stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2024-2619 (severity: MEDIUM, weakness: CWE-79)
The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary HTML in pages that will be shown whenever a user accesses an injected page.
CVE-2024-26190 (severity: HIGH, weakness: CWE-400)
Microsoft QUIC Denial of Service Vulnerability
CVE-2024-26191 (severity: HIGH, weakness: CWE-122)
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
CVE-2024-26192 (severity: HIGH, weakness: CWE-359)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-26193 (severity: MEDIUM, weakness: CWE-285)
Azure Migrate Remote Code Execution Vulnerability
CVE-2024-26194 (severity: HIGH, weakness: CWE-347)
Secure Boot Security Feature Bypass Vulnerability
CVE-2024-26195 (severity: HIGH, weakness: CWE-122)
DHCP Server Service Remote Code Execution Vulnerability
CVE-2024-26196 (severity: MEDIUM, weakness: CWE-259)
Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability
CVE-2024-26197 (severity: MEDIUM, weakness: CWE-20)
Windows Standards-Based Storage Management Service Denial of Service Vulnerability
CVE-2024-26198 (severity: HIGH, weakness: CWE-426)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2024-26199 (severity: HIGH, weakness: CWE-59)
Microsoft Office Elevation of Privilege Vulnerability
CVE-2024-2620 (severity: CRITICAL, weakness: CWE-89)
A vulnerability has been found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this vulnerability is an unknown functionality of the file api/client/down_file.php. The manipulation of the argument uuid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257197 was assigned to this vulnerability.
CVE-2024-26200 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-26201 (severity: MEDIUM, weakness: CWE-284)
Microsoft Intune Linux Agent Elevation of Privilege Vulnerability
CVE-2024-26202 (severity: HIGH, weakness: CWE-122)
DHCP Server Service Remote Code Execution Vulnerability
CVE-2024-26203 (severity: HIGH, weakness: CWE-284)
Azure Data Studio Elevation of Privilege Vulnerability
CVE-2024-26204 (severity: HIGH, weakness: CWE-77)
Outlook for Android Information Disclosure Vulnerability
CVE-2024-26205 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-26207 (severity: MEDIUM, weakness: CWE-125)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-26208 (severity: HIGH, weakness: CWE-191)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2024-26209 (severity: MEDIUM, weakness: CWE-908)
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
CVE-2024-2621 (severity: CRITICAL, weakness: CWE-89)
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this issue is some unknown functionality of the file api/client/user/pwd_update.php. The manipulation of the argument uuid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257198 is the identifier assigned to this vulnerability.
CVE-2024-26210 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-26211 (severity: HIGH, weakness: CWE-122)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2024-26212 (severity: HIGH, weakness: CWE-400)
DHCP Server Service Denial of Service Vulnerability
CVE-2024-26213 (severity: HIGH, weakness: CWE-822)
Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2024-26214 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability
CVE-2024-26215 (severity: HIGH, weakness: CWE-400)
DHCP Server Service Denial of Service Vulnerability
CVE-2024-26216 (severity: HIGH, weakness: CWE-59)
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
CVE-2024-26217 (severity: LOW, weakness: CWE-125)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-26218 (severity: HIGH, weakness: CWE-367)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-26219 (severity: HIGH, weakness: CWE-476)
HTTP.sys Denial of Service Vulnerability
CVE-2024-2622 (severity: CRITICAL, weakness: CWE-89)
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318. It has been classified as critical. This affects an unknown part of the file /api/client/editemedia.php. The manipulation of the argument number/enterprise_uuid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257199.
CVE-2024-26220 (severity: MEDIUM, weakness: CWE-908)
Windows Mobile Hotspot Information Disclosure Vulnerability
CVE-2024-26221 (severity: MEDIUM, weakness: CWE-416)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2024-26222 (severity: MEDIUM, weakness: CWE-416)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2024-26223 (severity: MEDIUM, weakness: CWE-416)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2024-26224 (severity: MEDIUM, weakness: CWE-416)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2024-26226 (severity: MEDIUM, weakness: CWE-125)
Windows Distributed File System (DFS) Information Disclosure Vulnerability
CVE-2024-26227 (severity: MEDIUM, weakness: CWE-416)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2024-26228 (severity: HIGH, weakness: CWE-310)
Windows Cryptographic Services Security Feature Bypass Vulnerability
CVE-2024-26229 (severity: HIGH, weakness: CWE-122)
Windows CSC Service Elevation of Privilege Vulnerability
CVE-2024-2623 (severity: MEDIUM, weakness: CWE-79)
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's message parameter in all versions up to, and including, 5.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-26230 (severity: HIGH, weakness: CWE-416)
Windows Telephony Server Elevation of Privilege Vulnerability
CVE-2024-26231 (severity: MEDIUM, weakness: CWE-416)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2024-26232 (severity: HIGH, weakness: CWE-843)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2024-26233 (severity: MEDIUM, weakness: CWE-416)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2024-26234 (severity: MEDIUM, weakness: CWE-284)
Proxy Driver Spoofing Vulnerability
CVE-2024-26235 (severity: HIGH, weakness: CWE-306)
Windows Update Stack Elevation of Privilege Vulnerability
CVE-2024-26236 (severity: HIGH, weakness: CWE-591)
Windows Update Stack Elevation of Privilege Vulnerability
CVE-2024-26237 (severity: HIGH, weakness: CWE-416)
Windows Defender Credential Guard Elevation of Privilege Vulnerability
CVE-2024-26238 (severity: HIGH, weakness: CWE-59)
Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability
CVE-2024-26239 (severity: HIGH, weakness: CWE-122)
Windows Telephony Server Elevation of Privilege Vulnerability
CVE-2024-2624 (severity: CRITICAL, weakness: CWE-29)
A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_personal_path")` endpoint in `./lollms-webui/lollms_core/lollms/server/endpoints/lollms_user.py`. The vulnerability arises due to insufficient sanitization of user-supplied input for the `path` parameter, allowing an attacker to specify arbitrary file system paths. This flaw enables direct arbitrary file uploads, leakage of `personal_data`, and overwriting of configurations in `lollms-webui`->`configs` by exploiting the same named directory in `personal_data`. The issue affects the latest version of the application and is fixed in version 9.4. Successful exploitation could lead to sensitive information disclosure, unauthorized file uploads, and potentially remote code execution by overwriting critical configuration files.
CVE-2024-26240 (severity: HIGH, weakness: CWE-20)
Secure Boot Security Feature Bypass Vulnerability
CVE-2024-26241 (severity: HIGH, weakness: CWE-416)
Win32k Elevation of Privilege Vulnerability
CVE-2024-26242 (severity: HIGH, weakness: CWE-591)
Windows Telephony Server Elevation of Privilege Vulnerability
CVE-2024-26243 (severity: HIGH, weakness: CWE-126)
Windows USB Print Driver Elevation of Privilege Vulnerability
CVE-2024-26244 (severity: HIGH, weakness: CWE-191)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-26245 (severity: HIGH, weakness: CWE-125)
Windows SMB Elevation of Privilege Vulnerability
CVE-2024-26246 (severity: LOW, weakness: CWE-1220)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2024-26247 (severity: MEDIUM, weakness: CWE-269)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2024-26248 (severity: HIGH, weakness: CWE-303)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2024-2625 (severity: HIGH, weakness: NVD-CWE-Other)
Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-26250 (severity: MEDIUM, weakness: CWE-693)
Secure Boot Security Feature Bypass Vulnerability
CVE-2024-26251 (severity: LOW, weakness: CWE-79)
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2024-26252 (severity: MEDIUM, weakness: CWE-822)
Windows rndismp6.sys Remote Code Execution Vulnerability
CVE-2024-26253 (severity: MEDIUM, weakness: CWE-20)
Windows rndismp6.sys Remote Code Execution Vulnerability
CVE-2024-26254 (severity: HIGH, weakness: CWE-822)
Microsoft Virtual Machine Bus (VMBus) Denial of Service Vulnerability
CVE-2024-26255 (severity: MEDIUM, weakness: CWE-126)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-26256 (severity: HIGH, weakness: CWE-122)
Libarchive Remote Code Execution Vulnerability
CVE-2024-26257 (severity: HIGH, weakness: CWE-415)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-26258 (severity: MEDIUM, weakness: CWE-78)
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with credentials to execute arbitrary OS commands by sending a specially crafted request to the product.
CVE-2024-2626 (severity: MEDIUM, weakness: CWE-125)
Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-26260 (severity: CRITICAL, weakness: CWE-78)
The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.
CVE-2024-26261 (severity: CRITICAL, weakness: CWE-22)
The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.
CVE-2024-26262 (severity: HIGH, weakness: CWE-89)
EBM Technologies Uniweb/SoliPACS WebServer's query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo privilege in the database for privilege escalation, elevating their privileges to administrator .
CVE-2024-26263 (severity: HIGH, weakness: CWE-306)
EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data without login.
CVE-2024-26264 (severity: CRITICAL, weakness: CWE-89)
EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.
CVE-2024-26265 (severity: MEDIUM, weakness: CWE-770)
The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by modifying the `maxFileSize` parameter.
CVE-2024-26266 (severity: MEDIUM, weakness: CWE-79)
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget.
CVE-2024-26267 (severity: MEDIUM, weakness: CWE-1188)
In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header.
CVE-2024-26268 (severity: MEDIUM, weakness: CWE-203)
User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.
CVE-2024-26269 (severity: MEDIUM, weakness: CWE-79)
Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.
CVE-2024-2627 (severity: HIGH, weakness: CWE-416)
Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-26270 (severity: MEDIUM, weakness: CWE-201)
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
CVE-2024-26271 (severity: HIGH, weakness: CWE-352)
Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter.
CVE-2024-26272 (severity: HIGH, weakness: CWE-352)
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.
CVE-2024-26273 (severity: HIGH, weakness: CWE-352)
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter.
CVE-2024-26275 (severity: HIGH, weakness: CWE-125)
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-26276 (severity: MEDIUM, weakness: CWE-770)
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected application contains a stack exhaustion vulnerability while parsing a specially crafted X_T file. This could allow an attacker to cause denial of service condition.
CVE-2024-26277 (severity: MEDIUM, weakness: CWE-476)
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted X_T files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVE-2024-26278 (severity: MEDIUM, weakness: CWE-79)
The Custom Fields component not correctly filter inputs, leading to a XSS vector.
CVE-2024-26279 (severity: MEDIUM, weakness: CWE-79)
The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
CVE-2024-2628 (severity: MEDIUM, weakness: CWE-474)
Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted URL. (Chromium security severity: Medium)
CVE-2024-26280 (severity: MEDIUM, weakness: CWE-276)
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
CVE-2024-26281 (severity: MEDIUM, weakness: CWE-79)
Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. This vulnerability affects Firefox for iOS < 123.
CVE-2024-26282 (severity: HIGH, weakness: CWE-80)
Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iOS < 123.
CVE-2024-26283 (severity: HIGH, weakness: CWE-83)
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.
CVE-2024-26284 (severity: MEDIUM, weakness: CWE-79)
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacker's website. This vulnerability affects Focus for iOS < 123.
CVE-2024-26288 (severity: HIGH, weakness: CWE-319)
An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected.
CVE-2024-26289 (severity: CRITICAL, weakness: CWE-502)
Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.
CVE-2024-2629 (severity: MEDIUM, weakness: NVD-CWE-Other)
Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-26290 (severity: HIGH, weakness: CWE-20)
Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Linux, Avid System Director Appliance (SDA+) on Linux allows code execution on underlying operating system with root permissions.This issue affects Avid NEXIS E-series: before 2024.6.0; Avid NEXIS F-series: before 2024.6.0; Avid NEXIS PRO+: before 2024.6.0; System Director Appliance (SDA+): before 2024.6.0.
CVE-2024-26294 (severity: HIGH, weakness: CWE-77)
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
CVE-2024-26295 (severity: HIGH, weakness: CWE-77)
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
CVE-2024-26296 (severity: HIGH, weakness: CWE-77)
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.