Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7045 State: PUBLISHED Published: 2025-03-20T10:10:18.155Z Last Updated: 2025-10-15T12:50:37.205Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-862 Description: In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt information created by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{com
ated by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{command_id} interface to obtain arbitrary prompt information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/03ea0826-af7b-4717-b63e-90fd19675ab2
CVE ID: CVE-2024-7046 State: PUBLISHED Published: 2025-03-20T10:09:38.263Z Last Updated: 2025-10-15T12:50:37.654Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-862 Description: An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/684185e4-6766-4638
details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/684185e4-6766-4638-b08a-0de9c2820aee
CVE ID: CVE-2024-7047 State: PUBLISHED Published: 2024-07-25T00:30:40.657Z Last Updated: 2024-08-29T15:05:00.689Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/455318
CVE ID: CVE-2024-7048 State: PUBLISHED Published: 2024-10-10T01:22:16.902Z Last Updated: 2025-10-15T12:49:49.363Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-863 Description: In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files, compromising the integrity an
ty, an attacker can view metadata of files uploaded by an admin and overwrite these files, compromising the integrity and availability of the RAG models. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/acd0b2dd-61eb-4712-82d3-a4e35d6ee560
CVE ID: CVE-2024-7049 State: PUBLISHED Published: 2024-10-10T07:15:55.293Z Last Updated: 2024-10-10T14:45:15.962Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-488 Description: In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ee9e3532-8ef1-4599-bb59-b8e2ba43a1fc
CVE ID: CVE-2024-7050 State: PUBLISHED Published: 2024-07-26T15:14:57.182Z Last Updated: 2024-08-01T21:45:38.396Z Vendors: OpenText Products: OpenText Directory Services Problem Types: CWE-287 Description: Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular scenarios.This issue affects OpenText Directory Services: 24.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0821213
CVE ID: CVE-2024-7051 State: REJECTED Published: N/A Last Updated: 2024-08-30T15:30:59.919Z Description: No description available.
CVE ID: CVE-2024-7052 State: PUBLISHED Published: 2025-02-14T06:00:09.548Z Last Updated: 2025-02-14T16:33:41.555Z Vendors: Unknown Products: Forminator Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4e52cab5-821c-4ca8-9024-67f716cf78fe/
CVE ID: CVE-2024-7053 State: PUBLISHED Published: 2025-03-20T10:11:16.240Z Last Updated: 2025-03-20T13:16:31.805Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-79 Description: A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default `SameSite=Lax` and does not have the `Secure` flag enabled, allowing the session cookie to be sent over HTTP to a cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed
cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This can lead to a stealthy administrator account takeover, potentially resulting in remote code execution (RCE) due to the elevated privileges of administrator accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/947f8191-0abf-4adf-b7c4-d4c19683aba2
CVE ID: CVE-2024-7054 State: PUBLISHED Published: 2024-08-20T10:58:30.167Z Last Updated: 2024-08-20T13:31:48.810Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: danieliser Products: Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder Problem Types: CWE-79 Description: The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘close_text’ parameter in all versions up to, and including, 1.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers
g, 1.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73524687-7703-4912-aad5-2a31122ba9b2?source=cve - https://plugins.trac.wordpress.org/changeset/3137126/
CVE ID: CVE-2024-7055 State: PUBLISHED Published: 2024-08-06T06:00:10.659Z Last Updated: 2025-11-03T22:32:48.492Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: FFmpeg Problem Types: CWE-122 Description: A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of
n 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.273651 - https://vuldb.com/?ctiid.273651 - https://vuldb.com/?submit.376532 - https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3 - https://ffmpeg.org/download.html - https://ffmpeg.org/
CVE ID: CVE-2024-7056 State: PUBLISHED Published: 2024-11-25T06:00:14.863Z Last Updated: 2025-11-13T21:16:05.330Z Vendors: Unknown Products: WPForms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/467af13e-25bd-425c-929d-5dd06e28d595/
CVE ID: CVE-2024-7057 State: PUBLISHED Published: 2024-07-25T00:30:55.513Z Last Updated: 2024-08-29T15:05:00.782Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-284 Description: An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where job artifacts can be inappropriately exposed to users lacking the proper authorization level. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458501 - https://h
DP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458501 - https://hackerone.com/reports/2475135
CVE ID: CVE-2024-7058 State: PUBLISHED Published: 2025-03-20T10:09:45.594Z Last Updated: 2025-03-20T18:35:07.195Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-23 Description: A vulnerability in the sanitize_path function in parisneo/lollms-webui v10 - latest allows an attacker to bypass path sanitization by using relative paths such as './'. This can lead to unauthorized access to directories within the personality_folder on the victim's computer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/148fce03-0f5a-4939-b636-b7f9848765e4
CVE ID: CVE-2024-7059 State: PUBLISHED Published: 2024-11-05T13:13:29.839Z Last Updated: 2024-11-09T22:45:41.270Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Genetec Inc. Products: Genetec Security Center Problem Types: CWE-470 Description: A high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec Security Center product line. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://resources.genetec.com/security-advisories/high-severity-vulnerability-affecting-security-center-web-sdk-role - https://ressources.genetec.com/bulletins-de-securite/vulnerabilite-de-haute
ity-affecting-security-center-web-sdk-role - https://ressources.genetec.com/bulletins-de-securite/vulnerabilite-de-haute-severite-affectant-le-role-sdk-web-de-security-center
CVE ID: CVE-2024-7060 State: PUBLISHED Published: 2024-07-24T22:07:50.018Z Last Updated: 2024-09-17T16:58:29.528Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-200 Description: An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/437894
CVE ID: CVE-2024-7061 State: PUBLISHED Published: 2024-08-07T16:35:44.403Z Last Updated: 2024-08-09T13:44:51.144Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Okta Products: Okta Verify for Windows Problem Types: CWE-22, CWE-427 Description: Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.okta.com/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061/ - https://help.okta.com/oie/en-us/con
om/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061/ - https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4
CVE ID: CVE-2024-7062 State: PUBLISHED Published: 2024-07-26T11:26:31.720Z Last Updated: 2024-08-01T21:52:30.436Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Nimble Commander Products: Nimble Commander Problem Types: CWE-863 Description: Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insufficient validation of a client’s authorization before executing an operation. Consequently, it is possible to execute system-level commands as the root user, such as changing permissions and ownership, obtaining a handle (file descriptor) of an arbitrary file, and term
ot user, such as changing permissions and ownership, obtaining a handle (file descriptor) of an arbitrary file, and terminating processes, among other operations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pentraze.com/vulnerability-reports/CVE-2024-7062/
CVE ID: CVE-2024-7063 State: PUBLISHED Published: 2024-08-15T05:30:56.039Z Last Updated: 2024-08-15T13:55:28.107Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wpmet Products: ElementsKit Pro Problem Types: CWE-200 Description: The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the 'render_raw' function. This can allow authenticated attackers, with Contributor-level permissions and above, to extract sensitive data including private, future, and draft posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilit
ts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d35dd18b-0f05-482f-aef3-08977cbec8a0?source=cve - https://wpmet.com/plugin/elementskit/
CVE ID: CVE-2024-7064 State: PUBLISHED Published: 2024-08-15T05:30:55.369Z Last Updated: 2024-08-15T14:06:34.917Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmet Products: ElementsKit Pro Problem Types: CWE-79 Description: The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - C
rbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/181e6f3a-dbcf-44a6-b725-6325d9e56453?source=cve - https://wpmet.com/plugin/elementskit/
CVE ID: CVE-2024-7065 State: PUBLISHED Published: 2024-07-24T09:31:03.848Z Last Updated: 2024-08-01T21:52:30.804Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Spina Products: CMS Problem Types: CWE-352 Description: A vulnerability was found in Spina CMS up to 2.18.0. It has been classified as problematic. Affected is an unknown function of the file /admin/pages/. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272346 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additi
to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272346 - https://vuldb.com/?ctiid.272346 - https://vuldb.com/?submit.375236 - https://github.com/topsky979/Security-Collections/blob/main/1700810/README.md
CVE ID: CVE-2024-7066 State: PUBLISHED Published: 2024-07-24T11:00:09.075Z Last Updated: 2024-08-01T21:52:31.414Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: F-logic Products: DataCube3 Problem Types: CWE-78 Description: A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/config_time_sync.php of the component HTTP POST Request Handler. The manipulation of the argument ntp_server leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-2723
he exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272347. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272347 - https://vuldb.com/?ctiid.272347 - https://vuldb.com/?submit.378322 - https://wiki.shikangsi.com/post/share/17dfab05-2c50-4437-afa7-ef1f5a1f43f8
CVE ID: CVE-2024-7067 State: PUBLISHED Published: 2024-07-24T14:00:06.814Z Last Updated: 2024-08-01T21:52:30.551Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: kirilkirkov Products: Ecommerce-Laravel-Bootstrap Problem Types: CWE-502 Description: A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87. It has been rated as critical. Affected by this issue is the function getCartProductsIds of the file app/Cart.php. The manipulation of the argument laraCart leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release
aunched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is a02111a674ab49f65018b31da3011b1e396f59b1. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-272348. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272348 - https://vuldb.com/?ctiid.272348 - https://vuldb.com/?submit.378780 - https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18 - https://github.com/kirilkirkov/Ecom
bmit.378780 - https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18 - https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18#issuecomment-2206863135 - https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18#issuecomment-2192470359 - https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/commit/a02111a674ab49f65018b31da3011b1e396f59b1
CVE ID: CVE-2024-7068 State: PUBLISHED Published: 2024-07-24T15:00:08.622Z Last Updated: 2024-08-01T21:52:30.633Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Insurance Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Insurance Management System 1.0. This affects an unknown part of the file /Script/admin/core/update_sub_category. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272349 was assigned to this vulnerability. Additiona
as been disclosed to the public and may be used. The identifier VDB-272349 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272349 - https://vuldb.com/?ctiid.272349 - https://vuldb.com/?submit.378874 - https://github.com/rtsjx-cve/cve/blob/main/xss2.md
CVE ID: CVE-2024-7069 State: PUBLISHED Published: 2024-07-24T15:31:04.268Z Last Updated: 2024-08-01T21:52:30.673Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee and Visitor Gate Pass Logging System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. This issue affects some unknown processing of the file /employee_gatepass/classes/Master.php?f=delete_department. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associ
njection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272351. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272351 - https://vuldb.com/?ctiid.272351 - https://vuldb.com/?submit.378881 - https://github.com/pineapple65/cve/blob/main/sql.md
CVE ID: CVE-2024-7071 State: PUBLISHED Published: 2024-08-27T13:57:55.604Z Last Updated: 2024-08-27T18:15:08.369Z Vendors: Brain Information Technologies Inc. Products: Brain Low-Code Problem Types: CWE-89, CWE - 564 - SQL Injection: Hibernate Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in Brain Information Technologies Inc. Brain Low-Code allows SQL Injection.This issue affects Brain Low-Code: before 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1349
CVE ID: CVE-2024-7073 State: PUBLISHED Published: 2025-06-02T16:38:33.113Z Last Updated: 2025-06-02T17:06:05.767Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: WSO2 Products: WSO2 Identity Server as Key Manager, WSO2 Identity Server, WSO2 Open Banking KM, WSO2 Open Banking IAM, WSO2 Carbon Policy Editor BE Problem Types: CWE-918 Description: A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem. Expl
rver-side requests, enabling access to internal and external resources available through the network or filesystem. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3562