rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-40705 IBM InfoSphere Information Server denial of service
IBM InfoSphere Information Server could allow an authenticated user to consume file space resources due to unrestricted file uploads.  IBM X-Force ID:  298279.
Problem types: cwe_id: CWE-405
description: CWE-405 Asymmetric Resource Consumption (Amplification)
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-08-15T16:48:03.025Z
CVE-2024-40706 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could allow a remote user to obtain sensitive version information that could aid in further attacks against the system.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-24T15:20:36.596Z
CVE-2024-40709 
A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level.
Affected products: vendor: Veeam
product: Backup and Recovery
default_status: unaffected
Published: 2024-09-07T16:11:22.216Z
CVE-2024-40710 
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role within Veeam Backup & Replication.
Affected products: vendor: Veeam
product: Backup and Recovery
default_status: unaffected
Published: 2024-09-07T16:11:22.182Z
CVE-2024-40711 
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
Affected products: vendor: Veeam
product: Backup and  Recovery
default_status: unaffected
Published: 2024-09-07T16:11:22.213Z
CVE-2024-40712 
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).
Affected products: vendor: Veeam
product: Backup and Recovery
default_status: unaffected
Published: 2024-09-07T16:11:22.203Z
CVE-2024-40713 
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.
Affected products: vendor: Veeam
product: Backup and Recovery
default_status: unaffected
Published: 2024-09-07T16:11:22.216Z
CVE-2024-40714 
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.
Affected products: vendor: Veeam
product: Backup and Recovery
default_status: unaffected
Published: 2024-09-07T16:11:22.237Z
CVE-2024-40715 
A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle (MITM) attack to exploit this vulnerability.
Affected products: vendor: Veeam
product: Enterprise Manager
default_status: unaffected
Published: 2024-11-07T16:40:37.566Z
CVE-2024-40717 
A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The user can update a job and schedule it to run almost immediately, allowing arbitrary code execution on the server.
Affected products: vendor: Veeam
product: Backup & Replication
default_status: unaffected
Published: 2024-12-04T01:06:04.636Z
CVE-2024-40718 
A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability.
Affected products: vendor: Veeam
product: Nutanix AHV
default_status: unaffected
vendor: Veeam
product: Nutanix KVM
default_status: unaffected
Published: 2024-09-07T16:11:22.238Z
CVE-2024-40719 CHANGING Information Technology TCBServiSign Windows Version - Inadequate Encryption Strength
The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that website as a legitimate server and interact with it.
Problem types: cwe_id: CWE-326
description: CWE-326 Inadequate Encryption Strength
Affected products: vendor: CHANGING Information Technology
product: TCBServiSign Windows Version
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-08-02T10:05:24.168Z
CVE-2024-40720 CHANGING Information Technology TCBServiSign Windows Version - Improper Input Validation
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can modify the `HKEY_CURRENT_USER` registry to execute arbitrary commands.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: CHANGING Information Technology
product: TCBServiSign Windows Version
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-02T10:10:16.249Z
CVE-2024-40721 CHANGING Information Technology TCBServiSign Windows Version - Improper Input Validation
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause the TCBServiSign to load a DLL from an arbitrary path.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: CHANGING Information Technology
product: TCBServiSign Windows Version
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-02T10:14:39.889Z
CVE-2024-40722 CHANGING Information Technology TCBServiSign Windows Version - Stack-based Buffer Overflow
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause a stack-based buffer overflow in the TCBServiSign, temporarily disrupting its service.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: CHANGING Information Technology
product: TCBServiSign Windows Version
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-08-02T10:18:36.629Z
CVE-2024-40723 CHANGING Information Technology HWATAIServiSign Windows Version - Stack-based Buffer Overflow
The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-side inputs. When a user visits a spoofed website, unauthenticated remote attackers can cause a stack-based buffer overflow in the HWATAIServiSign, temporarily disrupting its service.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: CHANGING Information Technology
product: HWATAIServiSign Windows Version
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-08-02T10:27:07.987Z
CVE-2024-40724 
Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.
Problem types: description: Heap-based buffer overflow
Affected products: vendor: Open Asset Import Library
product: Assimp
Published: 2024-07-19T07:38:28.057Z
CVE-2024-40725 Apache HTTP Server: source code disclosure with handlers configured via AddType
A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

Users are recommended to upgrade to version 2.4.62, which fixes this issue.


Problem types: cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
default_status: unaffected
Published: 2024-07-18T09:32:43.929Z
CVE-2024-40726 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/{id}/edit/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40727 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/add/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40728 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/{id}/edit/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40729 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/add/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40730 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/{id}/edit/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40731 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/{id}/edit/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40732 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40733 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/{id}/edit/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40734 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/add/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40735 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/{id}/edit/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40736 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40737 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40738 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/{id}/edit/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40739 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40740 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/{id}/edit/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40741 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at /circuits/circuits/{id}/edit/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40742 
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at /circuits/circuits/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40743 [20240805] - Core - XSS vectors in Outputfilter::strip* methods
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Jesper den Boer
Published: 2024-08-20T16:03:45.461Z
CVE-2024-40744 Extension - tassos.gr - Unrestricted file upload in Convert Forms component for Joomla < 4.4.8
Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: tassos.gr
product: Convert Forms component for Joomla
default_status: unaffected
Credits: lang: en
value: Horizon Security’s Offensive Team
Published: 2024-12-04T15:01:50.739Z
CVE-2024-40745 Extension - tassos.gr - Reflected Cross site scripting vulnerability in Convert Forms component for Joomla < 4.4.8
Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tassos.gr
product: Convert Forms component for Joomla
default_status: unaffected
Credits: lang: en
value: Horizon Security’s Offensive Team
Published: 2024-12-04T15:02:05.517Z
CVE-2024-40746 Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla < 5.1.1
A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `description `parameter is not sanitised in the backend.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: hikashop.com
product: HikaShop component for Joomla
default_status: unaffected
Credits: lang: en
value: Catalin Iovita, https://github.com/cataliniovita
Published: 2024-10-21T16:16:32.627Z
CVE-2024-40747 [20250101] - Core - XSS vectors in module chromes
Various module chromes didn't properly process inputs, leading to XSS vectors.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Catalin Iovita
Published: 2025-01-07T16:22:02.501Z
CVE-2024-40748 [20250102] - Core - XSS vector in the id attribute of menu lists
Lack of output escaping in the id attribute of menu lists.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Lokesh Dachepalli
Published: 2025-01-07T16:22:00.896Z
CVE-2024-40749 [20250103] - Core - Read ACL violation in multiple core views
Improper Access Controls allows access to protected views.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Dominik Ziegelmüller
Published: 2025-01-07T16:22:12.593Z
CVE-2024-40750 
Linksys Velop Pro 6E 1.0.8 MX6200_1.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-40754 
Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Samsung Open Source
product: Escargot
default_status: unaffected
Credits: lang: en
value: Jeonil Ji, Sunghoon Jang
Published: 2024-09-10T10:48:51.493Z
CVE-2024-40761 Apache Answer: Avatar URL leaked user email addresses
Inadequate Encryption Strength vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Problem types: cwe_id: CWE-326
description: CWE-326 Inadequate Encryption Strength
Affected products: vendor: Apache Software Foundation
product: Apache Answer
default_status: unaffected
Credits: lang: en
value: 张岳熙
Published: 2024-09-25T07:31:08.416Z
CVE-2024-40762 
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predicted by an attacker potentially resulting in authentication bypass.
Problem types: cwe_id: CWE-338
description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Affected products: vendor: SonicWall
product: SonicOS
default_status: unknown
Credits: lang: en
value: Daan Keuper, Thijs Alkemade and Khaled Nassar of Computest Security through Trend Micro (Zero Day Initiative)
Published: 2025-01-09T06:43:25.000Z
CVE-2024-40763 
Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: SonicWall
product: SMA100
default_status: unknown
Credits: lang: en
value: Alain Mowat of Orange Cyberdefense, Switzerland.
Published: 2024-12-05T13:39:19.644Z
CVE-2024-40764 
Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS).
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: SonicWall
product: SonicOS
default_status: unknown
Published: 2024-07-18T07:42:37.995Z
CVE-2024-40765 
An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a specially crafted IKEv2 payload.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: SonicWall
product: SonicOS
default_status: unknown
Credits: lang: en
value: Yue Liu & n3k from TIANGONG Team of Legendsec at QI-ANXIN Group
Published: 2025-01-09T07:12:40.644Z
CVE-2024-40766 
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: SonicWall
product: SonicOS
default_status: unknown
Published: 2024-08-23T06:19:07.229Z