CWE-749
Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
CVE-2023-51583 (GCVE-0-2023-51583)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:15 – Updated: 2024-08-02 22:40
VLAI
Title
Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability
Summary
Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the UpsScheduler class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22036.
Severity
9.8 (Critical)
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Voltronic Power | ViewPower |
Affected:
1.04.21353
|
Date Public
2023-12-20 23:09
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "viewpower",
"vendor": "voltronicpower",
"versions": [
{
"status": "affected",
"version": "1.04.21353"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-51583",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-03T19:02:44.964376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:20:45.586Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:40:33.769Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1888",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1888/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "ViewPower",
"vendor": "Voltronic Power",
"versions": [
{
"status": "affected",
"version": "1.04.21353"
}
]
}
],
"dateAssigned": "2023-12-20T20:45:49.312Z",
"datePublic": "2023-12-20T23:09:19.129Z",
"descriptions": [
{
"lang": "en",
"value": "Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the UpsScheduler class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22036."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:15:14.835Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1888",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1888/"
}
],
"source": {
"lang": "en",
"value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
},
"title": "Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-51583",
"datePublished": "2024-05-03T02:15:14.835Z",
"dateReserved": "2023-12-20T20:38:20.868Z",
"dateUpdated": "2024-08-02T22:40:33.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-51584 (GCVE-0-2023-51584)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:15 – Updated: 2024-08-02 22:40
VLAI
Title
Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability
Summary
Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.
The specific flaw exists within the shutdown method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22065.
Severity
8.8 (High)
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Voltronic Power | ViewPower |
Affected:
1.04-21353
|
Date Public
2023-12-20 23:09
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "viewpower",
"vendor": "voltronicpower",
"versions": [
{
"status": "affected",
"version": "1.04.21353"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-51584",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-03T18:59:22.361790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:20:50.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:40:34.090Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1889",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1889/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "ViewPower",
"vendor": "Voltronic Power",
"versions": [
{
"status": "affected",
"version": "1.04-21353"
}
]
}
],
"dateAssigned": "2023-12-20T20:45:49.325Z",
"datePublic": "2023-12-20T23:09:22.994Z",
"descriptions": [
{
"lang": "en",
"value": "Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.\n\nThe specific flaw exists within the shutdown method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22065."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:15:15.629Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1889",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1889/"
}
],
"source": {
"lang": "en",
"value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
},
"title": "Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-51584",
"datePublished": "2024-05-03T02:15:15.629Z",
"dateReserved": "2023-12-20T20:38:20.869Z",
"dateUpdated": "2024-08-02T22:40:34.090Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5389 (GCVE-0-2023-5389)
Vulnerability from cvelistv5 – Published: 2024-01-30 20:00 – Updated: 2025-06-17 21:29
VLAI
Summary
An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
9.1 (Critical)
CWE
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | ControlEdge UOC |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) |
|
| Honeywell | ControlEdge UOC |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) |
|
| Honeywell | ControlEdge UOC |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.048Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.honeywell.com/us/en/product-security"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5389",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-31T15:30:52.882701Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-17T21:29:17.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "ControlEdge UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX"
],
"product": "ControlEdge UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"PlantCruise by Experion"
],
"product": "ControlEdge UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nAn attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.\u0026nbsp;"
}
],
"value": "\nAn attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.\u00a0"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-25T16:54:14.096Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
},
{
"url": "https://www.honeywell.com/us/en/product-security"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-5389",
"datePublished": "2024-01-30T20:00:50.382Z",
"dateReserved": "2023-10-04T17:49:59.920Z",
"dateUpdated": "2025-06-17T21:29:17.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12651 (GCVE-0-2024-12651)
Vulnerability from cvelistv5 – Published: 2025-02-14 13:24 – Updated: 2025-02-14 14:00
VLAI
Title
Sensitive Data Exposure in PTT Inc.'s HGS Mobile App
Summary
Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.This issue affects HGS Mobile App: before 6.5.0.
Severity
8.5 (High)
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PTT Inc. | HGS Mobile App |
Affected:
0 , < 6.5.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-14T13:59:09.493697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T14:00:38.374Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HGS Mobile App",
"vendor": "PTT Inc.",
"versions": [
{
"lessThan": "6.5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.\u003cp\u003eThis issue affects HGS Mobile App: before 6.5.0.\u003c/p\u003e"
}
],
"value": "Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.This issue affects HGS Mobile App: before 6.5.0."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749 Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T13:24:13.567Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"url": "https://www.usom.gov.tr/bildirim/tr-25-0034"
}
],
"source": {
"advisory": "TR-25-0034",
"defect": [
"TR-25-0034"
],
"discovery": "UNKNOWN"
},
"title": "Sensitive Data Exposure in PTT Inc.\u0027s HGS Mobile App",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2024-12651",
"datePublished": "2025-02-14T13:24:13.567Z",
"dateReserved": "2024-12-16T07:47:37.434Z",
"dateUpdated": "2025-02-14T14:00:38.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-13242 (GCVE-0-2024-13242)
Vulnerability from cvelistv5 – Published: 2025-01-09 18:49 – Updated: 2025-01-10 17:12
VLAI
Title
Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006
Summary
Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.
Severity
9.1 (Critical)
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | Swift Mailer (abandoned) |
Affected:
*.*
(semver)
|
Date Public
2024-01-24 15:54
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-13242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-10T17:12:27.928453Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-10T17:12:58.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/swiftmailer",
"defaultStatus": "unaffected",
"product": "Swift Mailer (abandoned)",
"repo": "https://git.drupalcode.org/project/swiftmailer",
"vendor": "Drupal",
"versions": [
{
"status": "affected",
"version": "*.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Shepherd"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Adam Shepherd"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Wayne Eaker"
},
{
"lang": "en",
"type": "coordinator",
"value": "Damien McKenna"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison"
}
],
"datePublic": "2024-01-24T15:54:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.\u003cp\u003eThis issue affects Swift Mailer: *.*.\u003c/p\u003e"
}
],
"value": "Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*."
}
],
"impacts": [
{
"capecId": "CAPEC-154",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-154 Resource Location Spoofing"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749 Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T18:49:16.322Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2024-006"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2024-13242",
"datePublished": "2025-01-09T18:49:16.322Z",
"dateReserved": "2025-01-09T18:27:04.220Z",
"dateUpdated": "2025-01-10T17:12:58.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27261 (GCVE-0-2024-27261)
Vulnerability from cvelistv5 – Published: 2024-04-12 12:13 – Updated: 2024-08-02 00:27
VLAI
Title
IBM Storage Defender - Resiliency Service privilege escalation
Summary
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.2 could allow a privileged user to install a potentially dangerous tar file, which could give them access to subsequent systems where the package was installed. IBM X-Force ID: 283986.
Severity
6.4 (Medium)
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7148023 | vendor-advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Storage Defender |
Affected:
2.0.0 , ≤ 2.0.2
(semver)
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:storage_defender_resiliency_service:2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "storage_defender_resiliency_service",
"vendor": "ibm",
"versions": [
{
"lessThanOrEqual": "2.0.2",
"status": "affected",
"version": "2.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27261",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-12T20:49:25.341590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-12T20:50:26.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.747Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7148023"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/283986"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Storage Defender",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "2.0.2",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.2 could allow a privileged user to install a potentially dangerous tar file, which could give them access to subsequent systems where the package was installed. IBM X-Force ID: 283986."
}
],
"value": "IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.2 could allow a privileged user to install a potentially dangerous tar file, which could give them access to subsequent systems where the package was installed. IBM X-Force ID: 283986."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749 Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-12T12:13:17.338Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7148023"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/283986"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Storage Defender - Resiliency Service privilege escalation",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-27261",
"datePublished": "2024-04-12T12:13:17.338Z",
"dateReserved": "2024-02-22T01:26:39.519Z",
"dateUpdated": "2024-08-02T00:27:59.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32764 (GCVE-0-2024-32764)
Vulnerability from cvelistv5 – Published: 2024-04-26 15:00 – Updated: 2024-08-02 02:20
VLAI
Title
myQNAPcloud Link
Summary
A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network.
We have already fixed the vulnerability in the following version:
myQNAPcloud Link 2.4.51 and later
Severity
9.9 (Critical)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| QNAP Systems Inc. | myQNAPcloud Link |
Affected:
2.4.x , < 2.4.51
(custom)
|
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:qnap:myqnapcloud_link:2.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "myqnapcloud_link",
"vendor": "qnap",
"versions": [
{
"lessThan": "2.4.51",
"status": "affected",
"version": "2.4",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32764",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T17:31:11.291616Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:50:44.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:20:35.321Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-24-09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "myQNAPcloud Link",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "2.4.51",
"status": "affected",
"version": "2.4.x",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ZDI-CAN-22457/22458: Team ECQ"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following version:\u003cbr\u003emyQNAPcloud Link 2.4.51 and later\u003cbr\u003e"
}
],
"value": "A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network.\n\nWe have already fixed the vulnerability in the following version:\nmyQNAPcloud Link 2.4.51 and later\n"
}
],
"impacts": [
{
"capecId": "CAPEC-36",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-36"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-346",
"description": "CWE-346",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-749",
"description": "CWE-749",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-26T15:00:51.334Z",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"url": "https://www.qnap.com/en/security-advisory/qsa-24-09"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We have already fixed the vulnerability in the following version:\u003cbr\u003emyQNAPcloud Link 2.4.51 and later\u003cbr\u003e"
}
],
"value": "We have already fixed the vulnerability in the following version:\nmyQNAPcloud Link 2.4.51 and later\n"
}
],
"source": {
"advisory": "QSA-24-09",
"discovery": "EXTERNAL"
},
"title": "myQNAPcloud Link",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2024-32764",
"datePublished": "2024-04-26T15:00:51.334Z",
"dateReserved": "2024-04-18T08:14:16.553Z",
"dateUpdated": "2024-08-02T02:20:35.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-35209 (GCVE-0-2024-35209)
Vulnerability from cvelistv5 – Published: 2024-06-11 11:15 – Updated: 2025-02-11 21:44
VLAI
Summary
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowing HTTP methods like PUT and Delete. This could allow an attacker to modify unauthorized files.
Severity
6.2 (Medium)
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | SINEC Traffic Analyzer |
Affected:
0 , < V1.2
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:siemens:traffic_analyzer:v1.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "traffic_analyzer",
"vendor": "siemens",
"versions": [
{
"lessThan": "v1.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T13:16:07.196850Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-11T21:44:25.793Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:07:46.932Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-196737.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SINEC Traffic Analyzer",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V1.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \u003c V1.2). The affected web server is allowing HTTP methods like PUT and Delete. This could allow an attacker to modify unauthorized files."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-11T10:28:39.628Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-196737.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2024-35209",
"datePublished": "2024-06-11T11:15:50.551Z",
"dateReserved": "2024-05-13T17:54:10.655Z",
"dateUpdated": "2025-02-11T21:44:25.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-43065 (GCVE-0-2024-43065)
Vulnerability from cvelistv5 – Published: 2025-04-07 10:15 – Updated: 2025-04-07 15:56
VLAI
Title
Exposed Dangerous Method or Function in HLOS
Summary
Cryptographic issues while generating an asymmetric key pair for RKP use cases.
Severity
7.1 (High)
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qualcomm, Inc. | Snapdragon |
Affected:
AR8035
Affected: FastConnect 6200 Affected: FastConnect 6700 Affected: FastConnect 6800 Affected: FastConnect 6900 Affected: FastConnect 7800 Affected: QAM8255P Affected: QAM8295P Affected: QAM8620P Affected: QAM8650P Affected: QAM8775P Affected: QAMSRV1H Affected: QAMSRV1M Affected: QCA6174A Affected: QCA6391 Affected: QCA6421 Affected: QCA6426 Affected: QCA6431 Affected: QCA6436 Affected: QCA6574 Affected: QCA6574A Affected: QCA6574AU Affected: QCA6584AU Affected: QCA6595 Affected: QCA6595AU Affected: QCA6678AQ Affected: QCA6688AQ Affected: QCA6696 Affected: QCA6698AQ Affected: QCA6797AQ Affected: QCA8081 Affected: QCA8337 Affected: QCC710 Affected: QCM4325 Affected: QCM5430 Affected: QCM6490 Affected: QCM8550 Affected: QCN6224 Affected: QCN6274 Affected: QCN9274 Affected: QCS5430 Affected: QCS6490 Affected: QCS8300 Affected: QCS8550 Affected: QCS9100 Affected: QDU1000 Affected: QDU1010 Affected: QDU1110 Affected: QDU1210 Affected: QDX1010 Affected: QDX1011 Affected: QEP8111 Affected: QFW7114 Affected: QFW7124 Affected: QMP1000 Affected: QRU1032 Affected: QRU1052 Affected: QRU1062 Affected: QSM8350 Affected: Qualcomm Video Collaboration VC3 Platform Affected: SA4150P Affected: SA4155P Affected: SA6145P Affected: SA6150P Affected: SA6155P Affected: SA7255P Affected: SA7775P Affected: SA8145P Affected: SA8150P Affected: SA8155P Affected: SA8195P Affected: SA8255P Affected: SA8295P Affected: SA8530P Affected: SA8540P Affected: SA8620P Affected: SA8650P Affected: SA8770P Affected: SA8775P Affected: SA9000P Affected: SC8380XP Affected: SD 8 Gen1 5G Affected: SD865 5G Affected: SDM429W Affected: SG4150P Affected: SM4635 Affected: SM6650 Affected: SM7250P Affected: SM7635 Affected: SM7675 Affected: SM7675P Affected: SM8635 Affected: SM8635P Affected: SM8650Q Affected: SM8735 Affected: SM8750 Affected: SM8750P Affected: Snapdragon 4 Gen 1 Mobile Platform Affected: Snapdragon 429 Mobile Platform Affected: Snapdragon 460 Mobile Platform Affected: Snapdragon 480 5G Mobile Platform Affected: Snapdragon 480+ 5G Mobile Platform (SM4350-AC) Affected: Snapdragon 662 Mobile Platform Affected: Snapdragon 680 4G Mobile Platform Affected: Snapdragon 685 4G Mobile Platform (SM6225-AD) Affected: Snapdragon 695 5G Mobile Platform Affected: Snapdragon 765 5G Mobile Platform (SM7250-AA) Affected: Snapdragon 765G 5G Mobile Platform (SM7250-AB) Affected: Snapdragon 768G 5G Mobile Platform (SM7250-AC) Affected: Snapdragon 8 Gen 1 Mobile Platform Affected: Snapdragon 8 Gen 3 Mobile Platform Affected: Snapdragon 865 5G Mobile Platform Affected: Snapdragon 865+ 5G Mobile Platform (SM8250-AB) Affected: Snapdragon 870 5G Mobile Platform (SM8250-AC) Affected: Snapdragon 888 5G Mobile Platform Affected: Snapdragon 888+ 5G Mobile Platform (SM8350-AC) Affected: Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, BB) Affected: Snapdragon AR1 Gen 1 Platform Affected: Snapdragon AR1 Gen 1 Platform "Luna1" Affected: Snapdragon Auto 5G Modem-RF Gen 2 Affected: Snapdragon Wear 4100+ Platform Affected: Snapdragon X35 5G Modem-RF System Affected: Snapdragon X55 5G Modem-RF System Affected: Snapdragon X62 5G Modem-RF System Affected: Snapdragon X65 5G Modem-RF System Affected: Snapdragon X72 5G Modem-RF System Affected: Snapdragon X75 5G Modem-RF System Affected: Snapdragon XR2 5G Platform Affected: SRV1H Affected: SRV1L Affected: SRV1M Affected: SXR2130 Affected: SXR2330P Affected: WCD9340 Affected: WCD9370 Affected: WCD9375 Affected: WCD9378 Affected: WCD9380 Affected: WCD9385 Affected: WCD9390 Affected: WCD9395 Affected: WCN3620 Affected: WCN3660B Affected: WCN3680B Affected: WCN3950 Affected: WCN3980 Affected: WCN3988 Affected: WCN6450 Affected: WCN6650 Affected: WCN6755 Affected: WCN7750 Affected: WCN7860 Affected: WCN7861 Affected: WCN7880 Affected: WCN7881 Affected: WSA8810 Affected: WSA8815 Affected: WSA8830 Affected: WSA8832 Affected: WSA8835 Affected: WSA8840 Affected: WSA8845 Affected: WSA8845H |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-43065",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-07T15:56:06.529335Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-07T15:56:17.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Snapdragon Auto",
"Snapdragon Compute",
"Snapdragon Consumer IOT",
"Snapdragon Industrial IOT",
"Snapdragon Mobile",
"Snapdragon Technology",
"Snapdragon WBC",
"Snapdragon Wearables"
],
"product": "Snapdragon",
"vendor": "Qualcomm, Inc.",
"versions": [
{
"status": "affected",
"version": "AR8035"
},
{
"status": "affected",
"version": "FastConnect 6200"
},
{
"status": "affected",
"version": "FastConnect 6700"
},
{
"status": "affected",
"version": "FastConnect 6800"
},
{
"status": "affected",
"version": "FastConnect 6900"
},
{
"status": "affected",
"version": "FastConnect 7800"
},
{
"status": "affected",
"version": "QAM8255P"
},
{
"status": "affected",
"version": "QAM8295P"
},
{
"status": "affected",
"version": "QAM8620P"
},
{
"status": "affected",
"version": "QAM8650P"
},
{
"status": "affected",
"version": "QAM8775P"
},
{
"status": "affected",
"version": "QAMSRV1H"
},
{
"status": "affected",
"version": "QAMSRV1M"
},
{
"status": "affected",
"version": "QCA6174A"
},
{
"status": "affected",
"version": "QCA6391"
},
{
"status": "affected",
"version": "QCA6421"
},
{
"status": "affected",
"version": "QCA6426"
},
{
"status": "affected",
"version": "QCA6431"
},
{
"status": "affected",
"version": "QCA6436"
},
{
"status": "affected",
"version": "QCA6574"
},
{
"status": "affected",
"version": "QCA6574A"
},
{
"status": "affected",
"version": "QCA6574AU"
},
{
"status": "affected",
"version": "QCA6584AU"
},
{
"status": "affected",
"version": "QCA6595"
},
{
"status": "affected",
"version": "QCA6595AU"
},
{
"status": "affected",
"version": "QCA6678AQ"
},
{
"status": "affected",
"version": "QCA6688AQ"
},
{
"status": "affected",
"version": "QCA6696"
},
{
"status": "affected",
"version": "QCA6698AQ"
},
{
"status": "affected",
"version": "QCA6797AQ"
},
{
"status": "affected",
"version": "QCA8081"
},
{
"status": "affected",
"version": "QCA8337"
},
{
"status": "affected",
"version": "QCC710"
},
{
"status": "affected",
"version": "QCM4325"
},
{
"status": "affected",
"version": "QCM5430"
},
{
"status": "affected",
"version": "QCM6490"
},
{
"status": "affected",
"version": "QCM8550"
},
{
"status": "affected",
"version": "QCN6224"
},
{
"status": "affected",
"version": "QCN6274"
},
{
"status": "affected",
"version": "QCN9274"
},
{
"status": "affected",
"version": "QCS5430"
},
{
"status": "affected",
"version": "QCS6490"
},
{
"status": "affected",
"version": "QCS8300"
},
{
"status": "affected",
"version": "QCS8550"
},
{
"status": "affected",
"version": "QCS9100"
},
{
"status": "affected",
"version": "QDU1000"
},
{
"status": "affected",
"version": "QDU1010"
},
{
"status": "affected",
"version": "QDU1110"
},
{
"status": "affected",
"version": "QDU1210"
},
{
"status": "affected",
"version": "QDX1010"
},
{
"status": "affected",
"version": "QDX1011"
},
{
"status": "affected",
"version": "QEP8111"
},
{
"status": "affected",
"version": "QFW7114"
},
{
"status": "affected",
"version": "QFW7124"
},
{
"status": "affected",
"version": "QMP1000"
},
{
"status": "affected",
"version": "QRU1032"
},
{
"status": "affected",
"version": "QRU1052"
},
{
"status": "affected",
"version": "QRU1062"
},
{
"status": "affected",
"version": "QSM8350"
},
{
"status": "affected",
"version": "Qualcomm Video Collaboration VC3 Platform"
},
{
"status": "affected",
"version": "SA4150P"
},
{
"status": "affected",
"version": "SA4155P"
},
{
"status": "affected",
"version": "SA6145P"
},
{
"status": "affected",
"version": "SA6150P"
},
{
"status": "affected",
"version": "SA6155P"
},
{
"status": "affected",
"version": "SA7255P"
},
{
"status": "affected",
"version": "SA7775P"
},
{
"status": "affected",
"version": "SA8145P"
},
{
"status": "affected",
"version": "SA8150P"
},
{
"status": "affected",
"version": "SA8155P"
},
{
"status": "affected",
"version": "SA8195P"
},
{
"status": "affected",
"version": "SA8255P"
},
{
"status": "affected",
"version": "SA8295P"
},
{
"status": "affected",
"version": "SA8530P"
},
{
"status": "affected",
"version": "SA8540P"
},
{
"status": "affected",
"version": "SA8620P"
},
{
"status": "affected",
"version": "SA8650P"
},
{
"status": "affected",
"version": "SA8770P"
},
{
"status": "affected",
"version": "SA8775P"
},
{
"status": "affected",
"version": "SA9000P"
},
{
"status": "affected",
"version": "SC8380XP"
},
{
"status": "affected",
"version": "SD 8 Gen1 5G"
},
{
"status": "affected",
"version": "SD865 5G"
},
{
"status": "affected",
"version": "SDM429W"
},
{
"status": "affected",
"version": "SG4150P"
},
{
"status": "affected",
"version": "SM4635"
},
{
"status": "affected",
"version": "SM6650"
},
{
"status": "affected",
"version": "SM7250P"
},
{
"status": "affected",
"version": "SM7635"
},
{
"status": "affected",
"version": "SM7675"
},
{
"status": "affected",
"version": "SM7675P"
},
{
"status": "affected",
"version": "SM8635"
},
{
"status": "affected",
"version": "SM8635P"
},
{
"status": "affected",
"version": "SM8650Q"
},
{
"status": "affected",
"version": "SM8735"
},
{
"status": "affected",
"version": "SM8750"
},
{
"status": "affected",
"version": "SM8750P"
},
{
"status": "affected",
"version": "Snapdragon 4 Gen 1 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 429 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 460 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 480 5G Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 480+ 5G Mobile Platform (SM4350-AC)"
},
{
"status": "affected",
"version": "Snapdragon 662 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 680 4G Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 685 4G Mobile Platform (SM6225-AD)"
},
{
"status": "affected",
"version": "Snapdragon 695 5G Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 765 5G Mobile Platform (SM7250-AA)"
},
{
"status": "affected",
"version": "Snapdragon 765G 5G Mobile Platform (SM7250-AB)"
},
{
"status": "affected",
"version": "Snapdragon 768G 5G Mobile Platform (SM7250-AC)"
},
{
"status": "affected",
"version": "Snapdragon 8 Gen 1 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 8 Gen 3 Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 865 5G Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 865+ 5G Mobile Platform (SM8250-AB)"
},
{
"status": "affected",
"version": "Snapdragon 870 5G Mobile Platform (SM8250-AC)"
},
{
"status": "affected",
"version": "Snapdragon 888 5G Mobile Platform"
},
{
"status": "affected",
"version": "Snapdragon 888+ 5G Mobile Platform (SM8350-AC)"
},
{
"status": "affected",
"version": "Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, BB)"
},
{
"status": "affected",
"version": "Snapdragon AR1 Gen 1 Platform"
},
{
"status": "affected",
"version": "Snapdragon AR1 Gen 1 Platform \"Luna1\""
},
{
"status": "affected",
"version": "Snapdragon Auto 5G Modem-RF Gen 2"
},
{
"status": "affected",
"version": "Snapdragon Wear 4100+ Platform"
},
{
"status": "affected",
"version": "Snapdragon X35 5G Modem-RF System"
},
{
"status": "affected",
"version": "Snapdragon X55 5G Modem-RF System"
},
{
"status": "affected",
"version": "Snapdragon X62 5G Modem-RF System"
},
{
"status": "affected",
"version": "Snapdragon X65 5G Modem-RF System"
},
{
"status": "affected",
"version": "Snapdragon X72 5G Modem-RF System"
},
{
"status": "affected",
"version": "Snapdragon X75 5G Modem-RF System"
},
{
"status": "affected",
"version": "Snapdragon XR2 5G Platform"
},
{
"status": "affected",
"version": "SRV1H"
},
{
"status": "affected",
"version": "SRV1L"
},
{
"status": "affected",
"version": "SRV1M"
},
{
"status": "affected",
"version": "SXR2130"
},
{
"status": "affected",
"version": "SXR2330P"
},
{
"status": "affected",
"version": "WCD9340"
},
{
"status": "affected",
"version": "WCD9370"
},
{
"status": "affected",
"version": "WCD9375"
},
{
"status": "affected",
"version": "WCD9378"
},
{
"status": "affected",
"version": "WCD9380"
},
{
"status": "affected",
"version": "WCD9385"
},
{
"status": "affected",
"version": "WCD9390"
},
{
"status": "affected",
"version": "WCD9395"
},
{
"status": "affected",
"version": "WCN3620"
},
{
"status": "affected",
"version": "WCN3660B"
},
{
"status": "affected",
"version": "WCN3680B"
},
{
"status": "affected",
"version": "WCN3950"
},
{
"status": "affected",
"version": "WCN3980"
},
{
"status": "affected",
"version": "WCN3988"
},
{
"status": "affected",
"version": "WCN6450"
},
{
"status": "affected",
"version": "WCN6650"
},
{
"status": "affected",
"version": "WCN6755"
},
{
"status": "affected",
"version": "WCN7750"
},
{
"status": "affected",
"version": "WCN7860"
},
{
"status": "affected",
"version": "WCN7861"
},
{
"status": "affected",
"version": "WCN7880"
},
{
"status": "affected",
"version": "WCN7881"
},
{
"status": "affected",
"version": "WSA8810"
},
{
"status": "affected",
"version": "WSA8815"
},
{
"status": "affected",
"version": "WSA8830"
},
{
"status": "affected",
"version": "WSA8832"
},
{
"status": "affected",
"version": "WSA8835"
},
{
"status": "affected",
"version": "WSA8840"
},
{
"status": "affected",
"version": "WSA8845"
},
{
"status": "affected",
"version": "WSA8845H"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cryptographic issues while generating an asymmetric key pair for RKP use cases."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-07T10:15:35.110Z",
"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
"shortName": "qualcomm"
},
"references": [
{
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"
}
],
"title": "Exposed Dangerous Method or Function in HLOS"
}
},
"cveMetadata": {
"assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
"assignerShortName": "qualcomm",
"cveId": "CVE-2024-43065",
"datePublished": "2025-04-07T10:15:35.110Z",
"dateReserved": "2024-08-05T14:22:16.920Z",
"dateUpdated": "2025-04-07T15:56:17.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47005 (GCVE-0-2024-47005)
Vulnerability from cvelistv5 – Published: 2024-10-25 06:18 – Updated: 2024-10-25 18:38
VLAI
Summary
Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted.
A non-administrative user may execute some configuration APIs.
Severity
8.1 (High)
CWE
- CWE-749 - Exposed dangerous method or function
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Sharp Digital Full-color MFPs and Monochrome MFPs |
Affected:
see the information provided by Sharp Corporation
|
|
| Toshiba Tec Corporation | e-STUDIO 908 |
Affected:
T2.12.h3.00 and earlier versions
|
|
| Toshiba Tec Corporation | e-STUDIO 1058 |
Affected:
T1.01.h4.00 and earlier versions
|
|
| Toshiba Tec Corporation | e-STUDIO 1208 |
Affected:
T1.01.h4.00 and earlier versions
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:toshibatec:e-studio-1058_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-1058_firmware",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "t1.01.h4.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:bp-90c70_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-90c80_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-90c80_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "210",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:bp-50c26_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50c31_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50c36_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50c45_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50c55_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50c65_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-55c26_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-60c31_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-60c36_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-60c45_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70c31_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70c36_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70c45_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70c55_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70c65_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c65_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "320",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-7081_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-8081_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-8081_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "160",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-2651_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3051_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3061_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3061s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3071_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3071s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3551_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3561_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3561s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3571_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3571s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4051_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4061_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4061s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4071_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4071s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-5051_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-5071_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-5071s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-6051_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-6071_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-6071s_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6071s_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "613",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:bp-30c25t_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-30c25y_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-30c25z_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-30c25_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30c25_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "130",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-6580n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-7580n_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-7580n_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "503",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-7090n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-8090n_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-8090n_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "405",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-2630n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3050n_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3050n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3050v_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3050v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3550n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3550v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4050n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4050v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-5050n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-5050v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-6050n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-6050v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3060n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3060v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3070n_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3070n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3070v_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3070v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3560n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3560v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3570n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-3570v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4060n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4060v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4070n_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4070n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4070v_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-4070v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-5070n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-5070v_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-6070n_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-6070n_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-6070v_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-6070v_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6070v_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "802",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:toshibatec:e-studio-1208_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-1208_firmware",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "t1.01.h4.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:bp-c533wd_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-c533wr_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-c535wd_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-c535wr_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-c542wd_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-c545wd_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-c545wd_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "262",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-c303_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-c303w_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-c303wh_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-c304_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-c304w_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-c304wh_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-c304wh_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "520",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:bp-70m75_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70m90_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70m90_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:bp-50m26_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50m31_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50m36_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50m45_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50m50_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-50m55_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70m31_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70m36_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70m45_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70m55_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-70m65_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70m65_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "320",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-m1056_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m1206_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m1206_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "200",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-m6570_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m7570_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m7570_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "456",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-m5051_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m4051_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m2651_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3051_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3071_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3071s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3551_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3571_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3571s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m4071_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m4071s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m5071_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m5071s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m6051_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m6071_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m6071s_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m6071s_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "413",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:bp-30m28_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-30m28t_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-30m31_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-30m31t_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-30m35_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-30m35t_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30m35t_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "220",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-b356w_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b356wh_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b376w_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b376wh_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b456w_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b456wh_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b476w_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b476wh_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b476wh_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "413",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-m905_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m905_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-m3550_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m2630_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m2630_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3050_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3050_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3070_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3070_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m3570_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m4050_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m4070_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m4070_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m5050_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m5070_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m6050_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m6070_a_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-m6070_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m6070_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "503",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:bp-b537wr_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-b540wr_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-b547wd_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:bp-b550wd_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-b550wd_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "260",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:sharp:mx-b355w_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b355wt_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b355wz_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b455w_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b455wt_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:sharp:mx-b455wz_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b455wz_firmware",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "404",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:toshibatec:e-studio-908_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-908_firmware",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "t2.12.h3.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47005",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-25T18:33:28.662590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-25T18:38:02.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Sharp Digital Full-color MFPs and Monochrome MFPs",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "see the information provided by Sharp Corporation"
}
]
},
{
"product": "e-STUDIO 908",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "T2.12.h3.00 and earlier versions"
}
]
},
{
"product": "e-STUDIO 1058",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "T1.01.h4.00 and earlier versions"
}
]
},
{
"product": "e-STUDIO 1208",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "T1.01.h4.00 and earlier versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted.\r\nA non-administrative user may execute some configuration APIs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "Exposed dangerous method or function",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-25T09:02:05.781Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://jvn.jp/en/vu/JVNVU95063136/"
},
{
"url": "https://global.sharp/products/copier/info/info_security_2024-10.html"
},
{
"url": "https://www.toshibatec.com/information/20241025_01.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-47005",
"datePublished": "2024-10-25T06:18:30.415Z",
"dateReserved": "2024-10-16T05:26:37.236Z",
"dateUpdated": "2024-10-25T18:38:02.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Phase: Architecture and Design
Description:
- If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.
Mitigation
Phases: Architecture and Design, Implementation
Strategy: Attack Surface Reduction
Description:
- Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be:
- Ensure that the implemented code follows these expectations. This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) or not marking ActiveX controls safe-for-scripting.
- accessible to all users
- restricted to a small set of privileged users
- prevented from being directly accessible at all
CAPEC-500: WebView Injection
An adversary, through a previously installed malicious application, injects code into the context of a web page displayed by a WebView component. Through the injected code, an adversary is able to manipulate the DOM tree and cookies of the page, expose sensitive information, and can launch attacks against the web application from within the web page.