Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-36377 State: PUBLISHED Published: 2024-05-29T13:29:06.268Z Last Updated: 2024-08-02T03:37:05.169Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-863 Description: In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-36378 State: PUBLISHED Published: 2024-05-29T13:29:06.790Z Last Updated: 2024-08-02T03:37:05.048Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: JetBrains Products: TeamCity Problem Types: CWE-770 Description: In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-36383 State: PUBLISHED Published: 2024-05-27T10:58:03.833Z Last Updated: 2025-02-13T15:59:19.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Logpoint SAML Authentication before 6.0.3. An attacker can place a crafted filename in the state field of a SAML SSO-URL response, and the file corresponding to this filename will ultimately be deleted. This can lead to a SAML Authentication login outage. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://servicedesk.logpoint.com/hc/en-us/articles/19128172110621-Arbitrary-file-deletion-through-URL-Injection-to-SAML-SSO-URL-Response
CVE ID: CVE-2024-36384 State: PUBLISHED Published: 2024-05-27T04:07:37.867Z Last Updated: 2025-02-13T15:59:19.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.cryptshare.com/w/CSSCurrent_en:Version_7.0.0#Additional_Changes
CVE ID: CVE-2024-36387 State: PUBLISHED Published: 2024-07-01T18:10:25.512Z Last Updated: 2025-02-13T17:52:53.571Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-476 Description: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20240712-0001/
CVE ID: CVE-2024-36388 State: PUBLISHED Published: 2024-06-02T13:14:46.927Z Last Updated: 2024-08-02T03:37:04.924Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: MileSight Products: DeviceHub Problem Types: CWE-305 Description: MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36389 State: PUBLISHED Published: 2024-06-02T13:21:11.748Z Last Updated: 2024-08-02T03:37:04.960Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MileSight Products: DeviceHub Problem Types: CWE-330 Description: MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36390 State: PUBLISHED Published: 2024-06-02T13:22:24.377Z Last Updated: 2024-08-02T03:37:05.270Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MileSight Products: DeviceHub Problem Types: CWE-20 Description: MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36391 State: PUBLISHED Published: 2024-06-02T13:23:28.345Z Last Updated: 2024-08-02T03:37:04.857Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: MileSight Products: DeviceHub Problem Types: CWE-320 Description: MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36392 State: PUBLISHED Published: 2024-06-02T13:24:33.806Z Last Updated: 2024-08-02T03:37:05.325Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: MileSight Products: DeviceHub Problem Types: CWE-79 Description: MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36393 State: PUBLISHED Published: 2024-06-06T08:18:52.667Z Last Updated: 2024-08-02T03:37:04.931Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Sysaid Products: SysAid Problem Types: CWE-89 Description: SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36394 State: PUBLISHED Published: 2024-06-06T08:20:04.781Z Last Updated: 2024-08-02T03:37:05.138Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Sysaid Products: SysAid Problem Types: CWE-78 Description: SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36395 State: PUBLISHED Published: 2024-06-13T12:32:22.905Z Last Updated: 2024-08-02T03:37:05.221Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Verint Products: WFO Problem Types: CWE-80 Description: Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36396 State: PUBLISHED Published: 2024-06-13T12:33:41.805Z Last Updated: 2024-08-02T03:37:05.180Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Verint Products: WFO Problem Types: CWE-434 Description: Verint - CWE-434: Unrestricted Upload of File with Dangerous Type Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36397 State: PUBLISHED Published: 2024-06-16T08:06:13.314Z Last Updated: 2024-08-02T03:37:05.153Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Vantiva Products: MediaAccess DGA2232 Problem Types: CWE-79 Description: Vantiva - MediaAccess DGA2232 v19.4 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-36398 State: PUBLISHED Published: 2024-08-13T07:54:08.979Z Last Updated: 2024-08-13T13:26:17.671Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SINEC NMS Problem Types: CWE-250 Description: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application executes a subset of its services as `NT AUTHORITY\SYSTEM`. This could allow a local attacker to execute operating system commands with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-784301.html
CVE ID: CVE-2024-36399 State: PUBLISHED Published: 2024-06-06T15:15:46.978Z Last Updated: 2024-08-02T03:37:05.195Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-284, CWE-285, CWE-639 Description: Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked
is project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-x8v7-3ghx-65cv - https://github.com/kanboard/kanboard/commit/b6703688aac8187f5ea4d4d704fc7afeeffeafa7
CVE ID: CVE-2024-36400 State: PUBLISHED Published: 2024-06-04T14:11:26.945Z Last Updated: 2024-08-02T03:37:05.234Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: viz-rs Products: nano-id Problem Types: CWE-331 Description: nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen`
ase58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that `nano_id::base64` is not affected by this vulnerability. This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. The vulnerability is fixed in 0.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/viz-rs/nano-id/security/ad
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/viz-rs/nano-id/security/advisories/GHSA-9hc7-6w9r-wj94 - https://github.com/viz-rs/nano-id/commit/a9022772b2f1ce38929b5b81eccc670ac9d3ab23
CVE ID: CVE-2024-36401 State: PUBLISHED Published: 2024-07-01T15:25:41.873Z Last Updated: 2025-10-21T22:56:21.450Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: geoserver Products: geoserver Problem Types: CWE-95 Description: GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/a
afely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WM
ty has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
eoServer from deploying if the gt-complex module is needed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv - https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w - https://github.com/geotools/geotools/pull/4797 - https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852 - https://osgeo-org.atlassian.net/browse/GEOT-7587
CVE ID: CVE-2024-36402 State: PUBLISHED Published: 2025-01-16T19:19:19.373Z Last Updated: 2025-02-12T20:31:21.273Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: t2bot Products: matrix-media-repo Problem Types: CWE-287 Description: Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remot
vailable for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg -
ISA ADP Vulnrichment: References: - https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg - https://github.com/matrix-org/matrix-spec-proposals/pull/3916
CVE ID: CVE-2024-36403 State: PUBLISHED Published: 2025-01-16T19:16:07.419Z Last Updated: 2025-02-12T20:31:21.408Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: t2bot Products: matrix-media-repo Problem Types: CWE-770 Description: Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 is vulnerable to unbounded disk consumption, where an unauthenticated adversary can induce it to download and cache large amounts of remote media files. MMR's typical operating environment uses S3-like storage as a backend, with file-backed store as an alternative option. Instances using a file-backed store or t
S3-like storage as a backend, with file-backed store as an alternative option. Instances using a file-backed store or those which self-host an S3 storage system are therefore vulnerable to a disk fill attack. Once the disk is full, authenticated users will be unable to upload new media, resulting in denial of service. For instances configured to use a cloud-based S3 storage option, this could result in high service fees instead of a denial of service. MMR 1.3.5 introduces a new default-on "leaky bucket" rate limit to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data
This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data. Operators should note that the leaky bucket implementation introduced in MMR 1.3.5 requires the IP address associated with the request to be forwarded, to avoid mistakenly applying the rate limit to the reverse proxy instead. To avoid this issue, the reverse proxy should populate the X-Forwarded-For header when sending the request to MMR. Operators who cannot update may wish to lower the maximum file size they allow and implement harsh rate limits, though this can still lead to a large amount of data to be downloaded. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
h this can still lead to a large amount of data to be downloaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-vc2m-hw89-qjxf - https://en.wikipedia.org/wiki/Leaky_bucket#As_a_meter
CVE ID: CVE-2024-36404 State: PUBLISHED Published: 2024-07-02T13:39:35.716Z Last Updated: 2024-08-02T03:37:05.024Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: geotools Products: geotools Problem Types: CWE-95 Description: GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's
his issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/geotool
ns. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w - https://github.com/geotools/geotools/pull/4797 - https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea - https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852 - https://osgeo-org.atlassian.net/browse/GEOT-7587 - https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download - https://sourceforg
eforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4 - https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2
ols%2028%20Releases/28.2/geotools-28.2-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download - https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1
CVE ID: CVE-2024-36405 State: PUBLISHED Published: 2024-06-10T12:47:17.934Z Last Updated: 2024-08-02T03:37:05.189Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: open-quantum-safe Products: liboqs Problem Types: CWE-208, CWE-385 Description: liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for `-Os`, `-O1`, and other compilation options. A proof-of-concept local attack on the reference implementation leaks the entire ML-KEM 512 secret ke
mpilation options. A proof-of-concept local attack on the reference implementation leaks the entire ML-KEM 512 secret key in ~10 minutes using end-to-end decapsulation timing measurements. The issue has been fixed in version 0.10.1. As a possible workaround, some compiler options may produce vectorized code that does not leak secret information, however relying on these compiler options as a workaround may not be reliable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-f2v9-5498-2vpp - https://github.com/open-quantum-safe/liboqs/commit/982c762c242ef549c914891b47bf6e0ed6321f91 - htt
/GHSA-f2v9-5498-2vpp - https://github.com/open-quantum-safe/liboqs/commit/982c762c242ef549c914891b47bf6e0ed6321f91 - https://github.com/pq-crystals/kyber/commit/9b8d30698a3e7449aeb34e62339d4176f11e3c6c - https://github.com/open-quantum-safe/liboqs/blob/7eecda6095c003ddded7175a1ffdf35a2ce63ed5/src/kem/kyber/pqcrystals-kyber_kyber512_ref/poly.c#L166
CVE ID: CVE-2024-36406 State: PUBLISHED Published: 2024-06-10T15:06:22.355Z Last Updated: 2024-08-02T03:37:05.251Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-601 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open re-direct. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-hcw8-p37h-8hrv
CVE ID: CVE-2024-36407 State: PUBLISHED Published: 2024-06-10T16:38:17.390Z Last Updated: 2024-08-02T03:37:05.160Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-640 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is also dependent on some password reset functionalities being enabled. It also requires the system using php 7, which is not an officially sup