rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-43683 Improper verification of the Host header in TimeProvider 4100
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Microchip
product: TimeProvider 4100
default_status: unknown
Credits: lang: en
value: Armando Huesca Prida
lang: en
value: Marco Negro
lang: en
value: Antonio Carriero
lang: en
value: Vito Pistillo
lang: en
value: Davide Renna
lang: en
value: Manuel Leone
lang: en
value: Massimiliano Brolli
lang: en
value: TIM Security Red Team Research
Published: 2024-10-04T19:56:15.872Z
CVE-2024-43684 Cross-Site Request Forgery vulnerability in TimeProvider 4100
Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Microchip
product: TimeProvider 4100
default_status: unknown
Credits: lang: en
value: Armando Huesca Prida
lang: en
value: Marco Negro
lang: en
value: Antonio Carriero
lang: en
value: Vito Pistillo
lang: en
value: Davide Renna
lang: en
value: Manuel Leone
lang: en
value: Massimiliano Brolli
lang: en
value: TIM Security Red Team Research
Published: 2024-10-04T19:51:51.926Z
CVE-2024-43685 Session token fixation in TimeProvider 4100
Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Microchip
product: TimeProvider 4100
default_status: unaffected
Credits: lang: en
value: Armando Huesca Prida
lang: en
value: Marco Negro
lang: en
value: Antonio Carriero
lang: en
value: Vito Pistillo
lang: en
value: Davide Renna
lang: en
value: Manuel Leone
lang: en
value: Massimiliano Brolli
lang: en
value: TIM Security Red Team Research
Published: 2024-10-04T19:48:53.595Z
CVE-2024-43686 Reflected XSS in TimeProvider 4100 chart component
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Microchip
product: TimeProvider 4100
default_status: unaffected
Credits: lang: en
value: Armando Huesca Prida
lang: en
value: Marco Negro
lang: en
value: Antonio Carriero
lang: en
value: Vito Pistillo
lang: en
value: Davide Renna
lang: en
value: Manuel Leone
lang: en
value: Massimiliano Brolli
lang: en
value: TIM Security Red Team Research
Published: 2024-10-04T19:47:06.117Z
CVE-2024-43687 XSS vulnerability in bannerconfig endpoint in TimeProvider 4100
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Microchip
product: TimeProvider 4100
default_status: unaffected
Credits: lang: en
value: Armando Huesca Prida
lang: en
value: Marco Negro
lang: en
value: Antonio Carriero
lang: en
value: Vito Pistillo
lang: en
value: Davide Renna
lang: en
value: Manuel Leone
lang: en
value: Massimiliano Brolli
lang: en
value: TIM Security Red Team Research
Published: 2024-10-04T19:41:15.354Z
CVE-2024-43688 
cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-43689 
Stack-based buffer overflow vulnerability exists in ELECOM wireless access points. By processing a specially crafted HTTP request, arbitrary code may be executed.
Problem types: cwe_id: CWE-121
description: Stack-based buffer overflow
Affected products: vendor: ELECOM CO.,LTD.
product: WAB-I1750-PS
vendor: ELECOM CO.,LTD.
product: WAB-M1775-PS
vendor: ELECOM CO.,LTD.
product: WAB-S1167-PS
vendor: ELECOM CO.,LTD.
product: WAB-S1775
vendor: ELECOM CO.,LTD.
product: WAB-S733MI
Published: 2024-10-21T01:27:15.253Z
CVE-2024-43690 
Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).

This issue affects: Command Centre Server and Command Centre Workstations 9.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior.
Problem types: cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: Gallagher
product: Command Centre Server
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-09-11T04:04:19.129Z
CVE-2024-43692 Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or Channel
An attacker can directly request the ProGauge MAGLINK LX CONSOLE 
resource sub page with full privileges by requesting the URL directly.
Problem types: cwe_id: CWE-288
description: CWE-288
Affected products: vendor: Dover Fueling Solutions (DFS)
product: ProGauge MAGLINK LX CONSOLE
default_status: unaffected
vendor: Dover Fueling Solutions (DFS)
product: ProGauge MAGLINK LX4 CONSOLE
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Pedro Umbelino of Bitsight reported these vulnerabilities to CISA.
Published: 2024-09-24T23:46:12.640Z
CVE-2024-43693 Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection
A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE 
UTILITY sub-menu can allow a remote attacker to inject arbitrary 
commands.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: Dover Fueling Solutions (DFS)
product: ProGauge MAGLINK LX CONSOLE
default_status: unaffected
vendor: Dover Fueling Solutions (DFS)
product: ProGauge MAGLINK LX4 CONSOLE
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Pedro Umbelino of Bitsight reported these vulnerabilities to CISA.
Published: 2024-09-24T23:50:10.531Z
CVE-2024-43694 goTenna Pro ATAK Plugin Insecure Storage of Sensitive Information
In the goTenna Pro ATAK Plugin application, the encryption keys are 
stored along with a static IV on the device. This allows for complete 
decryption of keys stored on the device. This allows an attacker to 
decrypt all encrypted broadcast communications based on broadcast keys 
stored on the device.
Problem types: cwe_id: CWE-922
description: CWE-922 Insecure Storage of Sensitive Information
Affected products: vendor: goTenna
product: Pro ATAK Plugin
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Erwin Karincic, Clayton Smith, and Dale Wooden reported this these vulnerabilities to CISA.
Published: 2024-09-26T17:25:52.840Z
CVE-2024-43696 Liteos_a has an Memory Leak vulnerability
in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS by memory leak.
Problem types: cwe_id: CWE-401
description: CWE-401 Missing Release of Memory after Effective Lifetime
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-10-08T03:03:41.262Z
CVE-2024-43697 Liteos_a has an Improper Input Validation vulnerability
in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-10-08T03:03:46.535Z
CVE-2024-43698 Kieback&Peter DDC4000 Series Use of Weak Credentials
Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system.
Problem types: cwe_id: CWE-1391
description: CWE-1391 Use of Weak Credentials
Affected products: vendor: Kieback&Peter
product: DDC4040e
default_status: unaffected
vendor: Kieback&Peter
product: DDC4020e
default_status: unaffected
vendor: Kieback&Peter
product: DDC4400e
default_status: unaffected
vendor: Kieback&Peter
product: DDC4200e
default_status: unaffected
vendor: Kieback&Peter
product: DDC4002e
default_status: unaffected
vendor: Kieback&Peter
product: DDC4400
default_status: unaffected
vendor: Kieback&Peter
product: DDC4200-L
default_status: unaffected
vendor: Kieback&Peter
product: DDC4200
default_status: unaffected
vendor: Kieback&Peter
product: DDC4100
default_status: unaffected
vendor: Kieback&Peter
product: DDC4002
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Raphael Ruf of terreActive AG reported these vulnerabilities to CISA.
Published: 2024-10-22T21:23:17.403Z
CVE-2024-43699 Delta Electronics DIAEnergie SQL Injection
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Delta Electronics
product: DIAEnergie
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2024-10-03T22:28:35.364Z
CVE-2024-43700 
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
Problem types: description: Stack-based buffer overflow
Affected products: vendor: Philip Hazel
product: xfpt
Published: 2024-08-29T07:36:13.470Z
CVE-2024-43701 GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices
Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
cwe_id: CWE-362
description: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unaffected
Published: 2024-10-14T08:17:01.686Z
CVE-2024-43702 GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages
Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page.
Problem types: cwe_id: CWE-280
description: CWE - CWE-280: Improper Handling of Insufficient Permissions or Privileges (4.15)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2024-11-30T02:30:25.404Z
CVE-2024-43703 GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF
Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physical memory from the GPU HW.
Problem types: cwe_id: CWE-416
description: CWE - CWE-416: Use After Free (4.16)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2024-11-30T02:39:25.336Z
CVE-2024-43704 GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process.
Problem types: cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2024-11-18T04:54:20.225Z
CVE-2024-43705 GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)
Software installed and run as a non-privileged user can trigger the GPU kernel driver to write to arbitrary read-only system files that have been mapped into application memory.
Problem types: cwe_id: CWE-280
description: CWE - CWE-280: Improper Handling of Insufficient Permissions or Privileges (4.15)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2024-12-28T04:58:08.905Z
CVE-2024-43706 Kibana Improper Authorization
Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Published: 2025-06-10T16:59:54.945Z
CVE-2024-43707 Kibana exposure of sensitive information to an unauthorized actor
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-01-23T06:08:10.724Z
CVE-2024-43708 
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-01-23T10:27:30.753Z
CVE-2024-43709 Elasticsearch allocation of resources without limits or throttling leads to crash
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Elastic
product: Elasticsearch
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-01-21T11:00:11.403Z
CVE-2024-43710 Kibana server-side request forgery
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-01-23T06:06:38.572Z
CVE-2024-43712 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a user-controllable source is improperly sanitized before being used in the Document Object Model (DOM) of a web page, leading to the execution of malicious scripts. Exploitation of this issue requires user interaction, such as tricking a victim into clicking a link or navigating to a malicious website.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (DOM-based XSS) (CWE-79)
Affected products: vendor: Adobe
product: Adobe Experience Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.4
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: CHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 5.4
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-12-10T22:04:35.949Z
CVE-2024-43713 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated URL or page with the malicious script.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (DOM-based XSS) (CWE-79)
Affected products: vendor: Adobe
product: Adobe Experience Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.4
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: CHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 5.4
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-12-10T22:05:02.851Z