csaf_ncscnl - ncsc-2025-0106

ncsc-2025-0106

Vulnerability from csaf_ncscnl

Published

2025-04-08 13:57

Modified

2025-04-08 13:57

Summary

Kwetsbaarheden verholpen in Siemens producten

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Siemens heeft kwetsbaarheden verholpen in diverse producten als Industrial Edge Devices, Mendix, SENTRON, SIDIS, SIMATIC, SIPLUS,Insights Hub Private Cloud, Siemens License Server en Solid Edge.

Interpretaties

De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service (DoS) - Manipulatie van gegevens - Omzeilen van een beveiligingsmaatregel - Omzeilen van authenticatie - (Remote) code execution (root/admin rechten) - (Remote) code execution (Gebruikersrechten) - Toegang tot systeemgegevens - Toegang tot gevoelige gegevens - Spoofing De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.

Oplossingen

Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.

Dreigingsinformatie

Kans

medium

Schade

high

CWE-287

Improper Authentication

CWE-1240

Use of a Cryptographic Primitive with a Risky Implementation

CWE-606

Unchecked Input for Loop Condition

CWE-1395

Dependency on Vulnerable Third-Party Component

CWE-363

Race Condition Enabling Link Following

CWE-420

Unprotected Alternate Channel

CWE-684

Incorrect Provision of Specified Functionality

CWE-834

Excessive Iteration

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-440

Expected Behavior Violation

CWE-754

Improper Check for Unusual or Exceptional Conditions

CWE-319

Cleartext Transmission of Sensitive Information

CWE-354

Improper Validation of Integrity Check Value

CWE-325

Missing Cryptographic Step

CWE-404

Improper Resource Shutdown or Release

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-1333

Inefficient Regular Expression Complexity

CWE-416

Use After Free

CWE-476

NULL Pointer Dereference

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-400

Uncontrolled Resource Consumption

CWE-787

Out-of-bounds Write

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-122

Heap-based Buffer Overflow

CWE-20

Improper Input Validation

CWE-1390

Weak Authentication

CWE-204

Observable Response Discrepancy

CWE-15

External Control of System or Configuration Setting

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-653

Improper Isolation or Compartmentalization

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-620

Unverified Password Change

CWE-798

Use of Hard-coded Credentials

CWE-269

Improper Privilege Management

CWE-295

Improper Certificate Validation

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Siemens heeft kwetsbaarheden verholpen in diverse producten als Industrial Edge Devices, Mendix, SENTRON, SIDIS, SIMATIC, SIPLUS,Insights Hub Private Cloud, Siemens License Server en Solid Edge.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service (DoS)\n- Manipulatie van gegevens\n- Omzeilen van een beveiligingsmaatregel\n- Omzeilen van authenticatie\n- (Remote) code execution (root/admin rechten)\n- (Remote) code execution (Gebruikersrechten)\n- Toegang tot systeemgegevens\n- Toegang tot gevoelige gegevens\n- Spoofing\n\nDe kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico\u0027s zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "description",
        "text": "  ",
        "title": "Dreigingsinformatie"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Use of a Cryptographic Primitive with a Risky Implementation",
        "title": "CWE-1240"
      },
      {
        "category": "general",
        "text": "Unchecked Input for Loop Condition",
        "title": "CWE-606"
      },
      {
        "category": "general",
        "text": "Dependency on Vulnerable Third-Party Component",
        "title": "CWE-1395"
      },
      {
        "category": "general",
        "text": "Race Condition Enabling Link Following",
        "title": "CWE-363"
      },
      {
        "category": "general",
        "text": "Unprotected Alternate Channel",
        "title": "CWE-420"
      },
      {
        "category": "general",
        "text": "Incorrect Provision of Specified Functionality",
        "title": "CWE-684"
      },
      {
        "category": "general",
        "text": "Excessive Iteration",
        "title": "CWE-834"
      },
      {
        "category": "general",
        "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
        "title": "CWE-367"
      },
      {
        "category": "general",
        "text": "Expected Behavior Violation",
        "title": "CWE-440"
      },
      {
        "category": "general",
        "text": "Improper Check for Unusual or Exceptional Conditions",
        "title": "CWE-754"
      },
      {
        "category": "general",
        "text": "Cleartext Transmission of Sensitive Information",
        "title": "CWE-319"
      },
      {
        "category": "general",
        "text": "Improper Validation of Integrity Check Value",
        "title": "CWE-354"
      },
      {
        "category": "general",
        "text": "Missing Cryptographic Step",
        "title": "CWE-325"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
        "title": "CWE-119"
      },
      {
        "category": "general",
        "text": "Inefficient Regular Expression Complexity",
        "title": "CWE-1333"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Use of a Broken or Risky Cryptographic Algorithm",
        "title": "CWE-327"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      },
      {
        "category": "general",
        "text": "Weak Authentication",
        "title": "CWE-1390"
      },
      {
        "category": "general",
        "text": "Observable Response Discrepancy",
        "title": "CWE-204"
      },
      {
        "category": "general",
        "text": "External Control of System or Configuration Setting",
        "title": "CWE-15"
      },
      {
        "category": "general",
        "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
        "title": "CWE-22"
      },
      {
        "category": "general",
        "text": "Improper Isolation or Compartmentalization",
        "title": "CWE-653"
      },
      {
        "category": "general",
        "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
        "title": "CWE-94"
      },
      {
        "category": "general",
        "text": "Unverified Password Change",
        "title": "CWE-620"
      },
      {
        "category": "general",
        "text": "Use of Hard-coded Credentials",
        "title": "CWE-798"
      },
      {
        "category": "general",
        "text": "Improper Privilege Management",
        "title": "CWE-269"
      },
      {
        "category": "general",
        "text": "Improper Certificate Validation",
        "title": "CWE-295"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-187636.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-277137.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-525431.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-634640.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-672923.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-725549.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-819629.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-874353.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-817234.pdf"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Siemens producten",
    "tracking": {
      "current_release_date": "2025-04-08T13:57:11.959816Z",
      "generator": {
        "date": "2025-02-25T15:15:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.0"
        }
      },
      "id": "NCSC-2025-0106",
      "initial_release_date": "2025-04-08T13:57:11.959816Z",
      "revision_history": [
        {
          "date": "2025-04-08T13:57:11.959816Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv1.21.1-1-a",
                "product": {
                  "name": "vers:unknown/\u003cv1.21.1-1-a",
                  "product_id": "CSAFPID-2631845"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Own Device (IEOD)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv1.21.1-1",
                "product": {
                  "name": "vers:unknown/\u003cv1.21.1-1",
                  "product_id": "CSAFPID-2631844"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - x86-64 V1.21"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv1.20.2-1",
                "product": {
                  "name": "vers:unknown/\u003cv1.20.2-1",
                  "product_id": "CSAFPID-2631843"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - x86-64 V1.20"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631842"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - x86-64 V1.19"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631841"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - x86-64 V1.18"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631840"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - x86-64 V1.17"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv1.21.1-1",
                "product": {
                  "name": "vers:unknown/\u003cv1.21.1-1",
                  "product_id": "CSAFPID-2631839"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - arm64 V1.21"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv1.20.2-1",
                "product": {
                  "name": "vers:unknown/\u003cv1.20.2-1",
                  "product_id": "CSAFPID-2631838"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - arm64 V1.20"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631837"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - arm64 V1.19"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631836"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - arm64 V1.18"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631835"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Device Kit - arm64 V1.17"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631900"
                }
              }
            ],
            "category": "product_name",
            "name": "SENTRON 7KT PAC1260 Data Manager"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/4.0",
                "product": {
                  "name": "vers:unknown/4.0",
                  "product_id": "CSAFPID-2632341"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/4.1",
                "product": {
                  "name": "vers:unknown/4.1",
                  "product_id": "CSAFPID-2632342"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/4.2",
                "product": {
                  "name": "vers:unknown/4.2",
                  "product_id": "CSAFPID-2632343"
                }
              }
            ],
            "category": "product_name",
            "name": "License Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv4.3",
                "product": {
                  "name": "vers:unknown/\u003cv4.3",
                  "product_id": "CSAFPID-2631790"
                }
              }
            ],
            "category": "product_name",
            "name": "Siemens License Server (SLS)"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:siemens/224.0 update 12",
                    "product": {
                      "name": "vers:siemens/224.0 update 12",
                      "product_id": "CSAFPID-2632460"
                    }
                  },
                  {
                    "category": "product_version_range",
                    "name": "vers:siemens/225.0 update 3",
                    "product": {
                      "name": "vers:siemens/225.0 update 3",
                      "product_id": "CSAFPID-2632459"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Solid Edge"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:siemens/v224.0 update 12",
                    "product": {
                      "name": "vers:siemens/v224.0 update 12",
                      "product_id": "CSAFPID-2632083"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Solid_Edge_Se2024"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:siemens/2.0 sp1",
                    "product": {
                      "name": "vers:siemens/2.0 sp1",
                      "product_id": "CSAFPID-1211926"
                    }
                  }
                ],
                "category": "product_name",
                "name": "SINEC Network Management System"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:unknown/none",
                    "product": {
                      "name": "vers:unknown/none",
                      "product_id": "CSAFPID-2619361"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Siemens Simatic S7-1500 Tm Mfp"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:unknown/\u003e=3|\u003c312",
                    "product": {
                      "name": "vers:unknown/\u003e=3|\u003c312",
                      "product_id": "CSAFPID-1209122"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Siemens Telecontrol Server Basic"
              }
            ],
            "category": "product_family",
            "name": "Siemens"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv224.0update12",
                "product": {
                  "name": "vers:unknown/\u003cv224.0update12",
                  "product_id": "CSAFPID-2631854"
                }
              }
            ],
            "category": "product_name",
            "name": "Solid Edge SE2024"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv225.0update3",
                "product": {
                  "name": "vers:unknown/\u003cv225.0update3",
                  "product_id": "CSAFPID-2631855"
                }
              }
            ],
            "category": "product_name",
            "name": "Solid Edge SE2025"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv2.0.0",
                "product": {
                  "name": "vers:unknown/\u003cv2.0.0",
                  "product_id": "CSAFPID-1296722"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC CFU DIQ"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv2.0",
                "product": {
                  "name": "vers:unknown/\u003cv2.0",
                  "product_id": "CSAFPID-2631923"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv2.0.0",
                "product": {
                  "name": "vers:unknown/\u003cv2.0.0",
                  "product_id": "CSAFPID-1296723"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC CFU PA"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631924"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200AL IM 157-1 PN"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631925"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200M IM 153-4 PN IO HF"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631926"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200M IM 153-4 PN IO ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631927"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200MP IM 155-5 PN BA"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631928"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200MP IM 155-5 PN HF"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631929"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200MP IM 155-5 PN ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631932"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200S IM 151-3 PN FO"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631933"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200S IM 151-3 PN HF"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631934"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200S IM 151-3 PN HS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631935"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200S IM 151-3 PN ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-1765658"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200S IM 151-8 PN/DP CPU"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-1765659"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200S IM 151-8F PN/DP CPU"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631856"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP CPU 1510SP F-1 PN"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631858"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP CPU 1510SP-1 PN"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631860"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP CPU 1512SP F-1 PN"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631862"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP CPU 1512SP-1 PN"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-1765660"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP IM 155-6 MF HF"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631936"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP IM 155-6 PN BA"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv1.3",
                "product": {
                  "name": "vers:unknown/\u003cv1.3",
                  "product_id": "CSAFPID-2631937"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631938"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP IM 155-6 PN HF"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631939"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP IM 155-6 PN HS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631940"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP IM 155-6 PN ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631920"
                }
              }
            ],
            "category": "product_name",
            "name": "SIDOOR ATD430W"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631921"
                }
              }
            ],
            "category": "product_name",
            "name": "SIDOOR ATE530G COATED"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631922"
                }
              }
            ],
            "category": "product_name",
            "name": "SIDOOR ATE530S COATED"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631967"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631968"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOCODE pro V PROFINET"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631969"
                }
              }
            ],
            "category": "product_name",
            "name": "SINUMERIK 840D sl"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2632004"
                }
              }
            ],
            "category": "product_name",
            "name": "SIWAREX WP231"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2632005"
                }
              }
            ],
            "category": "product_name",
            "name": "SIWAREX WP241"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2632006"
                }
              }
            ],
            "category": "product_name",
            "name": "SIWAREX WP251"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2632007"
                }
              }
            ],
            "category": "product_name",
            "name": "SIWAREX WP521 ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2632008"
                }
              }
            ],
            "category": "product_name",
            "name": "SIWAREX WP522 ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631966"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-1765690"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-1765691"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv8.3",
                "product": {
                  "name": "vers:unknown/\u003cv8.3",
                  "product_id": "CSAFPID-2459039"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631970"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200M IM 153-4 PN IO HF"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631971"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200M IM 153-4 PN IO ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631972"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200MP IM 155-5 PN HF"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631973"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631974"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200MP IM 155-5 PN ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631975"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200MP IM 155-5 PN ST TX RAIL"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-1765700"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200S IM 151-8 PN/DP CPU"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-1765701"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200S IM 151-8F PN/DP CPU"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631976"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200S IM151-3 PN HF"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631977"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200S IM151-3 PN ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-1296980"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200SP CPU 1512SP F-1 PN"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631978"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200SP IM 155-6 PN HF"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631979"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631980"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200SP IM 155-6 PN HF TX RAIL"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631981"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200SP IM 155-6 PN ST"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631982"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200SP IM 155-6 PN ST BA"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631983"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631984"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS ET 200SP IM 155-6 PN ST TX RAIL"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631985"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPLUS HCS4200 CIM4210"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/10.16.0",
                "product": {
                  "name": "vers:unknown/10.16.0",
                  "product_id": "CSAFPID-2632402"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv10.21.0",
                "product": {
                  "name": "vers:unknown/\u003cv10.21.0",
                  "product_id": "CSAFPID-2631802"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V10"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631803"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V10.12"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631804"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V10.18"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-2631805"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V10.6"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003c*",
                "product": {
                  "name": "vers:unknown/\u003c*",
                  "product_id": "CSAFPID-1296837"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V8"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/\u003cv9.24.34",
                "product": {
                  "name": "vers:unknown/\u003cv9.24.34",
                  "product_id": "CSAFPID-2631806"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V9"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-21658",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "other",
          "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
          "title": "CWE-367"
        },
        {
          "category": "other",
          "text": "Race Condition Enabling Link Following",
          "title": "CWE-363"
        },
        {
          "category": "other",
          "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
          "title": "CWE-362"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-21658",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-21658.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2022-21658"
    },
    {
      "cve": "CVE-2023-2975",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        },
        {
          "category": "other",
          "text": "Improper Validation of Integrity Check Value",
          "title": "CWE-354"
        },
        {
          "category": "other",
          "text": "Use of a Broken or Risky Cryptographic Algorithm",
          "title": "CWE-327"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-2975",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-2975.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2023-2975"
    },
    {
      "cve": "CVE-2023-3446",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        },
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "other",
          "text": "Inefficient Regular Expression Complexity",
          "title": "CWE-1333"
        },
        {
          "category": "other",
          "text": "Unchecked Input for Loop Condition",
          "title": "CWE-606"
        },
        {
          "category": "other",
          "text": "Use of a Cryptographic Primitive with a Risky Implementation",
          "title": "CWE-1240"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-3446",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3446.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2023-3446"
    },
    {
      "cve": "CVE-2023-3817",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        },
        {
          "category": "other",
          "text": "Excessive Iteration",
          "title": "CWE-834"
        },
        {
          "category": "other",
          "text": "Unchecked Input for Loop Condition",
          "title": "CWE-606"
        },
        {
          "category": "other",
          "text": "Use of a Cryptographic Primitive with a Risky Implementation",
          "title": "CWE-1240"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-3817",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3817.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2023-3817"
    },
    {
      "cve": "CVE-2023-4807",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "other",
          "text": "Expected Behavior Violation",
          "title": "CWE-440"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-4807",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4807.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2023-4807"
    },
    {
      "cve": "CVE-2023-5363",
      "cwe": {
        "id": "CWE-325",
        "name": "Missing Cryptographic Step"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Cryptographic Step",
          "title": "CWE-325"
        },
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "other",
          "text": "Incorrect Provision of Specified Functionality",
          "title": "CWE-684"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-5363",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5363.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2023-5363"
    },
    {
      "cve": "CVE-2023-5678",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Check for Unusual or Exceptional Conditions",
          "title": "CWE-754"
        },
        {
          "category": "other",
          "text": "Missing Cryptographic Step",
          "title": "CWE-325"
        },
        {
          "category": "other",
          "text": "Unchecked Input for Loop Condition",
          "title": "CWE-606"
        },
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-5678",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5678.json"
        }
      ],
      "title": "CVE-2023-5678"
    },
    {
      "cve": "CVE-2023-7104",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-7104",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-7104.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2023-7104"
    },
    {
      "cve": "CVE-2024-0056",
      "cwe": {
        "id": "CWE-420",
        "name": "Unprotected Alternate Channel"
      },
      "notes": [
        {
          "category": "other",
          "text": "Unprotected Alternate Channel",
          "title": "CWE-420"
        },
        {
          "category": "other",
          "text": "Cleartext Transmission of Sensitive Information",
          "title": "CWE-319"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-0056",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0056.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-0056"
    },
    {
      "cve": "CVE-2024-0232",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-0232",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0232.json"
        }
      ],
      "title": "CVE-2024-0232"
    },
    {
      "cve": "CVE-2024-0727",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-0727",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-0727"
    },
    {
      "cve": "CVE-2024-5535",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        },
        {
          "category": "other",
          "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
          "title": "CWE-119"
        },
        {
          "category": "other",
          "text": "Dependency on Vulnerable Third-Party Component",
          "title": "CWE-1395"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-5535",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-5535.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-5535"
    },
    {
      "cve": "CVE-2024-9143",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-9143",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-9143.json"
        }
      ],
      "title": "CVE-2024-9143"
    },
    {
      "cve": "CVE-2024-21319",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21319",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21319.json"
        }
      ],
      "title": "CVE-2024-21319"
    },
    {
      "cve": "CVE-2024-23814",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-23814",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-23814.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-23814"
    },
    {
      "cve": "CVE-2024-30105",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-30105",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-30105.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-30105"
    },
    {
      "cve": "CVE-2024-41788",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41788",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41788.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-41788"
    },
    {
      "cve": "CVE-2024-41789",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41789",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41789.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-41789"
    },
    {
      "cve": "CVE-2024-41790",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41790",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41790.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-41790"
    },
    {
      "cve": "CVE-2024-41791",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authentication for Critical Function",
          "title": "CWE-306"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41791",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41791.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-41791"
    },
    {
      "cve": "CVE-2024-41792",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41792",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41792.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-41792"
    },
    {
      "cve": "CVE-2024-41793",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authentication for Critical Function",
          "title": "CWE-306"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41793",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41793.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-41793"
    },
    {
      "cve": "CVE-2024-41794",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Hard-coded Credentials",
          "title": "CWE-798"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41794",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41794.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-41794"
    },
    {
      "cve": "CVE-2024-41795",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Cross-Site Request Forgery (CSRF)",
          "title": "CWE-352"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41795",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41795.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-41795"
    },
    {
      "cve": "CVE-2024-41796",
      "cwe": {
        "id": "CWE-620",
        "name": "Unverified Password Change"
      },
      "notes": [
        {
          "category": "other",
          "text": "Unverified Password Change",
          "title": "CWE-620"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41796",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41796.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-41796"
    },
    {
      "cve": "CVE-2024-54091",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54091",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54091.json"
        }
      ],
      "title": "CVE-2024-54091"
    },
    {
      "cve": "CVE-2024-54092",
      "cwe": {
        "id": "CWE-1390",
        "name": "Weak Authentication"
      },
      "notes": [
        {
          "category": "other",
          "text": "Weak Authentication",
          "title": "CWE-1390"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54092",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54092.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2024-54092"
    },
    {
      "cve": "CVE-2025-30280",
      "cwe": {
        "id": "CWE-204",
        "name": "Observable Response Discrepancy"
      },
      "notes": [
        {
          "category": "other",
          "text": "Observable Response Discrepancy",
          "title": "CWE-204"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-30280",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30280.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2025-30280"
    },
    {
      "cve": "CVE-2025-1097",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "other",
          "text": "External Control of System or Configuration Setting",
          "title": "CWE-15"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-1097",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-1097.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2025-1097"
    },
    {
      "cve": "CVE-2025-24514",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "other",
          "text": "External Control of System or Configuration Setting",
          "title": "CWE-15"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-24514",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24514.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2025-24514"
    },
    {
      "cve": "CVE-2025-24513",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-24513",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24513.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2025-24513"
    },
    {
      "cve": "CVE-2025-1974",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Isolation or Compartmentalization",
          "title": "CWE-653"
        },
        {
          "category": "other",
          "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
          "title": "CWE-94"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-1974",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-1974.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2025-1974"
    },
    {
      "cve": "CVE-2025-1098",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "other",
          "text": "External Control of System or Configuration Setting",
          "title": "CWE-15"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-1098",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-1098.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2025-1098"
    },
    {
      "cve": "CVE-2025-29999",
      "cwe": {
        "id": "CWE-269",
        "name": "Improper Privilege Management"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Privilege Management",
          "title": "CWE-269"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-29999",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-29999.json"
        }
      ],
      "title": "CVE-2025-29999"
    },
    {
      "cve": "CVE-2025-30000",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-2631845",
          "CSAFPID-2631844",
          "CSAFPID-2631843",
          "CSAFPID-2631842",
          "CSAFPID-2631841",
          "CSAFPID-2631840",
          "CSAFPID-2631839",
          "CSAFPID-2631838",
          "CSAFPID-2631837",
          "CSAFPID-2631836",
          "CSAFPID-2631835",
          "CSAFPID-2631900",
          "CSAFPID-2632341",
          "CSAFPID-2632342",
          "CSAFPID-2632343",
          "CSAFPID-2631790",
          "CSAFPID-2632460",
          "CSAFPID-2632459",
          "CSAFPID-2631854",
          "CSAFPID-2631855",
          "CSAFPID-2632083",
          "CSAFPID-1296722",
          "CSAFPID-2631923",
          "CSAFPID-1296723",
          "CSAFPID-2631924",
          "CSAFPID-2631925",
          "CSAFPID-2631926",
          "CSAFPID-2631927",
          "CSAFPID-2631928",
          "CSAFPID-2631929",
          "CSAFPID-2631932",
          "CSAFPID-2631933",
          "CSAFPID-2631934",
          "CSAFPID-2631935",
          "CSAFPID-1765658",
          "CSAFPID-1765659",
          "CSAFPID-2631856",
          "CSAFPID-2631858",
          "CSAFPID-2631860",
          "CSAFPID-2631862",
          "CSAFPID-1765660",
          "CSAFPID-2631936",
          "CSAFPID-2631937",
          "CSAFPID-2631938",
          "CSAFPID-2631939",
          "CSAFPID-2631940",
          "CSAFPID-2631920",
          "CSAFPID-2631921",
          "CSAFPID-2631922",
          "CSAFPID-2631967",
          "CSAFPID-2631968",
          "CSAFPID-2631969",
          "CSAFPID-2632004",
          "CSAFPID-2632005",
          "CSAFPID-2632006",
          "CSAFPID-2632007",
          "CSAFPID-2632008",
          "CSAFPID-2631966",
          "CSAFPID-1765690",
          "CSAFPID-1765691",
          "CSAFPID-2459039",
          "CSAFPID-2631970",
          "CSAFPID-2631971",
          "CSAFPID-2631972",
          "CSAFPID-2631973",
          "CSAFPID-2631974",
          "CSAFPID-2631975",
          "CSAFPID-1765700",
          "CSAFPID-1765701",
          "CSAFPID-2631976",
          "CSAFPID-2631977",
          "CSAFPID-1296980",
          "CSAFPID-2631978",
          "CSAFPID-2631979",
          "CSAFPID-2631980",
          "CSAFPID-2631981",
          "CSAFPID-2631982",
          "CSAFPID-2631983",
          "CSAFPID-2631984",
          "CSAFPID-2631985",
          "CSAFPID-2632402",
          "CSAFPID-2631802",
          "CSAFPID-2631803",
          "CSAFPID-2631804",
          "CSAFPID-2631805",
          "CSAFPID-1296837",
          "CSAFPID-2631806",
          "CSAFPID-1211926",
          "CSAFPID-2619361",
          "CSAFPID-1209122"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-30000",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30000.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-2631845",
            "CSAFPID-2631844",
            "CSAFPID-2631843",
            "CSAFPID-2631842",
            "CSAFPID-2631841",
            "CSAFPID-2631840",
            "CSAFPID-2631839",
            "CSAFPID-2631838",
            "CSAFPID-2631837",
            "CSAFPID-2631836",
            "CSAFPID-2631835",
            "CSAFPID-2631900",
            "CSAFPID-2632341",
            "CSAFPID-2632342",
            "CSAFPID-2632343",
            "CSAFPID-2631790",
            "CSAFPID-2632460",
            "CSAFPID-2632459",
            "CSAFPID-2631854",
            "CSAFPID-2631855",
            "CSAFPID-2632083",
            "CSAFPID-1296722",
            "CSAFPID-2631923",
            "CSAFPID-1296723",
            "CSAFPID-2631924",
            "CSAFPID-2631925",
            "CSAFPID-2631926",
            "CSAFPID-2631927",
            "CSAFPID-2631928",
            "CSAFPID-2631929",
            "CSAFPID-2631932",
            "CSAFPID-2631933",
            "CSAFPID-2631934",
            "CSAFPID-2631935",
            "CSAFPID-1765658",
            "CSAFPID-1765659",
            "CSAFPID-2631856",
            "CSAFPID-2631858",
            "CSAFPID-2631860",
            "CSAFPID-2631862",
            "CSAFPID-1765660",
            "CSAFPID-2631936",
            "CSAFPID-2631937",
            "CSAFPID-2631938",
            "CSAFPID-2631939",
            "CSAFPID-2631940",
            "CSAFPID-2631920",
            "CSAFPID-2631921",
            "CSAFPID-2631922",
            "CSAFPID-2631967",
            "CSAFPID-2631968",
            "CSAFPID-2631969",
            "CSAFPID-2632004",
            "CSAFPID-2632005",
            "CSAFPID-2632006",
            "CSAFPID-2632007",
            "CSAFPID-2632008",
            "CSAFPID-2631966",
            "CSAFPID-1765690",
            "CSAFPID-1765691",
            "CSAFPID-2459039",
            "CSAFPID-2631970",
            "CSAFPID-2631971",
            "CSAFPID-2631972",
            "CSAFPID-2631973",
            "CSAFPID-2631974",
            "CSAFPID-2631975",
            "CSAFPID-1765700",
            "CSAFPID-1765701",
            "CSAFPID-2631976",
            "CSAFPID-2631977",
            "CSAFPID-1296980",
            "CSAFPID-2631978",
            "CSAFPID-2631979",
            "CSAFPID-2631980",
            "CSAFPID-2631981",
            "CSAFPID-2631982",
            "CSAFPID-2631983",
            "CSAFPID-2631984",
            "CSAFPID-2631985",
            "CSAFPID-2632402",
            "CSAFPID-2631802",
            "CSAFPID-2631803",
            "CSAFPID-2631804",
            "CSAFPID-2631805",
            "CSAFPID-1296837",
            "CSAFPID-2631806",
            "CSAFPID-1211926",
            "CSAFPID-2619361",
            "CSAFPID-1209122"
          ]
        }
      ],
      "title": "CVE-2025-30000"
    }
  ]
}

CVE-2024-41791 (GCVE-0-2024-41791)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:20

Severity ?

7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-306 - Missing Authentication for Critical Function

Summary

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not authenticate report creation requests. This could allow an unauthenticated remote attacker to read or clear the log files on the device, reset the device or set the date and time.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Impacted products

	Vendor	Product	Version
	Siemens	SENTRON 7KT PAC1260 Data Manager	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41791",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:20:22.385619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:20:38.459Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SENTRON 7KT PAC1260 Data Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not authenticate report creation requests. This could allow an unauthenticated remote attacker to read or clear the log files on the device, reset the device or set the date and time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:05.720Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-41791",
    "datePublished": "2025-04-08T08:22:05.720Z",
    "dateReserved": "2024-07-22T13:19:53.376Z",
    "dateUpdated": "2025-04-08T13:20:38.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-0727 (GCVE-0-2024-0727)

Vulnerability from cvelistv5

Published

2024-01-26 08:57

Modified

2025-05-29 15:17

Severity ?

CWE

CWE-476 - NULL Pointer Dereference

Summary

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20240125.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a	patch
	https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c	patch
	https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2	patch
	https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8	patch
	https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.2.0 ≤ Version: 3.1.0 ≤ Version: 3.0.0 ≤ Version: 1.1.1 < 1.1.1x Version: 1.0.2 < 1.0.2zj

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:18:17.369Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20240125.txt"
          },
          {
            "name": "3.2.1 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a"
          },
          {
            "name": "3.1.5 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c"
          },
          {
            "name": "3.0.13 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2"
          },
          {
            "name": "1.1.1x git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8"
          },
          {
            "name": "1.0.2zj git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240208-0006/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/11/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-0727",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T20:15:21.221130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-29T15:17:17.376Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.2.1",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.5",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.13",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1x",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zj",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Bahaa Naamneh (Crosspoint Labs)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Matt Caswell"
        }
      ],
      "datePublic": "2024-01-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\u003cbr\u003eto crash leading to a potential Denial of Service attack\u003cbr\u003e\u003cbr\u003eImpact summary: Applications loading files in the PKCS12 format from untrusted\u003cbr\u003esources might terminate abruptly.\u003cbr\u003e\u003cbr\u003eA file in PKCS12 format can contain certificates and keys and may come from an\u003cbr\u003euntrusted source. The PKCS12 specification allows certain fields to be NULL, but\u003cbr\u003eOpenSSL does not correctly check for this case. This can lead to a NULL pointer\u003cbr\u003edereference that results in OpenSSL crashing. If an application processes PKCS12\u003cbr\u003efiles from an untrusted source using the OpenSSL APIs then that application will\u003cbr\u003ebe vulnerable to this issue.\u003cbr\u003e\u003cbr\u003eOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\u003cbr\u003ePKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\u003cbr\u003eand PKCS12_newpass().\u003cbr\u003e\u003cbr\u003eWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\u003cbr\u003efunction is related to writing data we do not consider it security significant.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."
            }
          ],
          "value": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:55:58.371Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20240125.txt"
        },
        {
          "name": "3.2.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a"
        },
        {
          "name": "3.1.5 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c"
        },
        {
          "name": "3.0.13 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2"
        },
        {
          "name": "1.1.1x git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8"
        },
        {
          "name": "1.0.2zj git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PKCS12 Decoding crashes",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2024-0727",
    "datePublished": "2024-01-26T08:57:19.579Z",
    "dateReserved": "2024-01-19T11:01:11.010Z",
    "dateUpdated": "2025-05-29T15:17:17.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3817 (GCVE-0-2023-3817)

Vulnerability from cvelistv5

Published

2023-07-31 15:34

Modified

2025-05-05 15:53

Severity ?

CWE

CWE-606 - Unchecked Input for Loop Condition

Summary

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20230731.txt	vendor-advisory
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.1.0 ≤ Version: 3.0.0 ≤ Version: 1.1.1 < 1.1.1v Version: 1.0.2 < 1.0.2zi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:08:50.496Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20230731.txt"
          },
          {
            "name": "3.1.2 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"
          },
          {
            "name": "3.0.10 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"
          },
          {
            "name": "1.1.1v git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5"
          },
          {
            "name": "1.0.2zi patch (premium)",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Jul/43"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230818-0014/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/09/22/9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/09/22/11"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231027-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/11/06/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202402-08"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-3817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:26:20.624850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T15:53:49.014Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.1.2",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.10",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1v",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zi",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Bernd Edlinger"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Tomas Mraz"
        }
      ],
      "datePublic": "2023-07-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\u003cbr\u003e\u003cbr\u003eImpact summary: Applications that use the functions DH_check(), DH_check_ex()\u003cbr\u003eor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\u003cbr\u003edelays. Where the key or parameters that are being checked have been obtained\u003cbr\u003efrom an untrusted source this may lead to a Denial of Service.\u003cbr\u003e\u003cbr\u003eThe function DH_check() performs various checks on DH parameters. After fixing\u003cbr\u003eCVE-2023-3446 it was discovered that a large q parameter value can also trigger\u003cbr\u003ean overly long computation during some of these checks. A correct q value,\u003cbr\u003eif present, cannot be larger than the modulus p parameter, thus it is\u003cbr\u003eunnecessary to perform these checks if q is larger than p.\u003cbr\u003e\u003cbr\u003eAn application that calls DH_check() and supplies a key or parameters obtained\u003cbr\u003efrom an untrusted source could be vulnerable to a Denial of Service attack.\u003cbr\u003e\u003cbr\u003eThe function DH_check() is itself called by a number of other OpenSSL functions.\u003cbr\u003eAn application calling any of those other functions may similarly be affected.\u003cbr\u003eThe other functions affected by this are DH_check_ex() and\u003cbr\u003eEVP_PKEY_param_check().\u003cbr\u003e\u003cbr\u003eAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\u003cbr\u003ewhen using the \"-check\" option.\u003cbr\u003e\u003cbr\u003eThe OpenSSL SSL/TLS implementation is not affected by this issue.\u003cbr\u003e\u003cbr\u003eThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."
            }
          ],
          "value": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-606",
              "description": "CWE-606 Unchecked Input for Loop Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:55:48.907Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20230731.txt"
        },
        {
          "name": "3.1.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"
        },
        {
          "name": "3.0.10 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"
        },
        {
          "name": "1.1.1v git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5"
        },
        {
          "name": "1.0.2zi patch (premium)",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Excessive time spent checking DH q parameter value",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2023-3817",
    "datePublished": "2023-07-31T15:34:13.627Z",
    "dateReserved": "2023-07-21T08:47:25.638Z",
    "dateUpdated": "2025-05-05T15:53:49.014Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41788 (GCVE-0-2024-41788)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:24

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Impacted products

	Vendor	Product	Version
	Siemens	SENTRON 7KT PAC1260 Data Manager	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41788",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:24:09.499048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:24:24.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SENTRON 7KT PAC1260 Data Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:00.872Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-41788",
    "datePublished": "2025-04-08T08:22:00.872Z",
    "dateReserved": "2024-07-22T13:19:53.375Z",
    "dateUpdated": "2025-04-08T13:24:24.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-1974 (GCVE-0-2025-1974)

Vulnerability from cvelistv5

Published

2025-03-24 23:28

Modified

2025-03-27 03:55

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-653 - Improper Isolation or Compartmentalization

Summary

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

References

▼	URL	Tags
	https://https://github.com/kubernetes/kubernetes/issues/131009

Impacted products

	Vendor	Product	Version
	kubernetes	ingress-nginx	Version: 0 ≤ 1.11.4 Version: 1.12.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1974",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T03:55:19.309Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Validating Admission Controller"
          ],
          "product": "ingress-nginx",
          "repo": "https://github.com/kubernetes/ingress-nginx",
          "vendor": "kubernetes",
          "versions": [
            {
              "lessThanOrEqual": "1.11.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.12.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Ohfeld"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ronen Shustin"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sagi Tzadik"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Hillai Ben Sasson"
        }
      ],
      "datePublic": "2025-03-24T19:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)"
            }
          ],
          "value": "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-251",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-251 Local Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-653",
              "description": "CWE-653 Improper Isolation or Compartmentalization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-24T23:28:48.985Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "url": "https://https://github.com/kubernetes/kubernetes/issues/131009"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ingress-nginx admission controller RCE escalation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Before applying the patch, this issue can be mitigated by disabling the Validating Admission Controller functionality of ingress-nginx."
            }
          ],
          "value": "Before applying the patch, this issue can be mitigated by disabling the Validating Admission Controller functionality of ingress-nginx."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2025-1974",
    "datePublished": "2025-03-24T23:28:48.985Z",
    "dateReserved": "2025-03-04T21:34:07.543Z",
    "dateUpdated": "2025-03-27T03:55:19.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3446 (GCVE-0-2023-3446)

Vulnerability from cvelistv5

Published

2023-07-19 11:31

Modified

2025-04-23 16:20

Severity ?

CWE

CWE-606 - Unchecked Input for Loop Condition

Summary

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20230719.txt	vendor-advisory
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.1.0 ≤ Version: 3.0.0 ≤ Version: 1.1.1 < 1.1.1v Version: 1.0.2 < 1.0.2zi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:55:03.577Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20230719.txt"
          },
          {
            "name": "3.1.2 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23"
          },
          {
            "name": "3.0.10 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb"
          },
          {
            "name": "1.1.1v git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528"
          },
          {
            "name": "1.0.2zi patch (premium)",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/07/19/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/07/19/6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230803-0011/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202402-08"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/16/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-3446",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:26:22.087194Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:20:00.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.1.2",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.10",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1v",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zi",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "OSSfuzz"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Matt Caswell"
        }
      ],
      "datePublic": "2023-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\u003cbr\u003e\u003cbr\u003eImpact summary: Applications that use the functions DH_check(), DH_check_ex()\u003cbr\u003eor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\u003cbr\u003edelays. Where the key or parameters that are being checked have been obtained\u003cbr\u003efrom an untrusted source this may lead to a Denial of Service.\u003cbr\u003e\u003cbr\u003eThe function DH_check() performs various checks on DH parameters. One of those\u003cbr\u003echecks confirms that the modulus (\u0027p\u0027 parameter) is not too large. Trying to use\u003cbr\u003ea very large modulus is slow and OpenSSL will not normally use a modulus which\u003cbr\u003eis over 10,000 bits in length.\u003cbr\u003e\u003cbr\u003eHowever the DH_check() function checks numerous aspects of the key or parameters\u003cbr\u003ethat have been supplied. Some of those checks use the supplied modulus value\u003cbr\u003eeven if it has already been found to be too large.\u003cbr\u003e\u003cbr\u003eAn application that calls DH_check() and supplies a key or parameters obtained\u003cbr\u003efrom an untrusted source could be vulernable to a Denial of Service attack.\u003cbr\u003e\u003cbr\u003eThe function DH_check() is itself called by a number of other OpenSSL functions.\u003cbr\u003eAn application calling any of those other functions may similarly be affected.\u003cbr\u003eThe other functions affected by this are DH_check_ex() and\u003cbr\u003eEVP_PKEY_param_check().\u003cbr\u003e\u003cbr\u003eAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\u003cbr\u003ewhen using the \u0027-check\u0027 option.\u003cbr\u003e\u003cbr\u003eThe OpenSSL SSL/TLS implementation is not affected by this issue.\u003cbr\u003e\u003cbr\u003eThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."
            }
          ],
          "value": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus (\u0027p\u0027 parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \u0027-check\u0027 option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-606",
              "description": "CWE-606 Unchecked Input for Loop Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:55:47.238Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20230719.txt"
        },
        {
          "name": "3.1.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23"
        },
        {
          "name": "3.0.10 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb"
        },
        {
          "name": "1.1.1v git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528"
        },
        {
          "name": "1.0.2zi patch (premium)",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Excessive time spent checking DH keys and parameters",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2023-3446",
    "datePublished": "2023-07-19T11:31:34.994Z",
    "dateReserved": "2023-06-28T14:21:39.968Z",
    "dateUpdated": "2025-04-23T16:20:00.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-0056 (GCVE-0-2024-0056)

Vulnerability from cvelistv5

Published

2024-01-09 17:56

Modified

2025-06-03 14:30

Severity ?

8.7 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

CWE

CWE-319 - Cleartext Transmission of Sensitive Information

Summary

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

References

▼	URL	Tags
	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Microsoft

Microsoft SQL Server 2022 (GDR)

Version: 16.0.0 < 16.0.1110.1

Microsoft	.NET 6.0	Version: 6.0.0 < 6.0.26
Microsoft	.NET 7.0	Version: 7.0.0 < 7.0.15
Microsoft	.NET 8.0	Version: 8.0 < 8.0.1
Microsoft	Microsoft.Data.SqlClient	Version: 2.0 < 2.1.7
Microsoft	Microsoft.Data.SqlClient	Version: 3.0 < 3.1.5
Microsoft	Microsoft.Data.SqlClient	Version: 4.0 < 4.0.5
Microsoft	Microsoft.Data.SqlClient	Version: 5.0 < 5.1.3
Microsoft	System.Data.SqlClient	Version: 1.0 < 4.8.6
Microsoft	Microsoft Visual Studio 2022 version 17.2	Version: 17.2.0 < 17.2.23
Microsoft	Microsoft Visual Studio 2022 version 17.4	Version: 17.4.0 < 17.4.15
Microsoft	Microsoft Visual Studio 2022 version 17.6	Version: 17.6.0 < 17.6.11
Microsoft	Microsoft Visual Studio 2022 version 17.8	Version: 17.8.0 < 17.8.4
Microsoft	Microsoft SQL Server 2022 (CU 10)	Version: 0 < 16.0.4100.1
Microsoft	Microsoft .NET Framework 4.8	Version: 4.8.0 < 4.8.04690.02
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	Version: 4.8.0 < 4.8.04690.02
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	Version: 4.7.0 < 4.7.04081.03
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	Version: 4.7.0 < 4.7.04081.02
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	Version: 4.8.1 < 4.8.09214.01
Microsoft	Microsoft .NET Framework 2.0 Service Pack 2	Version: 2.0.0 < 3.0.50727.8976

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T17:41:15.885Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0056",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:47:49.601673Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:30:31.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft SQL Server 2022 (GDR)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.1110.1",
              "status": "affected",
              "version": "16.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": ".NET 6.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.26",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": ".NET 7.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.15",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": ".NET 8.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "8.0.1",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft.Data.SqlClient",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.1.7",
              "status": "affected",
              "version": "2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft.Data.SqlClient",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "3.1.5",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft.Data.SqlClient",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.0.5",
              "status": "affected",
              "version": "4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft.Data.SqlClient",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "5.1.3",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "System.Data.SqlClient",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.8.6",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.2.23",
              "status": "affected",
              "version": "17.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.4",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.4.15",
              "status": "affected",
              "version": "17.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.6",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.6.11",
              "status": "affected",
              "version": "17.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.8.4",
              "status": "affected",
              "version": "17.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft SQL Server 2022 (CU 10)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.4100.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows Server 2016 (Server Core installation)",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1",
            "Windows Server 2016",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.8.04690.02",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)",
            "Windows Server 2022",
            "Windows Server 2022 (Server Core installation)",
            "Windows 11 version 21H2 for x64-based Systems",
            "Windows 11 version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for 32-bit Systems",
            "Windows 10 Version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for x64-based Systems",
            "Windows 10 Version 22H2 for x64-based Systems",
            "Windows 10 Version 22H2 for ARM64-based Systems",
            "Windows 10 Version 22H2 for 32-bit Systems"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.8.04690.02",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows 10 Version 1809 for ARM64-based Systems",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)",
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows Server 2016",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows Server 2016 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.7.04081.03",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2 (Server Core installation)",
            "Windows Server 2012 R2"
          ],
          "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.7.04081.02",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2022 (Server Core installation)",
            "Windows Server 2022",
            "Windows 11 version 21H2 for x64-based Systems",
            "Windows 11 version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for 32-bit Systems",
            "Windows 10 Version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for x64-based Systems",
            "Windows 11 Version 22H2 for ARM64-based Systems",
            "Windows 11 Version 22H2 for x64-based Systems",
            "Windows 10 Version 22H2 for x64-based Systems",
            "Windows 10 Version 22H2 for ARM64-based Systems",
            "Windows 10 Version 22H2 for 32-bit Systems",
            "Windows 11 Version 23H2 for ARM64-based Systems",
            "Windows Server 2022, 23H2 Edition (Server Core installation)",
            "Windows 11 Version 23H2 for x64-based Systems"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.8.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.8.09214.01",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2008 for 32-bit Systems Service Pack 2",
            "Windows Server 2008 for x64-based Systems Service Pack 2"
          ],
          "product": "Microsoft .NET Framework 2.0 Service Pack 2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "3.0.50727.8976",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "16.0.1110.1",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.26",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.15",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.0.1",
                  "versionStartIncluding": "8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:data_sql_client:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.1.7",
                  "versionStartIncluding": "2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:data_sql_client:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.1.5",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:data_sql_client:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.0.5",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:data_sql_client:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.1.3",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:System.Data.SqlClient:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.8.6",
                  "versionStartIncluding": "1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.2.23",
                  "versionStartIncluding": "17.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.4.15",
                  "versionStartIncluding": "17.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.6.11",
                  "versionStartIncluding": "17.6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.8.4",
                  "versionStartIncluding": "17.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "16.0.4100.1",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.8.04690.02",
                  "versionStartIncluding": "4.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.8.04690.02",
                  "versionStartIncluding": "4.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.7.04081.03",
                  "versionStartIncluding": "4.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.7.04081.02",
                  "versionStartIncluding": "4.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.8.09214.01",
                  "versionStartIncluding": "4.8.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:sp2:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.50727.8976",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-01-09T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319: Cleartext Transmission of Sensitive Information",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-03T01:46:55.272Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056"
        }
      ],
      "title": "Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-0056",
    "datePublished": "2024-01-09T17:56:58.972Z",
    "dateReserved": "2023-11-22T17:43:06.743Z",
    "dateUpdated": "2025-06-03T14:30:31.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41795 (GCVE-0-2024-41795)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:37

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Summary

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices is vulnerable to Cross-Site Request Forgery (CSRF) attacks. This could allow an unauthenticated attacker to change arbitrary device settings by tricking a legitimate device administrator to click on a malicious link.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Impacted products

	Vendor	Product	Version
	Siemens	SENTRON 7KT PAC1260 Data Manager	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41795",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:36:50.483935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:37:07.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SENTRON 7KT PAC1260 Data Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices is vulnerable to Cross-Site Request Forgery (CSRF) attacks. This could allow an unauthenticated attacker to change arbitrary device settings by tricking a legitimate device administrator to click on a malicious link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:12.685Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-41795",
    "datePublished": "2025-04-08T08:22:12.685Z",
    "dateReserved": "2024-07-22T13:19:53.376Z",
    "dateUpdated": "2025-04-08T13:37:07.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-5535 (GCVE-0-2024-5535)

Vulnerability from cvelistv5

Published

2024-06-27 10:30

Modified

2025-09-01 08:29

Severity ?

CWE

CWE-125 - Out-of-bounds Read

Summary

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20240627.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c	patch
	https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e	patch
	https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37	patch
	https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c	patch
	https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87	patch
	https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.3.0 ≤ Version: 3.2.0 ≤ Version: 3.1.0 ≤ Version: 3.0.0 ≤ Version: 1.1.1 < 1.1.1za Version: 1.0.2 < 1.0.2zk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openssl",
            "vendor": "openssl",
            "versions": [
              {
                "lessThan": "3.3.2",
                "status": "affected",
                "version": "3.3.0",
                "versionType": "custom"
              },
              {
                "lessThan": "3.2.3",
                "status": "affected",
                "version": "3.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "3.1.7",
                "status": "affected",
                "version": "3.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "3.0.15",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.1.1za",
                "status": "affected",
                "version": "1.1.1",
                "versionType": "custom"
              },
              {
                "lessThan": "1.0.2zk",
                "status": "affected",
                "version": "1.0.2",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-5535",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-14T04:55:17.007Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-15T12:04:53.153Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20240627.txt"
          },
          {
            "name": "3.3.2 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c"
          },
          {
            "name": "3.2.3 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e"
          },
          {
            "name": "3.1.7 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37"
          },
          {
            "name": "3.0.15 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c"
          },
          {
            "name": "1.1.1za git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87"
          },
          {
            "name": "1.0.2zk git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/27/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/28/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240712-0005/"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/08/15/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.3.2",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2.3",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.7",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.15",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1za",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zk",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joseph Birr-Pixton"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "David Benjamin (Google)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Matt Caswell"
        }
      ],
      "datePublic": "2024-06-26T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\u003cbr\u003eempty supported client protocols buffer may cause a crash or memory contents to\u003cbr\u003ebe sent to the peer.\u003cbr\u003e\u003cbr\u003eImpact summary: A buffer overread can have a range of potential consequences\u003cbr\u003esuch as unexpected application beahviour or a crash. In particular this issue\u003cbr\u003ecould result in up to 255 bytes of arbitrary private data from memory being sent\u003cbr\u003eto the peer leading to a loss of confidentiality. However, only applications\u003cbr\u003ethat directly call the SSL_select_next_proto function with a 0 length list of\u003cbr\u003esupported client protocols are affected by this issue. This would normally never\u003cbr\u003ebe a valid scenario and is typically not under attacker control but may occur by\u003cbr\u003eaccident in the case of a configuration or programming error in the calling\u003cbr\u003eapplication.\u003cbr\u003e\u003cbr\u003eThe OpenSSL API function SSL_select_next_proto is typically used by TLS\u003cbr\u003eapplications that support ALPN (Application Layer Protocol Negotiation) or NPN\u003cbr\u003e(Next Protocol Negotiation). NPN is older, was never standardised and\u003cbr\u003eis deprecated in favour of ALPN. We believe that ALPN is significantly more\u003cbr\u003ewidely deployed than NPN. The SSL_select_next_proto function accepts a list of\u003cbr\u003eprotocols from the server and a list of protocols from the client and returns\u003cbr\u003ethe first protocol that appears in the server list that also appears in the\u003cbr\u003eclient list. In the case of no overlap between the two lists it returns the\u003cbr\u003efirst item in the client list. In either case it will signal whether an overlap\u003cbr\u003ebetween the two lists was found. In the case where SSL_select_next_proto is\u003cbr\u003ecalled with a zero length client list it fails to notice this condition and\u003cbr\u003ereturns the memory immediately following the client list pointer (and reports\u003cbr\u003ethat there was no overlap in the lists).\u003cbr\u003e\u003cbr\u003eThis function is typically called from a server side application callback for\u003cbr\u003eALPN or a client side application callback for NPN. In the case of ALPN the list\u003cbr\u003eof protocols supplied by the client is guaranteed by libssl to never be zero in\u003cbr\u003elength. The list of server protocols comes from the application and should never\u003cbr\u003enormally be expected to be of zero length. In this case if the\u003cbr\u003eSSL_select_next_proto function has been called as expected (with the list\u003cbr\u003esupplied by the client passed in the client/client_len parameters), then the\u003cbr\u003eapplication will not be vulnerable to this issue. If the application has\u003cbr\u003eaccidentally been configured with a zero length server list, and has\u003cbr\u003eaccidentally passed that zero length server list in the client/client_len\u003cbr\u003eparameters, and has additionally failed to correctly handle a \"no overlap\"\u003cbr\u003eresponse (which would normally result in a handshake failure in ALPN) then it\u003cbr\u003ewill be vulnerable to this problem.\u003cbr\u003e\u003cbr\u003eIn the case of NPN, the protocol permits the client to opportunistically select\u003cbr\u003ea protocol when there is no overlap. OpenSSL returns the first client protocol\u003cbr\u003ein the no overlap case in support of this. The list of client protocols comes\u003cbr\u003efrom the application and should never normally be expected to be of zero length.\u003cbr\u003eHowever if the SSL_select_next_proto function is accidentally called with a\u003cbr\u003eclient_len of 0 then an invalid memory pointer will be returned instead. If the\u003cbr\u003eapplication uses this output as the opportunistic protocol then the loss of\u003cbr\u003econfidentiality will occur.\u003cbr\u003e\u003cbr\u003eThis issue has been assessed as Low severity because applications are most\u003cbr\u003elikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\u003cbr\u003ewidely used. It also requires an application configuration or programming error.\u003cbr\u003eFinally, this issue would not typically be under attacker control making active\u003cbr\u003eexploitation unlikely.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\u003cbr\u003e\u003cbr\u003e\n\nDue to the low severity of this issue we are not issuing new releases of\u003cbr\u003eOpenSSL at this time. The fix will be included in the next releases when they\u003cbr\u003ebecome available."
            }
          ],
          "value": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-01T08:29:27.594Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20240627.txt"
        },
        {
          "name": "3.3.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c"
        },
        {
          "name": "3.2.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e"
        },
        {
          "name": "3.1.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37"
        },
        {
          "name": "3.0.15 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c"
        },
        {
          "name": "1.1.1za git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87"
        },
        {
          "name": "1.0.2zk git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SSL_select_next_proto buffer overread",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2024-5535",
    "datePublished": "2024-06-27T10:30:53.118Z",
    "dateReserved": "2024-05-30T15:34:36.813Z",
    "dateUpdated": "2025-09-01T08:29:27.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-4807 (GCVE-0-2023-4807)

Vulnerability from cvelistv5

Published

2023-09-08 11:01

Modified

2025-08-27 20:42

Severity ?

CWE

CWE-440 - Expected Behavior Violation

Summary

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20230908.txt	vendor-advisory
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.1.0 ≤ Version: 3.0.0 ≤ Version: 1.1.1 < 1.1.1w

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:38:00.793Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20230908.txt"
          },
          {
            "name": "3.1.3 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5"
          },
          {
            "name": "3.0.11 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508"
          },
          {
            "name": "1.1.1w git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230921-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-4807",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:27:06.574022Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-27T20:42:52.433Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.1.3",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.11",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1w",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Zach Wilson"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Bernd Edlinger"
        }
      ],
      "datePublic": "2023-09-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: The POLY1305 MAC (message authentication code) implementation\u003cbr\u003econtains a bug that might corrupt the internal state of applications on the\u003cbr\u003eWindows 64 platform when running on newer X86_64 processors supporting the\u003cbr\u003eAVX512-IFMA instructions.\u003cbr\u003e\u003cbr\u003eImpact summary: If in an application that uses the OpenSSL library an attacker\u003cbr\u003ecan influence whether the POLY1305 MAC algorithm is used, the application\u003cbr\u003estate might be corrupted with various application dependent consequences.\u003cbr\u003e\u003cbr\u003eThe POLY1305 MAC (message authentication code) implementation in OpenSSL does\u003cbr\u003enot save the contents of non-volatile XMM registers on Windows 64 platform\u003cbr\u003ewhen calculating the MAC of data larger than 64 bytes. Before returning to\u003cbr\u003ethe caller all the XMM registers are set to zero rather than restoring their\u003cbr\u003eprevious content. The vulnerable code is used only on newer x86_64 processors\u003cbr\u003esupporting the AVX512-IFMA instructions.\u003cbr\u003e\u003cbr\u003eThe consequences of this kind of internal application state corruption can\u003cbr\u003ebe various - from no consequences, if the calling application does not\u003cbr\u003edepend on the contents of non-volatile XMM registers at all, to the worst\u003cbr\u003econsequences, where the attacker could get complete control of the application\u003cbr\u003eprocess. However given the contents of the registers are just zeroized so\u003cbr\u003ethe attacker cannot put arbitrary values inside, the most likely consequence,\u003cbr\u003eif any, would be an incorrect result of some application dependent\u003cbr\u003ecalculations or a crash leading to a denial of service.\u003cbr\u003e\u003cbr\u003eThe POLY1305 MAC algorithm is most frequently used as part of the\u003cbr\u003eCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\u003cbr\u003ealgorithm. The most common usage of this AEAD cipher is with TLS protocol\u003cbr\u003eversions 1.2 and 1.3 and a malicious client can influence whether this AEAD\u003cbr\u003ecipher is used by the server. This implies that server applications using\u003cbr\u003eOpenSSL can be potentially impacted. However we are currently not aware of\u003cbr\u003eany concrete application that would be affected by this issue therefore we\u003cbr\u003econsider this a Low severity security issue.\u003cbr\u003e\u003cbr\u003eAs a workaround the AVX512-IFMA instructions support can be disabled at\u003cbr\u003eruntime by setting the environment variable OPENSSL_ia32cap:\u003cbr\u003e\u003cbr\u003e   OPENSSL_ia32cap=:~0x200000\u003cbr\u003e\u003cbr\u003eThe FIPS provider is not affected by this issue."
            }
          ],
          "value": "Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications on the\nWindows 64 platform when running on newer X86_64 processors supporting the\nAVX512-IFMA instructions.\n\nImpact summary: If in an application that uses the OpenSSL library an attacker\ncan influence whether the POLY1305 MAC algorithm is used, the application\nstate might be corrupted with various application dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL does\nnot save the contents of non-volatile XMM registers on Windows 64 platform\nwhen calculating the MAC of data larger than 64 bytes. Before returning to\nthe caller all the XMM registers are set to zero rather than restoring their\nprevious content. The vulnerable code is used only on newer x86_64 processors\nsupporting the AVX512-IFMA instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However given the contents of the registers are just zeroized so\nthe attacker cannot put arbitrary values inside, the most likely consequence,\nif any, would be an incorrect result of some application dependent\ncalculations or a crash leading to a denial of service.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3 and a malicious client can influence whether this AEAD\ncipher is used by the server. This implies that server applications using\nOpenSSL can be potentially impacted. However we are currently not aware of\nany concrete application that would be affected by this issue therefore we\nconsider this a Low severity security issue.\n\nAs a workaround the AVX512-IFMA instructions support can be disabled at\nruntime by setting the environment variable OPENSSL_ia32cap:\n\n   OPENSSL_ia32cap=:~0x200000\n\nThe FIPS provider is not affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-440",
              "description": "CWE-440 Expected Behavior Violation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:55:50.502Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20230908.txt"
        },
        {
          "name": "3.1.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5"
        },
        {
          "name": "3.0.11 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508"
        },
        {
          "name": "1.1.1w git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "POLY1305 MAC implementation corrupts XMM registers on Windows",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2023-4807",
    "datePublished": "2023-09-08T11:01:53.663Z",
    "dateReserved": "2023-09-06T16:32:29.871Z",
    "dateUpdated": "2025-08-27T20:42:52.433Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41793 (GCVE-0-2024-41793)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:39

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
7.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N

CWE

CWE-306 - Missing Authentication for Critical Function

Summary

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices provides an endpoint that allows to enable the ssh service without authentication. This could allow an unauthenticated remote attacker to enable remote access to the device via ssh.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Impacted products

	Vendor	Product	Version
	Siemens	SENTRON 7KT PAC1260 Data Manager	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:39:19.167788Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:39:41.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SENTRON 7KT PAC1260 Data Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices provides an endpoint that allows to enable the ssh service without authentication. This could allow an unauthenticated remote attacker to enable remote access to the device via ssh."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:09.907Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-41793",
    "datePublished": "2025-04-08T08:22:09.907Z",
    "dateReserved": "2024-07-22T13:19:53.376Z",
    "dateUpdated": "2025-04-08T13:39:41.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41789 (GCVE-0-2024-41789)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:22

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the language parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Impacted products

	Vendor	Product	Version
	Siemens	SENTRON 7KT PAC1260 Data Manager	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41789",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:21:54.930717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:22:14.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SENTRON 7KT PAC1260 Data Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the language parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:02.733Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-41789",
    "datePublished": "2025-04-08T08:22:02.733Z",
    "dateReserved": "2024-07-22T13:19:53.376Z",
    "dateUpdated": "2025-04-08T13:22:14.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-1098 (GCVE-0-2025-1098)

Vulnerability from cvelistv5

Published

2025-03-24 23:29

Modified

2025-03-27 03:55

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-20 - Improper Input Validation

Summary

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

References

▼	URL	Tags
	https://github.com/kubernetes/kubernetes/issues/131008

Impacted products

	Vendor	Product	Version
	kubernetes	ingress-nginx	Version: 0 ≤ 1.11.4 Version: 1.12.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1098",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T03:55:16.707Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ingress-nginx",
          "repo": "https://github.com/kubernetes/ingress-nginx",
          "vendor": "kubernetes",
          "versions": [
            {
              "lessThanOrEqual": "1.11.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.12.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Ohfeld"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ronen Shustin"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sagi Tzadik"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Hillai Ben Sasson"
        }
      ],
      "datePublic": "2025-03-24T19:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A security issue was discovered in \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/kubernetes/ingress-nginx\"\u003eingress-nginx\u003c/a\u003e where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)"
            }
          ],
          "value": "A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-137",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-137 Parameter Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-24T23:29:15.610Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "url": "https://github.com/kubernetes/kubernetes/issues/131008"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ingress-nginx controller - configuration injection via unsanitized mirror annotations",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2025-1098",
    "datePublished": "2025-03-24T23:29:15.610Z",
    "dateReserved": "2025-02-07T00:11:53.927Z",
    "dateUpdated": "2025-03-27T03:55:16.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-24513 (GCVE-0-2025-24513)

Vulnerability from cvelistv5

Published

2025-03-24 23:29

Modified

2025-03-25 13:39

Severity ?

4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE

CWE-20 - Improper Input Validation

Summary

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.

References

▼	URL	Tags
	https://github.com/kubernetes/kubernetes/issues/131005

Impacted products

	Vendor	Product	Version
	kubernetes	ingress-nginx	Version: 0 ≤ 1.11.4 Version: 1.12.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24513",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-25T13:39:36.149148Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T13:39:50.057Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ingress-nginx",
          "repo": "https://github.com/kubernetes/ingress-nginx",
          "vendor": "kubernetes",
          "versions": [
            {
              "lessThanOrEqual": "1.11.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.12.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Ohfeld"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ronen Shustin"
        }
      ],
      "datePublic": "2025-03-24T19:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A security issue was discovered in \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/kubernetes/ingress-nginx\"\u003eingress-nginx\u003c/a\u003e where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster."
            }
          ],
          "value": "A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-24T23:29:25.215Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "url": "https://github.com/kubernetes/kubernetes/issues/131005"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ingress-nginx controller - auth secret file path traversal vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2025-24513",
    "datePublished": "2025-03-24T23:29:25.215Z",
    "dateReserved": "2025-01-23T00:50:17.928Z",
    "dateUpdated": "2025-03-25T13:39:50.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-7104 (GCVE-0-2023-7104)

Vulnerability from cvelistv5

Published

2023-12-25 21:00

Modified

2025-02-13 17:27

Severity ?

5.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium) - CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-122 - Heap-based Buffer Overflow

Summary

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

References

▼	URL	Tags
	https://vuldb.com/?id.248999	vdb-entry, technical-description
	https://vuldb.com/?ctiid.248999	signature, permissions-required
	https://sqlite.org/forum/forumpost/5bcbf4571c	related
	https://sqlite.org/src/info/0e4e7a05c4204b47	patch
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/
	https://security.netapp.com/advisory/ntap-20240112-0008/

Impacted products

	Vendor	Product	Version
	SQLite	SQLite3	Version: 3.0 Version: 3.1 Version: 3.2 Version: 3.3 Version: 3.4 Version: 3.5 Version: 3.6 Version: 3.7 Version: 3.8 Version: 3.9 Version: 3.10 Version: 3.11 Version: 3.12 Version: 3.13 Version: 3.14 Version: 3.15 Version: 3.16 Version: 3.17 Version: 3.18 Version: 3.19 Version: 3.20 Version: 3.21 Version: 3.22 Version: 3.23 Version: 3.24 Version: 3.25 Version: 3.26 Version: 3.27 Version: 3.28 Version: 3.29 Version: 3.30 Version: 3.31 Version: 3.32 Version: 3.33 Version: 3.34 Version: 3.35 Version: 3.36 Version: 3.37 Version: 3.38 Version: 3.39 Version: 3.40 Version: 3.41 Version: 3.42 Version: 3.43

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:50:08.189Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.248999"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.248999"
          },
          {
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://sqlite.org/forum/forumpost/5bcbf4571c"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://sqlite.org/src/info/0e4e7a05c4204b47"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240112-0008/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "make alltest Handler"
          ],
          "product": "SQLite3",
          "vendor": "SQLite",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "status": "affected",
              "version": "3.20"
            },
            {
              "status": "affected",
              "version": "3.21"
            },
            {
              "status": "affected",
              "version": "3.22"
            },
            {
              "status": "affected",
              "version": "3.23"
            },
            {
              "status": "affected",
              "version": "3.24"
            },
            {
              "status": "affected",
              "version": "3.25"
            },
            {
              "status": "affected",
              "version": "3.26"
            },
            {
              "status": "affected",
              "version": "3.27"
            },
            {
              "status": "affected",
              "version": "3.28"
            },
            {
              "status": "affected",
              "version": "3.29"
            },
            {
              "status": "affected",
              "version": "3.30"
            },
            {
              "status": "affected",
              "version": "3.31"
            },
            {
              "status": "affected",
              "version": "3.32"
            },
            {
              "status": "affected",
              "version": "3.33"
            },
            {
              "status": "affected",
              "version": "3.34"
            },
            {
              "status": "affected",
              "version": "3.35"
            },
            {
              "status": "affected",
              "version": "3.36"
            },
            {
              "status": "affected",
              "version": "3.37"
            },
            {
              "status": "affected",
              "version": "3.38"
            },
            {
              "status": "affected",
              "version": "3.39"
            },
            {
              "status": "affected",
              "version": "3.40"
            },
            {
              "status": "affected",
              "version": "3.41"
            },
            {
              "status": "affected",
              "version": "3.42"
            },
            {
              "status": "affected",
              "version": "3.43"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Junwha Hong"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Wonil Jang"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "qbit (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999."
        },
        {
          "lang": "de",
          "value": "Eine kritische Schwachstelle wurde in SQLite SQLite3 bis 3.43.0 gefunden. Hierbei geht es um die Funktion sessionReadRecord der Datei ext/session/sqlite3session.c der Komponente make alltest Handler. Durch die Manipulation mit unbekannten Daten kann eine heap-based buffer overflow-Schwachstelle ausgenutzt werden. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.2,
            "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T14:06:21.135Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.248999"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.248999"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://sqlite.org/forum/forumpost/5bcbf4571c"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://sqlite.org/src/info/0e4e7a05c4204b47"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240112-0008/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-12-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-12-25T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-12-29T10:49:22.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-7104",
    "datePublished": "2023-12-25T21:00:05.997Z",
    "dateReserved": "2023-12-25T14:00:48.991Z",
    "dateUpdated": "2025-02-13T17:27:03.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-1097 (GCVE-0-2025-1097)

Vulnerability from cvelistv5

Published

2025-03-24 23:29

Modified

2025-03-27 03:55

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-20 - Improper Input Validation

Summary

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

References

▼	URL	Tags
	https://github.com/kubernetes/kubernetes/issues/131007

Impacted products

	Vendor	Product	Version
	kubernetes	ingress-nginx	Version: 0 ≤ 1.11.4 Version: 1.12.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1097",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T03:55:13.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ingress-nginx",
          "repo": "https://github.com/kubernetes/ingress-nginx",
          "vendor": "kubernetes",
          "versions": [
            {
              "lessThanOrEqual": "1.11.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.12.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Ohfeld"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ronen Shustin"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sagi Tzadik"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Hillai Ben Sasson"
        }
      ],
      "datePublic": "2025-03-24T19:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A security issue was discovered in \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/kubernetes/ingress-nginx\"\u003eingress-nginx\u003c/a\u003e where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)"
            }
          ],
          "value": "A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-137",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-137 Parameter Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-24T23:29:05.879Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "url": "https://github.com/kubernetes/kubernetes/issues/131007"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2025-1097",
    "datePublished": "2025-03-24T23:29:05.879Z",
    "dateReserved": "2025-02-07T00:11:49.551Z",
    "dateUpdated": "2025-03-27T03:55:13.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30000 (GCVE-0-2025-30000)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:25

Severity ?

6.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
5.4 (Medium) - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-295 - Improper Certificate Validation

Summary

A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application does not properly restrict permissions of the users. This could allow a lowly-privileged attacker to escalate their privileges.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-525431.html

Impacted products

	Vendor	Product	Version
	Siemens	Siemens License Server (SLS)	Version: 0 < V4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:25:03.184802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:25:21.043Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Siemens License Server (SLS)",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The affected application does not properly restrict permissions of the users. This could allow a lowly-privileged attacker to escalate their privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:29.519Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-525431.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2025-30000",
    "datePublished": "2025-04-08T08:22:29.519Z",
    "dateReserved": "2025-03-13T14:30:18.938Z",
    "dateUpdated": "2025-04-08T13:25:21.043Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-24514 (GCVE-0-2025-24514)

Vulnerability from cvelistv5

Published

2025-03-24 23:29

Modified

2025-03-27 03:55

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-20 - Improper Input Validation

Summary

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

References

▼	URL	Tags
	https://github.com/kubernetes/kubernetes/issues/131006

Impacted products

	Vendor	Product	Version
	kubernetes	ingress-nginx	Version: 0 ≤ 1.11.4 Version: 1.12.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24514",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T03:55:17.986Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ingress-nginx",
          "repo": "https://github.com/kubernetes/ingress-nginx",
          "vendor": "kubernetes",
          "versions": [
            {
              "lessThanOrEqual": "1.11.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.12.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Ohfeld"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ronen Shustin"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sagi Tzadik"
        }
      ],
      "datePublic": "2025-03-24T19:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A security issue was discovered in \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/kubernetes/ingress-nginx\"\u003eingress-nginx\u003c/a\u003e where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)"
            }
          ],
          "value": "A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-137",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-137 Parameter Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-24T23:29:36.802Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "url": "https://github.com/kubernetes/kubernetes/issues/131006"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ingress-nginx controller - configuration injection via unsanitized auth-url annotation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2025-24514",
    "datePublished": "2025-03-24T23:29:36.802Z",
    "dateReserved": "2025-01-23T00:50:17.929Z",
    "dateUpdated": "2025-03-27T03:55:17.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-54092 (GCVE-0-2024-54092)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-07-08 10:34

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-1390 - Weak Authentication

Summary

A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-634640.html
	https://cert-portal.siemens.com/productcert/html/ssa-819629.html

Impacted products

Vendor

Product

Version

▼

Siemens

Industrial Edge Device Kit - arm64 V1.17

Version: 0 < *

Siemens	Industrial Edge Device Kit - arm64 V1.18	Version: 0 < *
Siemens	Industrial Edge Device Kit - arm64 V1.19	Version: 0 < *
Siemens	Industrial Edge Device Kit - arm64 V1.20	Version: 0 < V1.20.2-1
Siemens	Industrial Edge Device Kit - arm64 V1.21	Version: 0 < V1.21.1-1
Siemens	Industrial Edge Device Kit - x86-64 V1.17	Version: 0 < *
Siemens	Industrial Edge Device Kit - x86-64 V1.18	Version: 0 < *
Siemens	Industrial Edge Device Kit - x86-64 V1.19	Version: 0 < *
Siemens	Industrial Edge Device Kit - x86-64 V1.20	Version: 0 < V1.20.2-1
Siemens	Industrial Edge Device Kit - x86-64 V1.21	Version: 0 < V1.21.1-1
Siemens	Industrial Edge Own Device (IEOD)	Version: 0 < V1.21.1-1-a
Siemens	Industrial Edge Virtual Device	Version: 0 < V1.21.1-1-a
Siemens	SCALANCE LPE9413	Version: 0 < V2.1
Siemens	SIMATIC IPC BX-39A Industrial Edge Device	Version: 0 < V3.0
Siemens	SIMATIC IPC BX-59A Industrial Edge Device	Version: 0 < V3.0
Siemens	SIMATIC IPC127E Industrial Edge Device	Version: 0 < V3.0
Siemens	SIMATIC IPC227E Industrial Edge Device	Version: 0 < V3.0
Siemens	SIMATIC IPC427E Industrial Edge Device	Version: 0 < V3.0
Siemens	SIMATIC IPC847E Industrial Edge Device	Version: 0 < V3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-54092",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:27:19.071254Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:27:35.300Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - arm64 V1.17",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - arm64 V1.18",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - arm64 V1.19",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - arm64 V1.20",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V1.20.2-1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - arm64 V1.21",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V1.21.1-1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - x86-64 V1.17",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - x86-64 V1.18",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - x86-64 V1.19",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - x86-64 V1.20",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V1.20.2-1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Device Kit - x86-64 V1.21",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V1.21.1-1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Own Device (IEOD)",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V1.21.1-1-a",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Industrial Edge Virtual Device",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V1.21.1-1-a",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SCALANCE LPE9413",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC BX-39A Industrial Edge Device",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V3.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC BX-59A Industrial Edge Device",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V3.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC127E Industrial Edge Device",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V3.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC227E Industrial Edge Device",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V3.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC427E Industrial Edge Device",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V3.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC847E Industrial Edge Device",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V3.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions \u003c V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions \u003c V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions \u003c V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions \u003c V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions \u003c V1.21.1-1-a), Industrial Edge Virtual Device (All versions \u003c V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions \u003c V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions \u003c V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions \u003c V3.0), SIMATIC IPC127E Industrial Edge Device (All versions \u003c V3.0), SIMATIC IPC227E Industrial Edge Device (All versions \u003c V3.0), SIMATIC IPC427E Industrial Edge Device (All versions \u003c V3.0), SIMATIC IPC847E Industrial Edge Device (All versions \u003c V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390: Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T10:34:27.627Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-634640.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-819629.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-54092",
    "datePublished": "2025-04-08T08:22:24.861Z",
    "dateReserved": "2024-11-28T13:06:14.569Z",
    "dateUpdated": "2025-07-08T10:34:27.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-0232 (GCVE-0-2024-0232)

Vulnerability from cvelistv5

Published

2024-01-16 14:01

Modified

2025-09-02 16:05

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

CWE-416 - Use After Free

Summary

A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.

References

▼	URL	Tags
	https://access.redhat.com/security/cve/CVE-2024-0232	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2243754	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤

Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0232",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-13T20:18:59.193130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-13T20:19:06.883Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T17:41:16.024Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2024-0232"
          },
          {
            "name": "RHBZ#2243754",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243754"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240315-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.sqlite.org/download.html",
          "defaultStatus": "unaffected",
          "packageName": "sqlite",
          "versions": [
            {
              "lessThan": "3.43.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "sqlite",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "sqlite",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-sqlite",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "sqlite",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "sqlite",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2023-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-02T16:05:58.759Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-0232"
        },
        {
          "name": "RHBZ#2243754",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243754"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-10-12T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2023-10-12T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Sqlite: use-after-free bug in jsonparseaddnodearray",
      "x_redhatCweChain": "CWE-416: Use After Free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-0232",
    "datePublished": "2024-01-16T14:01:58.505Z",
    "dateReserved": "2024-01-04T12:11:09.709Z",
    "dateUpdated": "2025-09-02T16:05:58.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41794 (GCVE-0-2024-41794)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:37

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-798 - Use of Hard-coded Credentials

Summary

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the device operating system with root privileges. This could allow unauthenticated remote attackers to gain full access to a device, if they are in possession of these credentials and if the ssh service is enabled (e.g., by exploitation of CVE-2024-41793).

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Impacted products

	Vendor	Product	Version
	Siemens	SENTRON 7KT PAC1260 Data Manager	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41794",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:37:36.960442Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:37:54.608Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SENTRON 7KT PAC1260 Data Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the device operating system with root privileges. This could allow unauthenticated remote attackers to gain full access to a device, if they are in possession of these credentials and if the ssh service is enabled (e.g., by exploitation of CVE-2024-41793)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798: Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:11.279Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-41794",
    "datePublished": "2025-04-08T08:22:11.279Z",
    "dateReserved": "2024-07-22T13:19:53.376Z",
    "dateUpdated": "2025-04-08T13:37:54.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-30105 (GCVE-0-2024-30105)

Vulnerability from cvelistv5

Published

2024-07-09 17:02

Modified

2025-05-05 17:02

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

CWE

CWE-400 - Uncontrolled Resource Consumption

Summary

.NET and Visual Studio Denial of Service Vulnerability

References

▼	URL	Tags
	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30105	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Microsoft

.NET 8.0

Version: 8.0 < 8.0.7

Microsoft	PowerShell 7.4	Version: 7.4.0 < 7.4.4
Microsoft	Microsoft Visual Studio 2022 version 17.4	Version: 17.4.0 < 17.4.21
Microsoft	Microsoft Visual Studio 2022 version 17.6	Version: 17.6.0 < 17.6.17
Microsoft	Microsoft Visual Studio 2022 version 17.10	Version: 17.10 < 17.10.4
Microsoft	Microsoft Visual Studio 2022 version 17.8	Version: 17.8.0 < 17.8.12

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-30105",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-10T15:05:16.271423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-10T15:05:25.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:25:03.130Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": ".NET Core and Visual Studio Denial of Service Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30105"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": ".NET 8.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "8.0.7",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "PowerShell 7.4",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.4.4",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.4",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.4.21",
              "status": "affected",
              "version": "17.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.6",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.6.17",
              "status": "affected",
              "version": "17.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.10",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.10.4",
              "status": "affected",
              "version": "17.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.8.12",
              "status": "affected",
              "version": "17.8.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.0.7",
                  "versionStartIncluding": "8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:powershell:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.4",
                  "versionStartIncluding": "7.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.4.21",
                  "versionStartIncluding": "17.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.6.17",
                  "versionStartIncluding": "17.6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.10.4",
                  "versionStartIncluding": "17.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.8.12",
                  "versionStartIncluding": "17.8.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-07-09T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": ".NET and Visual Studio Denial of Service Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-05T17:02:07.484Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": ".NET and Visual Studio Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30105"
        }
      ],
      "title": ".NET and Visual Studio Denial of Service Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-30105",
    "datePublished": "2024-07-09T17:02:41.777Z",
    "dateReserved": "2024-03-22T23:12:15.573Z",
    "dateUpdated": "2025-05-05T17:02:07.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41792 (GCVE-0-2024-41792)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:17

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
9.2 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices contains a path traversal vulnerability. This could allow an unauthenticated attacker it to access arbitrary files on the device with root privileges.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Impacted products

	Vendor	Product	Version
	Siemens	SENTRON 7KT PAC1260 Data Manager	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41792",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:17:15.787250Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:17:38.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SENTRON 7KT PAC1260 Data Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices contains a path traversal vulnerability. This could allow an unauthenticated attacker it to access arbitrary files on the device with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:08.546Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-41792",
    "datePublished": "2025-04-08T08:22:08.546Z",
    "dateReserved": "2024-07-22T13:19:53.376Z",
    "dateUpdated": "2025-04-08T13:17:38.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41796 (GCVE-0-2024-41796)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:31

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-620 - Unverified Password Change

Summary

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login password without knowing the current password. In combination with a prepared CSRF attack (CVE-2024-41795) an unauthenticated attacker could be able to set the password to an attacker-controlled value.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Impacted products

	Vendor	Product	Version
	Siemens	SENTRON 7KT PAC1260 Data Manager	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41796",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:31:19.338109Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:31:32.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SENTRON 7KT PAC1260 Data Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login password without knowing the current password. In combination with a prepared CSRF attack (CVE-2024-41795) an unauthenticated attacker could be able to set the password to an attacker-controlled value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-620",
              "description": "CWE-620: Unverified Password Change",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:14.357Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-41796",
    "datePublished": "2025-04-08T08:22:14.357Z",
    "dateReserved": "2024-07-22T13:19:53.377Z",
    "dateUpdated": "2025-04-08T13:31:32.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-54091 (GCVE-0-2024-54091)

Vulnerability from cvelistv5

Published

2024-12-10 13:54

Modified

2025-04-08 08:22

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.3 (High) - CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-787 - Out-of-bounds Write

Summary

A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 12), Solid Edge SE2025 (All versions < V225.0 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer while parsing X_T data or a specially crafted file in X_T format. This could allow an attacker to execute code in the context of the current process.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-979056.html
	https://cert-portal.siemens.com/productcert/html/ssa-672923.html

Impacted products

Vendor

Product

Version

▼

Siemens

Solid Edge SE2024

Version: 0 < V224.0 Update 12

Siemens

Solid Edge SE2025

Version: 0 < V225.0 Update 3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-54091",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-10T15:15:24.096235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-10T17:17:59.464Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Solid Edge SE2024",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V224.0 Update 12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Solid Edge SE2025",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V225.0 Update 3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Solid Edge SE2024 (All versions \u003c V224.0 Update 12), Solid Edge SE2025 (All versions \u003c V225.0 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer while parsing X_T data or a specially crafted file in X_T format.\r\nThis could allow an attacker to execute code in the context of the current process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:23.402Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-979056.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-672923.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-54091",
    "datePublished": "2024-12-10T13:54:17.315Z",
    "dateReserved": "2024-11-28T12:05:26.694Z",
    "dateUpdated": "2025-04-08T08:22:23.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30280 (GCVE-0-2025-30280)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-06-10 15:17

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-204 - Observable Response Discrepancy

Summary

A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (All versions < V10.18.5), Mendix Runtime V10.6 (All versions < V10.6.22), Mendix Runtime V8 (All versions < V8.18.35), Mendix Runtime V9 (All versions < V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-874353.html

Impacted products

Vendor

Product

Version

▼

Siemens

Mendix Runtime V10

Version: 0 < V10.21.0

Siemens	Mendix Runtime V10.12	Version: 0 < V10.12.16
Siemens	Mendix Runtime V10.18	Version: 0 < V10.18.5
Siemens	Mendix Runtime V10.6	Version: 0 < V10.6.22
Siemens	Mendix Runtime V8	Version: 0 < V8.18.35
Siemens	Mendix Runtime V9	Version: 0 < V9.24.34

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:10:20.606472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:12:03.334Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Mendix Runtime V10",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V10.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Mendix Runtime V10.12",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V10.12.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Mendix Runtime V10.18",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V10.18.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Mendix Runtime V10.6",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V10.6.22",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Mendix Runtime V8",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V8.18.35",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Mendix Runtime V9",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V9.24.34",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Mendix Runtime V10 (All versions \u003c V10.21.0), Mendix Runtime V10.12 (All versions \u003c V10.12.16), Mendix Runtime V10.18 (All versions \u003c V10.18.5), Mendix Runtime V10.6 (All versions \u003c V10.6.22), Mendix Runtime V8 (All versions \u003c V8.18.35), Mendix Runtime V9 (All versions \u003c V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-204",
              "description": "CWE-204: Observable Response Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-10T15:17:23.562Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-874353.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2025-30280",
    "datePublished": "2025-04-08T08:22:31.167Z",
    "dateReserved": "2025-03-20T11:01:33.481Z",
    "dateUpdated": "2025-06-10T15:17:23.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21319 (GCVE-0-2024-21319)

Vulnerability from cvelistv5

Published

2024-01-09 18:59

Modified

2025-06-03 14:29

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C

CWE

CWE-20 - Improper Input Validation

Summary

Microsoft Identity Denial of service vulnerability

References

▼	URL	Tags
	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Microsoft

.NET 6.0

Version: 6.0.0 < 6.0.26

Microsoft	Microsoft Visual Studio 2022 version 17.2	Version: 17.2.0 < 17.2.23
Microsoft	Microsoft Visual Studio 2022 version 17.6	Version: 17.6.0 < 17.6.11
Microsoft	Microsoft Visual Studio 2022 version 17.4	Version: 17.4.0 < 17.4.15
Microsoft	Microsoft Visual Studio 2022 version 17.8	Version: 17.8.0 < 17.8.4
Microsoft	.NET 7.0	Version: 7.0.0 < 7.0.15
Microsoft	.NET 8.0	Version: 8.0 < 8.0.1
Microsoft	Microsoft Identity Model v6.0.0 forNuget	Version: 6.0 < 6.34.0
Microsoft	Microsoft Identity Model v7.0.0 for Nuget	Version: 7.0 < 7.1.2
Microsoft	Microsoft Identity Model v6.0.0	Version: 6.0 < 6.34.0
Microsoft	Microsoft Identity Model v5.0.0	Version: 5.0 < 5.7.0
Microsoft	Microsoft Identity Model v7.0.0	Version: 7.0 < 7.1.2
Microsoft	Microsoft Identity Model v5.0.0 for Nuget	Version: 5.0 < 5.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:20:39.921Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Microsoft Identity Denial of service vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21319",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:56:18.714850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:29:52.502Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": ".NET 6.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.26",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.2.23",
              "status": "affected",
              "version": "17.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.6",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.6.11",
              "status": "affected",
              "version": "17.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.4",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.4.15",
              "status": "affected",
              "version": "17.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.8.4",
              "status": "affected",
              "version": "17.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": ".NET 7.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.15",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": ".NET 8.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "8.0.1",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Identity Model v6.0.0 forNuget",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.34.0",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Identity Model v7.0.0 for Nuget",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.1.2",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Identity Model v6.0.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.34.0",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Identity Model v5.0.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "5.7.0",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Identity Model v7.0.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.1.2",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Identity Model v5.0.0 for Nuget",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "5.7.0",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.26",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.2.23",
                  "versionStartIncluding": "17.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.6.11",
                  "versionStartIncluding": "17.6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.4.15",
                  "versionStartIncluding": "17.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.8.4",
                  "versionStartIncluding": "17.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.15",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.0.1",
                  "versionStartIncluding": "8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:identitymodel_for_nuget:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.34.0",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:identitymodel_for_nuget:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:identitymodel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.34.0",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:identitymodel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.7.0",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:identitymodel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:identitymodel_for_nuget:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.7.0",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-01-09T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Microsoft Identity Denial of service vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-03T01:46:56.518Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Identity Denial of service vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"
        }
      ],
      "title": "Microsoft Identity Denial of service vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-21319",
    "datePublished": "2024-01-09T18:59:01.270Z",
    "dateReserved": "2023-12-08T22:45:19.367Z",
    "dateUpdated": "2025-06-03T14:29:52.502Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-29999 (GCVE-0-2025-29999)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:26

Severity ?

6.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
5.4 (Medium) - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-269 - Improper Privilege Management

Summary

A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application searches for executable files in the application folder without proper validation. This could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-525431.html

Impacted products

	Vendor	Product	Version
	Siemens	Siemens License Server (SLS)	Version: 0 < V4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-29999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:25:44.643425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:26:14.840Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Siemens License Server (SLS)",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The affected application searches for executable files in the application folder without proper validation.\r\nThis could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:28.099Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-525431.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2025-29999",
    "datePublished": "2025-04-08T08:22:28.099Z",
    "dateReserved": "2025-03-13T14:30:18.938Z",
    "dateUpdated": "2025-04-08T13:26:14.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5678 (GCVE-0-2023-5678)

Vulnerability from cvelistv5

Published

2023-11-06 15:47

Modified

2024-10-14 14:55

Severity ?

CWE

CWE-606 - Unchecked Input for Loop Condition

Summary

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20231106.txt	vendor-advisory
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 1.0.2 < 1.0.2zj Version: 1.1.1 < 1.1.1x Version: 3.0.0 ≤ Version: 3.1.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:07:32.546Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20231106.txt"
          },
          {
            "name": "1.0.2zj git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055"
          },
          {
            "name": "1.1.1x git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c"
          },
          {
            "name": "3.0.13 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017"
          },
          {
            "name": "3.1.5 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231130-0010/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/11/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "1.0.2zj",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.1x",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.13",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.5",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "David Benjamin (Google)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Richard Levitte"
        }
      ],
      "datePublic": "2023-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Generating excessively long X9.42 DH keys or checking\u003cbr\u003eexcessively long X9.42 DH keys or parameters may be very slow.\u003cbr\u003e\u003cbr\u003eImpact summary: Applications that use the functions DH_generate_key() to\u003cbr\u003egenerate an X9.42 DH key may experience long delays.  Likewise, applications\u003cbr\u003ethat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\u003cbr\u003eto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\u003cbr\u003eWhere the key or parameters that are being checked have been obtained from\u003cbr\u003ean untrusted source this may lead to a Denial of Service.\u003cbr\u003e\u003cbr\u003eWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\u003cbr\u003eDH_check_pub_key() doesn\u0027t make any of these checks, and is therefore\u003cbr\u003evulnerable for excessively large P and Q parameters.\u003cbr\u003e\u003cbr\u003eLikewise, while DH_generate_key() performs a check for an excessively large\u003cbr\u003eP, it doesn\u0027t check for an excessively large Q.\u003cbr\u003e\u003cbr\u003eAn application that calls DH_generate_key() or DH_check_pub_key() and\u003cbr\u003esupplies a key or parameters obtained from an untrusted source could be\u003cbr\u003evulnerable to a Denial of Service attack.\u003cbr\u003e\u003cbr\u003eDH_generate_key() and DH_check_pub_key() are also called by a number of\u003cbr\u003eother OpenSSL functions.  An application calling any of those other\u003cbr\u003efunctions may similarly be affected.  The other functions affected by this\u003cbr\u003eare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\u003cbr\u003e\u003cbr\u003eAlso vulnerable are the OpenSSL pkey command line application when using the\u003cbr\u003e\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\u003cbr\u003e\u003cbr\u003eThe OpenSSL SSL/TLS implementation is not affected by this issue.\u003cbr\u003e\u003cbr\u003eThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn\u0027t make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn\u0027t check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "LOW"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-606",
              "description": "CWE-606 Unchecked Input for Loop Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:55:53.778Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20231106.txt"
        },
        {
          "name": "1.0.2zj git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055"
        },
        {
          "name": "1.1.1x git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c"
        },
        {
          "name": "3.0.13 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017"
        },
        {
          "name": "3.1.5 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Excessive time spent in DH check / generation with large Q parameter value",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2023-5678",
    "datePublished": "2023-11-06T15:47:30.795Z",
    "dateReserved": "2023-10-20T09:38:43.518Z",
    "dateUpdated": "2024-10-14T14:55:53.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5363 (GCVE-0-2023-5363)

Vulnerability from cvelistv5

Published

2023-10-24 15:31

Modified

2024-10-14 14:55

Severity ?

CWE

CWE-684 - Incorrect Provision of Specified Functionality

Summary

Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes. When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been established. Any alterations to the key length, via the "keylen" parameter or the IV length, via the "ivlen" parameter, within the OSSL_PARAM array will not take effect as intended, potentially causing truncation or overreading of these values. The following ciphers and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB. For the CCM, GCM and OCB cipher modes, truncation of the IV can result in loss of confidentiality. For example, when following NIST's SP 800-38D section 8.2.1 guidance for constructing a deterministic IV for AES in GCM mode, truncation of the counter portion could lead to IV reuse. Both truncations and overruns of the key and overruns of the IV will produce incorrect results and could, in some cases, trigger a memory exception. However, these issues are not currently assessed as security critical. Changing the key and/or IV lengths is not considered to be a common operation and the vulnerable API was recently introduced. Furthermore it is likely that application developers will have spotted this problem during testing since decryption would fail unless both peers in the communication were similarly vulnerable. For these reasons we expect the probability of an application being vulnerable to this to be quite low. However if an application is vulnerable then this issue is considered very serious. For these reasons we have assessed this issue as Moderate severity overall. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because the issue lies outside of the FIPS provider boundary. OpenSSL 3.1 and 3.0 are vulnerable to this issue.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20231024.txt	vendor-advisory
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5f69f5c65e483928c4b28ed16af6e5742929f1ee	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0df40630850fb2740e6be6890bb905d3fc623b2d	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.0.0 ≤ Version: 3.1.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:59:44.527Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20231024.txt"
          },
          {
            "name": "3.1.4 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5f69f5c65e483928c4b28ed16af6e5742929f1ee"
          },
          {
            "name": "3.0.12 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0df40630850fb2740e6be6890bb905d3fc623b2d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/10/24/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5532"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231027-0010/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240201-0003/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240201-0004/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.0.12",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.4",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Tony Battersby (Cybernetics)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Dr Paul Dale"
        }
      ],
      "datePublic": "2023-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: A bug has been identified in the processing of key and\u003cbr\u003einitialisation vector (IV) lengths.  This can lead to potential truncation\u003cbr\u003eor overruns during the initialisation of some symmetric ciphers.\u003cbr\u003e\u003cbr\u003eImpact summary: A truncation in the IV can result in non-uniqueness,\u003cbr\u003ewhich could result in loss of confidentiality for some cipher modes.\u003cbr\u003e\u003cbr\u003eWhen calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or\u003cbr\u003eEVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after\u003cbr\u003ethe key and IV have been established.  Any alterations to the key length,\u003cbr\u003evia the \"keylen\" parameter or the IV length, via the \"ivlen\" parameter,\u003cbr\u003ewithin the OSSL_PARAM array will not take effect as intended, potentially\u003cbr\u003ecausing truncation or overreading of these values.  The following ciphers\u003cbr\u003eand cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.\u003cbr\u003e\u003cbr\u003eFor the CCM, GCM and OCB cipher modes, truncation of the IV can result in\u003cbr\u003eloss of confidentiality.  For example, when following NIST\u0027s SP 800-38D\u003cbr\u003esection 8.2.1 guidance for constructing a deterministic IV for AES in\u003cbr\u003eGCM mode, truncation of the counter portion could lead to IV reuse.\u003cbr\u003e\u003cbr\u003eBoth truncations and overruns of the key and overruns of the IV will\u003cbr\u003eproduce incorrect results and could, in some cases, trigger a memory\u003cbr\u003eexception.  However, these issues are not currently assessed as security\u003cbr\u003ecritical.\u003cbr\u003e\u003cbr\u003eChanging the key and/or IV lengths is not considered to be a common operation\u003cbr\u003eand the vulnerable API was recently introduced. Furthermore it is likely that\u003cbr\u003eapplication developers will have spotted this problem during testing since\u003cbr\u003edecryption would fail unless both peers in the communication were similarly\u003cbr\u003evulnerable. For these reasons we expect the probability of an application being\u003cbr\u003evulnerable to this to be quite low. However if an application is vulnerable then\u003cbr\u003ethis issue is considered very serious. For these reasons we have assessed this\u003cbr\u003eissue as Moderate severity overall.\u003cbr\u003e\u003cbr\u003eThe OpenSSL SSL/TLS implementation is not affected by this issue.\u003cbr\u003e\u003cbr\u003eThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because\u003cbr\u003ethe issue lies outside of the FIPS provider boundary.\u003cbr\u003e\u003cbr\u003eOpenSSL 3.1 and 3.0 are vulnerable to this issue."
            }
          ],
          "value": "Issue summary: A bug has been identified in the processing of key and\ninitialisation vector (IV) lengths.  This can lead to potential truncation\nor overruns during the initialisation of some symmetric ciphers.\n\nImpact summary: A truncation in the IV can result in non-uniqueness,\nwhich could result in loss of confidentiality for some cipher modes.\n\nWhen calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or\nEVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after\nthe key and IV have been established.  Any alterations to the key length,\nvia the \"keylen\" parameter or the IV length, via the \"ivlen\" parameter,\nwithin the OSSL_PARAM array will not take effect as intended, potentially\ncausing truncation or overreading of these values.  The following ciphers\nand cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.\n\nFor the CCM, GCM and OCB cipher modes, truncation of the IV can result in\nloss of confidentiality.  For example, when following NIST\u0027s SP 800-38D\nsection 8.2.1 guidance for constructing a deterministic IV for AES in\nGCM mode, truncation of the counter portion could lead to IV reuse.\n\nBoth truncations and overruns of the key and overruns of the IV will\nproduce incorrect results and could, in some cases, trigger a memory\nexception.  However, these issues are not currently assessed as security\ncritical.\n\nChanging the key and/or IV lengths is not considered to be a common operation\nand the vulnerable API was recently introduced. Furthermore it is likely that\napplication developers will have spotted this problem during testing since\ndecryption would fail unless both peers in the communication were similarly\nvulnerable. For these reasons we expect the probability of an application being\nvulnerable to this to be quite low. However if an application is vulnerable then\nthis issue is considered very serious. For these reasons we have assessed this\nissue as Moderate severity overall.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because\nthe issue lies outside of the FIPS provider boundary.\n\nOpenSSL 3.1 and 3.0 are vulnerable to this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "MODERATE"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-684",
              "description": "CWE-684 Incorrect Provision of Specified Functionality",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:55:52.132Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20231024.txt"
        },
        {
          "name": "3.1.4 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5f69f5c65e483928c4b28ed16af6e5742929f1ee"
        },
        {
          "name": "3.0.12 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0df40630850fb2740e6be6890bb905d3fc623b2d"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect cipher key \u0026 IV length processing",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2023-5363",
    "datePublished": "2023-10-24T15:31:40.890Z",
    "dateReserved": "2023-10-03T16:19:46.060Z",
    "dateUpdated": "2024-10-14T14:55:52.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9143 (GCVE-0-2024-9143)

Vulnerability from cvelistv5

Published

2024-10-16 17:09

Modified

2025-09-01 08:29

Severity ?

CWE

CWE-125 - Out-of-bounds Read
CWE-787 - Out-of-bounds Write

Summary

Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an "exotic" curve encoding. The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions. Applications working with "exotic" explicit binary (GF(2^m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the above or similar APIs, may terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

References

▼	URL	Tags
	https://openssl-library.org/news/secadv/20241016.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4	patch
	https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700	patch
	https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154	patch
	https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712	patch
	https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a	patch
	https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.3.0 ≤ Version: 3.2.0 ≤ Version: 3.1.0 ≤ Version: 3.0.0 ≤ Version: 1.1.1 < 1.1.1zb Version: 1.0.2 < 1.0.2zl

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-9143",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T19:45:11.544020Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-08T15:30:04.030Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-11-01T17:03:16.065Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/10/16/1"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/10/23/1"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/10/24/1"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241101-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.3.3",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2.4",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.8",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1zb",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zl",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Google OSS-Fuzz-Gen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Viktor Dukhovni"
        }
      ],
      "datePublic": "2024-10-16T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\u003cbr\u003eexplicit values for the field polynomial can lead to out-of-bounds memory reads\u003cbr\u003eor writes.\u003cbr\u003e\u003cbr\u003eImpact summary: Out of bound memory writes can lead to an application crash or\u003cbr\u003eeven a possibility of a remote code execution, however, in all the protocols\u003cbr\u003einvolving Elliptic Curve Cryptography that we\u0027re aware of, either only \"named\u003cbr\u003ecurves\" are supported, or, if explicit curve parameters are supported, they\u003cbr\u003especify an X9.62 encoding of binary (GF(2^m)) curves that can\u0027t represent\u003cbr\u003eproblematic input values. Thus the likelihood of existence of a vulnerable\u003cbr\u003eapplication is low.\u003cbr\u003e\u003cbr\u003eIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\u003cbr\u003eso problematic inputs cannot occur in the context of processing X.509\u003cbr\u003ecertificates.  Any problematic use-cases would have to be using an \"exotic\"\u003cbr\u003ecurve encoding.\u003cbr\u003e\u003cbr\u003eThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\u003cbr\u003eand various supporting BN_GF2m_*() functions.\u003cbr\u003e\u003cbr\u003eApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\u003cbr\u003ethat make it possible to represent invalid field polynomials with a zero\u003cbr\u003econstant term, via the above or similar APIs, may terminate abruptly as a\u003cbr\u003eresult of reading or writing outside of array bounds.  Remote code execution\u003cbr\u003ecannot easily be ruled out.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."
            }
          ],
          "value": "Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we\u0027re aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can\u0027t represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-01T08:29:10.392Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20241016.txt"
        },
        {
          "name": "3.3.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4"
        },
        {
          "name": "3.2.4 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700"
        },
        {
          "name": "3.1.8 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154"
        },
        {
          "name": "3.0.16 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712"
        },
        {
          "name": "1.1.1zb git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a"
        },
        {
          "name": "1.0.2zl git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Low-level invalid GF(2^m) parameters lead to OOB memory access",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2024-9143",
    "datePublished": "2024-10-16T17:09:23.844Z",
    "dateReserved": "2024-09-24T08:37:04.834Z",
    "dateUpdated": "2025-09-01T08:29:10.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21658 (GCVE-0-2022-21658)

Vulnerability from cvelistv5

Published

2022-01-20 00:00

Modified

2025-04-22 18:32

Severity ?

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

CWE

CWE-363 - Race Condition Enabling Link Following
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Summary

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.

References

▼	URL	Tags
	https://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2
	https://github.com/rust-lang/rust/pull/93110
	https://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946
	https://github.com/rust-lang/rust/pull/93110/commits/406cc071d6cfdfdb678bf3d83d766851de95abaf
	https://github.com/rust-lang/rust/pull/93110/commits/4f0ad1c92ca08da6e8dc17838070975762f59714
	https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BK32QZLHDC2OVLPKTUHNT2G3VHWHD4LX/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63NH72Q7UHJM5V3IVYRI7LVBGGFQMSQ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKGTACKMKAPRDPWPTU26GYWBELIRFF5N/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JKZDTBMGAWIFJSNWKBMPO5EAKRR4BEW/	vendor-advisory
	https://support.apple.com/kb/HT213183
	https://support.apple.com/kb/HT213182
	https://support.apple.com/kb/HT213186
	https://support.apple.com/kb/HT213193
	https://security.gentoo.org/glsa/202210-09	vendor-advisory

Impacted products

	Vendor	Product	Version
	rust-lang	rust	Version: < 1.58.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:46:39.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/rust-lang/rust/pull/93110"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/rust-lang/rust/pull/93110/commits/406cc071d6cfdfdb678bf3d83d766851de95abaf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/rust-lang/rust/pull/93110/commits/4f0ad1c92ca08da6e8dc17838070975762f59714"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html"
          },
          {
            "name": "FEDORA-2022-1bafa3fc91",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BK32QZLHDC2OVLPKTUHNT2G3VHWHD4LX/"
          },
          {
            "name": "FEDORA-2022-2c73789458",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63NH72Q7UHJM5V3IVYRI7LVBGGFQMSQ/"
          },
          {
            "name": "FEDORA-2022-1b76e3a192",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKGTACKMKAPRDPWPTU26GYWBELIRFF5N/"
          },
          {
            "name": "FEDORA-2022-06569a0a60",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JKZDTBMGAWIFJSNWKBMPO5EAKRR4BEW/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT213183"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT213182"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT213186"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT213193"
          },
          {
            "name": "GLSA-202210-09",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-09"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21658",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T15:52:12.198921Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T18:32:53.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rust",
          "vendor": "rust-lang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.58.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn\u0027t otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don\u0027t have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-363",
              "description": "CWE-363: Race Condition Enabling Link Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-16T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2"
        },
        {
          "url": "https://github.com/rust-lang/rust/pull/93110"
        },
        {
          "url": "https://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946"
        },
        {
          "url": "https://github.com/rust-lang/rust/pull/93110/commits/406cc071d6cfdfdb678bf3d83d766851de95abaf"
        },
        {
          "url": "https://github.com/rust-lang/rust/pull/93110/commits/4f0ad1c92ca08da6e8dc17838070975762f59714"
        },
        {
          "url": "https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html"
        },
        {
          "name": "FEDORA-2022-1bafa3fc91",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BK32QZLHDC2OVLPKTUHNT2G3VHWHD4LX/"
        },
        {
          "name": "FEDORA-2022-2c73789458",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63NH72Q7UHJM5V3IVYRI7LVBGGFQMSQ/"
        },
        {
          "name": "FEDORA-2022-1b76e3a192",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKGTACKMKAPRDPWPTU26GYWBELIRFF5N/"
        },
        {
          "name": "FEDORA-2022-06569a0a60",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JKZDTBMGAWIFJSNWKBMPO5EAKRR4BEW/"
        },
        {
          "url": "https://support.apple.com/kb/HT213183"
        },
        {
          "url": "https://support.apple.com/kb/HT213182"
        },
        {
          "url": "https://support.apple.com/kb/HT213186"
        },
        {
          "url": "https://support.apple.com/kb/HT213193"
        },
        {
          "name": "GLSA-202210-09",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-09"
        }
      ],
      "source": {
        "advisory": "GHSA-r9cc-f5pr-p3j2",
        "discovery": "UNKNOWN"
      },
      "title": "Race condition in std::fs::remove_dir_all in rustlang"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-21658",
    "datePublished": "2022-01-20T00:00:00.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2025-04-22T18:32:53.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-23814 (GCVE-0-2024-23814)

Vulnerability from cvelistv5

Published

2025-02-11 10:28

Modified

2025-07-10 10:53

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-400 - Uncontrolled Resource Consumption

Summary

The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re-assembly. This could allow an unauthenticated remote attacker to cause a temporary denial of service condition of the ICMP service, other communication services are not affected. Affected devices will resume normal operation after the attack terminates.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-769027.html
	https://cert-portal.siemens.com/productcert/html/ssa-725549.html

Impacted products

Vendor

Product

Version

▼

Siemens

SIDOOR ATD430W

Version: 0 < *

Siemens	SIDOOR ATE530G COATED	Version: 0 < *
Siemens	SIDOOR ATE530S COATED	Version: 0 < *
Siemens	SIMATIC CFU DIQ	Version: 0 < V2.0.0
Siemens	SIMATIC CFU PA	Version: 0 < V2.0.0
Siemens	SIMATIC CFU PA	Version: 0 < V2.0
Siemens	SIMATIC ET 200AL IM 157-1 PN	Version: 0 < *
Siemens	SIMATIC ET 200M IM 153-4 PN IO HF	Version: 0 < *
Siemens	SIMATIC ET 200M IM 153-4 PN IO ST	Version: 0 < *
Siemens	SIMATIC ET 200MP IM 155-5 PN BA	Version: 0 < *
Siemens	SIMATIC ET 200MP IM 155-5 PN HF	Version: 0 < *
Siemens	SIMATIC ET 200MP IM 155-5 PN ST	Version: 0 < *
Siemens	SIMATIC ET 200MP IM 155-5 PN ST	Version: 0 < *
Siemens	SIMATIC ET 200pro IM 154-3 PN HF	Version: 0 < *
Siemens	SIMATIC ET 200pro IM 154-4 PN HF	Version: 0 < *
Siemens	SIMATIC ET 200pro IM 154-8 PN/DP CPU	Version: 0 < *
Siemens	SIMATIC ET 200pro IM 154-8F PN/DP CPU	Version: 0 < *
Siemens	SIMATIC ET 200pro IM 154-8FX PN/DP CPU	Version: 0 < *
Siemens	SIMATIC ET 200S IM 151-3 PN FO	Version: 0 < *
Siemens	SIMATIC ET 200S IM 151-3 PN HF	Version: 0 < *
Siemens	SIMATIC ET 200S IM 151-3 PN HS	Version: 0 < *
Siemens	SIMATIC ET 200S IM 151-3 PN ST	Version: 0 < *
Siemens	SIMATIC ET 200S IM 151-8 PN/DP CPU	Version: 0 < *
Siemens	SIMATIC ET 200S IM 151-8F PN/DP CPU	Version: 0 < *
Siemens	SIMATIC ET 200SP CPU 1510SP F-1 PN	Version: 0 < *
Siemens	SIMATIC ET 200SP CPU 1510SP-1 PN	Version: 0 < *
Siemens	SIMATIC ET 200SP CPU 1512SP F-1 PN	Version: 0 < *
Siemens	SIMATIC ET 200SP CPU 1512SP-1 PN	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 MF HF	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 PN BA	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)	Version: 0 < V1.3
Siemens	SIMATIC ET 200SP IM 155-6 PN HF	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 PN HS	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 PN ST	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 PN ST	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 PN ST BA	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 PN ST BA	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 PN/2 HF	Version: 0 < *
Siemens	SIMATIC ET 200SP IM 155-6 PN/3 HF	Version: 0 < *
Siemens	SIMATIC PN/PN Coupler	Version: 0 < V6.0.0
Siemens	SIMATIC Power Line Booster PLB, Base Module	Version: 0 < *
Siemens	SIMATIC Power Line Booster PLB, Modem Module ST	Version: 0 < *
Siemens	SIMATIC S7-1200 CPU 1211C AC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1211C DC/DC/DC	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1211C DC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1212C AC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1212C DC/DC/DC	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1212C DC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1212FC DC/DC/DC	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1212FC DC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1214C AC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1214C DC/DC/DC	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1214C DC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1214FC DC/DC/DC	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1214FC DC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1215C AC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1215C DC/DC/DC	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1215C DC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1215FC DC/DC/DC	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1215FC DC/DC/Rly	Version: 0 < V4.4
Siemens	SIMATIC S7-1200 CPU 1217C DC/DC/DC	Version: 0 < V4.4
Siemens	SIMATIC S7-1500 CPU 1511-1 PN	Version: 0 < *
Siemens	SIMATIC S7-1500 CPU 1511F-1 PN	Version: 0 < *
Siemens	SIMATIC S7-1500 CPU 1513-1 PN	Version: 0 < *
Siemens	SIMATIC S7-1500 CPU 1513F-1 PN	Version: 0 < *
Siemens	SIMATIC S7-1500 CPU 1515-2 PN	Version: 0 < *
Siemens	SIMATIC S7-1500 CPU 1515F-2 PN	Version: 0 < *
Siemens	SIMATIC S7-1500 CPU 1516-3 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-1500 CPU 1516F-3 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 314C-2 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 315-2 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 315F-2 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 315T-3 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 317-2 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 317F-2 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 317T-3 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 317TF-3 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 319-3 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-300 CPU 319F-3 PN/DP	Version: 0 < *
Siemens	SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)	Version: 0 < *
Siemens	SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)	Version: 0 < *
Siemens	SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants)	Version: 0 < V10.2
Siemens	SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants)	Version: 0 < V8.3
Siemens	SIMATIC TDC CP51M1	Version: 0 < *
Siemens	SIMATIC TDC CPU555	Version: 0 < *
Siemens	SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants)	Version: 0 < *
Siemens	SIMOCODE pro V PROFINET	Version: 0 < *
Siemens	SINUMERIK 840D sl	Version: 0 < *
Siemens	SIPLUS ET 200M IM 153-4 PN IO HF	Version: 0 < *
Siemens	SIPLUS ET 200M IM 153-4 PN IO ST	Version: 0 < *
Siemens	SIPLUS ET 200MP IM 155-5 PN HF	Version: 0 < *
Siemens	SIPLUS ET 200MP IM 155-5 PN HF	Version: 0 < *
Siemens	SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL	Version: 0 < *
Siemens	SIPLUS ET 200MP IM 155-5 PN ST	Version: 0 < *
Siemens	SIPLUS ET 200MP IM 155-5 PN ST	Version: 0 < *
Siemens	SIPLUS ET 200MP IM 155-5 PN ST TX RAIL	Version: 0 < *
Siemens	SIPLUS ET 200MP IM 155-5 PN ST TX RAIL	Version: 0 < *
Siemens	SIPLUS ET 200S IM 151-8 PN/DP CPU	Version: 0 < *
Siemens	SIPLUS ET 200S IM 151-8F PN/DP CPU	Version: 0 < *
Siemens	SIPLUS ET 200S IM151-3 PN HF	Version: 0 < *
Siemens	SIPLUS ET 200S IM151-3 PN ST	Version: 0 < *
Siemens	SIPLUS ET 200SP CPU 1512SP F-1 PN	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN HF	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN HF	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN HF	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN HF	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN HF TX RAIL	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN ST	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN ST	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN ST BA	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN ST BA	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN ST TX RAIL	Version: 0 < *
Siemens	SIPLUS ET 200SP IM 155-6 PN ST TX RAIL	Version: 0 < *
Siemens	SIPLUS HCS4200 CIM4210	Version: 0 < *
Siemens	SIPLUS HCS4200 CIM4210C	Version: 0 < *
Siemens	SIPLUS HCS4300 CIM4310	Version: 0 < *
Siemens	SIPLUS NET PN/PN Coupler	Version: 0 < V6.0.0
Siemens	SIPLUS S7-1200 CPU 1212 AC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1212 AC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1212 DC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1212 DC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214 AC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214 AC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214 AC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214 DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214 DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214 DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214 DC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214 DC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214 DC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214FC DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1214FC DC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215 AC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215 AC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215 AC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/RLY	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215C DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1200 CPU 1215FC DC/DC/DC	Version: 0 < V4.4
Siemens	SIPLUS S7-1500 CPU 1511-1 PN	Version: 0 < *
Siemens	SIPLUS S7-1500 CPU 1511F-1 PN	Version: 0 < *
Siemens	SIPLUS S7-1500 CPU 1513-1 PN	Version: 0 < *
Siemens	SIPLUS S7-1500 CPU 1513F-1 PN	Version: 0 < *
Siemens	SIPLUS S7-1500 CPU 1516-3 PN/DP	Version: 0 < *
Siemens	SIPLUS S7-1500 CPU 1516-3 PN/DP	Version: 0 < *
Siemens	SIPLUS S7-1500 CPU 1516F-3 PN/DP	Version: 0 < *
Siemens	SIPLUS S7-300 CPU 314C-2 PN/DP	Version: 0 < *
Siemens	SIPLUS S7-300 CPU 315-2 PN/DP	Version: 0 < *
Siemens	SIPLUS S7-300 CPU 315F-2 PN/DP	Version: 0 < *
Siemens	SIPLUS S7-300 CPU 317-2 PN/DP	Version: 0 < *
Siemens	SIPLUS S7-300 CPU 317F-2 PN/DP	Version: 0 < *
Siemens	SIWAREX WP231	Version: 0 < *
Siemens	SIWAREX WP241	Version: 0 < *
Siemens	SIWAREX WP251	Version: 0 < *
Siemens	SIWAREX WP521 ST	Version: 0 < *
Siemens	SIWAREX WP522 ST	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-23814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T14:39:31.990801Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T14:39:43.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SIDOOR ATD430W",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIDOOR ATE530G COATED",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIDOOR ATE530S COATED",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC CFU DIQ",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC CFU PA",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC CFU PA",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200AL IM 157-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200M IM 153-4 PN IO HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200M IM 153-4 PN IO ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200MP IM 155-5 PN BA",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200MP IM 155-5 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200MP IM 155-5 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200MP IM 155-5 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200pro IM 154-3 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200pro IM 154-4 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200pro IM 154-8 PN/DP CPU",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200pro IM 154-8F PN/DP CPU",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200pro IM 154-8FX PN/DP CPU",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200S IM 151-3 PN FO",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200S IM 151-3 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200S IM 151-3 PN HS",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200S IM 151-3 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200S IM 151-8 PN/DP CPU",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200S IM 151-8F PN/DP CPU",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP CPU 1510SP F-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP CPU 1510SP-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP CPU 1512SP F-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP CPU 1512SP-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 MF HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN BA",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN HS",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN ST BA",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN ST BA",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN/2 HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ET 200SP IM 155-6 PN/3 HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC PN/PN Coupler",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V6.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC Power Line Booster PLB, Base Module",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC Power Line Booster PLB, Modem Module ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1211C AC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1211C DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1211C DC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1212C AC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1212C DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1212C DC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1212FC DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1212FC DC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1214C AC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1214C DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1214C DC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1214FC DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1214FC DC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1215C AC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1215C DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1215C DC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1215FC DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1215FC DC/DC/Rly",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1200 CPU 1217C DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 CPU 1511-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 CPU 1511F-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 CPU 1513-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 CPU 1513F-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 CPU 1515-2 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 CPU 1515F-2 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 CPU 1516-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 CPU 1516F-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 314C-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 315-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 315F-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 315T-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 317-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 317F-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 317T-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 317TF-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 319-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-300 CPU 319F-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V10.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V8.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC TDC CP51M1",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC TDC CPU555",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMOCODE pro V PROFINET",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SINUMERIK 840D sl",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200M IM 153-4 PN IO HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200M IM 153-4 PN IO ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200MP IM 155-5 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200MP IM 155-5 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200MP IM 155-5 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200MP IM 155-5 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200MP IM 155-5 PN ST TX RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200MP IM 155-5 PN ST TX RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200S IM 151-8 PN/DP CPU",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200S IM 151-8F PN/DP CPU",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200S IM151-3 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200S IM151-3 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP CPU 1512SP F-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN HF",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN HF TX RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN ST BA",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN ST BA",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN ST TX RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS ET 200SP IM 155-6 PN ST TX RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS HCS4200 CIM4210",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS HCS4200 CIM4210C",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS HCS4300 CIM4310",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS NET PN/PN Coupler",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V6.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1212 AC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1212 AC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1212 DC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1212 DC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1212C DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1212C DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214 AC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214 AC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214 AC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214 DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214 DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214 DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214 DC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214 DC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214 DC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214FC DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1214FC DC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215 AC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215 AC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215 AC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215 DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215 DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215 DC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215 DC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215 DC/DC/RLY",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215C DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1200 CPU 1215FC DC/DC/DC",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1500 CPU 1511-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1500 CPU 1511F-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1500 CPU 1513-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1500 CPU 1513F-1 PN",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1500 CPU 1516-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1500 CPU 1516-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-1500 CPU 1516F-3 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-300 CPU 314C-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-300 CPU 315-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-300 CPU 315F-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-300 CPU 317-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS S7-300 CPU 317F-2 PN/DP",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIWAREX WP231",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIWAREX WP241",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIWAREX WP251",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIWAREX WP521 ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIWAREX WP522 ST",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The integrated ICMP service of the network stack of affected devices can be  forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re-assembly. This could allow an unauthenticated remote attacker to cause a temporary denial of service condition of the ICMP service, other communication services are not affected. Affected devices will resume normal operation after the attack terminates."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T10:53:47.525Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-725549.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-23814",
    "datePublished": "2025-02-11T10:28:33.403Z",
    "dateReserved": "2024-01-22T17:44:56.763Z",
    "dateUpdated": "2025-07-10T10:53:47.525Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41790 (GCVE-0-2024-41790)

Vulnerability from cvelistv5

Published

2025-04-08 08:22

Modified

2025-04-08 13:21

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Impacted products

	Vendor	Product	Version
	Siemens	SENTRON 7KT PAC1260 Data Manager	Version: 0 < *

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41790",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:20:54.874407Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:21:17.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SENTRON 7KT PAC1260 Data Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T08:22:04.239Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-187636.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-41790",
    "datePublished": "2025-04-08T08:22:04.239Z",
    "dateReserved": "2024-07-22T13:19:53.376Z",
    "dateUpdated": "2025-04-08T13:21:17.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-2975 (GCVE-0-2023-2975)

Vulnerability from cvelistv5

Published

2023-07-14 11:16

Modified

2025-04-23 16:20

Severity ?

CWE

CWE-354 - Improper Validation of Integrity Check Value

Summary

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20230714.txt	vendor-advisory
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc	patch
	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.1.0 ≤ Version: 3.0.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:41:04.070Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20230714.txt"
          },
          {
            "name": "3.1.2 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc"
          },
          {
            "name": "3.0.10 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/07/15/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230725-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202402-08"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-2975",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:26:23.638671Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:20:14.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.1.2",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.10",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Juerg Wullschleger (Google)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Tomas Mraz"
        }
      ],
      "datePublic": "2023-07-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: The AES-SIV cipher implementation contains a bug that causes\u003cbr\u003eit to ignore empty associated data entries which are unauthenticated as\u003cbr\u003ea consequence.\u003cbr\u003e\u003cbr\u003eImpact summary: Applications that use the AES-SIV algorithm and want to\u003cbr\u003eauthenticate empty data entries as associated data can be misled by removing,\u003cbr\u003eadding or reordering such empty entries as these are ignored by the OpenSSL\u003cbr\u003eimplementation. We are currently unaware of any such applications.\u003cbr\u003e\u003cbr\u003eThe AES-SIV algorithm allows for authentication of multiple associated\u003cbr\u003edata entries along with the encryption. To authenticate empty data the\u003cbr\u003eapplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\u003cbr\u003eNULL pointer as the output buffer and 0 as the input buffer length.\u003cbr\u003eThe AES-SIV implementation in OpenSSL just returns success for such a call\u003cbr\u003einstead of performing the associated data authentication operation.\u003cbr\u003eThe empty data thus will not be authenticated.\u003cbr\u003e\u003cbr\u003eAs this issue does not affect non-empty associated data authentication and\u003cbr\u003ewe expect it to be rare for an application to use empty associated data\u003cbr\u003eentries this is qualified as Low severity issue."
            }
          ],
          "value": "Issue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be misled by removing,\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354 Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:55:45.748Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20230714.txt"
        },
        {
          "name": "3.1.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc"
        },
        {
          "name": "3.0.10 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AES-SIV implementation ignores empty associated data entries",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2023-2975",
    "datePublished": "2023-07-14T11:16:25.151Z",
    "dateReserved": "2023-05-30T10:29:34.539Z",
    "dateUpdated": "2025-04-23T16:20:14.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ncsc-2025-0106

Vulnerability from csaf_ncscnl

CVE-2024-41791 (GCVE-0-2024-41791)

Vulnerability from cvelistv5

CVE-2024-0727 (GCVE-0-2024-0727)

Vulnerability from cvelistv5

CVE-2023-3817 (GCVE-0-2023-3817)

Vulnerability from cvelistv5

CVE-2024-41788 (GCVE-0-2024-41788)

Vulnerability from cvelistv5

CVE-2025-1974 (GCVE-0-2025-1974)

Vulnerability from cvelistv5

CVE-2023-3446 (GCVE-0-2023-3446)

Vulnerability from cvelistv5

CVE-2024-0056 (GCVE-0-2024-0056)

Vulnerability from cvelistv5

CVE-2024-41795 (GCVE-0-2024-41795)

Vulnerability from cvelistv5

CVE-2024-5535 (GCVE-0-2024-5535)

Vulnerability from cvelistv5

CVE-2023-4807 (GCVE-0-2023-4807)

Vulnerability from cvelistv5

CVE-2024-41793 (GCVE-0-2024-41793)

Vulnerability from cvelistv5

CVE-2024-41789 (GCVE-0-2024-41789)

Vulnerability from cvelistv5

CVE-2025-1098 (GCVE-0-2025-1098)

Vulnerability from cvelistv5

CVE-2025-24513 (GCVE-0-2025-24513)

Vulnerability from cvelistv5

CVE-2023-7104 (GCVE-0-2023-7104)

Vulnerability from cvelistv5

CVE-2025-1097 (GCVE-0-2025-1097)

Vulnerability from cvelistv5

CVE-2025-30000 (GCVE-0-2025-30000)

Vulnerability from cvelistv5

CVE-2025-24514 (GCVE-0-2025-24514)

Vulnerability from cvelistv5

CVE-2024-54092 (GCVE-0-2024-54092)

Vulnerability from cvelistv5

CVE-2024-0232 (GCVE-0-2024-0232)

Vulnerability from cvelistv5

CVE-2024-41794 (GCVE-0-2024-41794)

Vulnerability from cvelistv5

CVE-2024-30105 (GCVE-0-2024-30105)

Vulnerability from cvelistv5

CVE-2024-41792 (GCVE-0-2024-41792)

Vulnerability from cvelistv5

CVE-2024-41796 (GCVE-0-2024-41796)

Vulnerability from cvelistv5

CVE-2024-54091 (GCVE-0-2024-54091)

Vulnerability from cvelistv5

CVE-2025-30280 (GCVE-0-2025-30280)

Vulnerability from cvelistv5

CVE-2024-21319 (GCVE-0-2024-21319)

Vulnerability from cvelistv5

CVE-2025-29999 (GCVE-0-2025-29999)

Vulnerability from cvelistv5

CVE-2023-5678 (GCVE-0-2023-5678)

Vulnerability from cvelistv5

CVE-2023-5363 (GCVE-0-2023-5363)

Vulnerability from cvelistv5

CVE-2024-9143 (GCVE-0-2024-9143)

Vulnerability from cvelistv5

CVE-2022-21658 (GCVE-0-2022-21658)

Vulnerability from cvelistv5

CVE-2024-23814 (GCVE-0-2024-23814)

Vulnerability from cvelistv5

CVE-2024-41790 (GCVE-0-2024-41790)

Vulnerability from cvelistv5

CVE-2023-2975 (GCVE-0-2023-2975)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature