Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e public and may be used. The associated identifier of this vulnerability is VDB-252271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252271 - https://vuldb.com/?ctiid.252271 - https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setIpPortFilterRules-71c3f0a947e14b7f95fa19b7d6676994?pvs=4
CVE ID: CVE-2024-1003 State: PUBLISHED Published: 2024-01-29T14:31:03.812Z Last Updated: 2025-06-17T21:29:17.310Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Totolink Products: N200RE Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252272. NOTE: The vendor was contacted early abo
the public and may be used. The identifier of this vulnerability is VDB-252272. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252272 - https://vuldb.com/?ctiid.252272 - https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setLanguageCfg-72357294db1e4f8096b29d3f2592d1fc?pvs=4
CVE ID: CVE-2024-1004 State: PUBLISHED Published: 2024-01-29T15:00:07.267Z Last Updated: 2025-06-17T21:29:17.449Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Totolink Products: N200RE Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. This affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252273 was assigned to this vulnerability. NOTE: The vendor was contacted early
lic and may be used. The identifier VDB-252273 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252273 - https://vuldb.com/?ctiid.252273 - https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-loginAuth-cbde48da404049328cb698394b6c0641?pvs=4
CVE ID: CVE-2024-1005 State: PUBLISHED Published: 2024-01-29T15:00:08.394Z Last Updated: 2024-08-29T19:06:37.230Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Shanxi Diankeyun Technology Products: NODERP Problem Types: CWE-552 Description: A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the file /runtime/log. The manipulation leads to files or directories accessible. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252274 is the identifier assigned to this vulnerability. NOTE: The vendor was contact
to the public and may be used. VDB-252274 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252274 - https://vuldb.com/?ctiid.252274 - https://note.zhaoj.in/share/M9ERphWTXUPj
CVE ID: CVE-2024-1006 State: PUBLISHED Published: 2024-01-29T15:31:04.204Z Last Updated: 2025-05-29T15:09:16.325Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Shanxi Diankeyun Technology Products: NODERP Problem Types: CWE-287 Description: A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument Nod_User_Id/Nod_User_Token leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of
k may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252275. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252275 - https://vuldb.com/?ctiid.252275 - https://note.zhaoj.in/share/vWuVlU2eg79t
CVE ID: CVE-2024-1007 State: PUBLISHED Published: 2024-01-29T16:00:05.978Z Last Updated: 2024-08-23T19:00:15.775Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown function of the file edit_profile.php. The manipulation of the argument txtfullname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252276. Additional Analyst Notes: - CVE Pro
d to the public and may be used. The identifier of this vulnerability is VDB-252276. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252276 - https://vuldb.com/?ctiid.252276 - https://www.youtube.com/watch?v=1yesMwvWcL4
CVE ID: CVE-2024-1008 State: PUBLISHED Published: 2024-01-29T16:00:07.104Z Last Updated: 2024-10-18T14:14:59.255Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Management System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Profile Page. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252277 was assigned to this vulnerability. Ad
ploit has been disclosed to the public and may be used. The identifier VDB-252277 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252277 - https://vuldb.com/?ctiid.252277 - https://www.youtube.com/watch?v=z4gcLZCOcnc
CVE ID: CVE-2024-1009 State: PUBLISHED Published: 2024-01-29T16:31:04.245Z Last Updated: 2025-06-05T20:24:51.240Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Admin/login.php. The manipulation of the argument txtusername leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252278 is the identifier assigned to this vulnerability. Additional Analyst
isclosed to the public and may be used. VDB-252278 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252278 - https://vuldb.com/?ctiid.252278 - https://youtu.be/oL98TSjy89Q?si=_T6YkJZlbn7SJ4Gn
CVE ID: CVE-2024-1010 State: PUBLISHED Published: 2024-01-29T16:31:05.461Z Last Updated: 2025-05-29T15:08:46.978Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Employee Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file edit-profile.php. The manipulation of the argument fullname/phone/date of birth/address/date of appointment leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-252279. Additional Analyst Notes: - CVE Program Co
tack remotely. The associated identifier of this vulnerability is VDB-252279. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252279 - https://vuldb.com/?ctiid.252279 - https://github.com/jomskiller/Employee-Management-System---Stored-XSS/ - https://github.com/jomskiller/Employee-Management-System---Stored-XSS
CVE ID: CVE-2024-1011 State: PUBLISHED Published: 2024-01-29T17:00:06.067Z Last Updated: 2025-06-02T18:41:59.618Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Employee Management System Problem Types: CWE-284 Description: A vulnerability classified as problematic was found in SourceCodester Employee Management System 1.0. This vulnerability affects unknown code of the file delete-leave.php of the component Leave Handler. The manipulation of the argument id leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VD
iated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252280. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252280 - https://vuldb.com/?ctiid.252280 - https://github.com/jomskiller/Employee-Managemet-System---Broken-Access-Control
CVE ID: CVE-2024-1012 State: PUBLISHED Published: 2024-01-31T07:10:51.041Z Last Updated: 2025-06-13T19:00:31.718Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Wanhu Products: ezOFFICE Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Wanhu ezOFFICE 11.1.0. This issue affects some unknown processing of the file defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp. The manipulation of the argument recordId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252281 was assigned to this vulnerability. Additional Analyst Notes: - CV
the public and may be used. The identifier VDB-252281 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252281 - https://vuldb.com/?ctiid.252281 - https://github.com/4nNns/cveAdd/blob/b73e94ff089ae2201d9836b4d61b8175ff21618a/sqli/%E4%B8%87%E6%88%B7EZOFFICE%20%E5%89%8D%E5%8F%B0SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
CVE ID: CVE-2024-1013 State: PUBLISHED Published: 2024-03-18T10:53:02.506Z Last Updated: 2025-11-20T18:11:15.710Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-823 Description: An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://a
tures can be broken. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-1013 - https://bugzilla.redhat.com/show_bug.cgi?id=2260823 - https://github.com/lurcher/unixODBC/pull/157
CVE ID: CVE-2024-1014 State: PUBLISHED Published: 2024-01-29T13:44:49.968Z Last Updated: 2024-11-12T21:45:03.574Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SE-elektronic GmbH Products: E-DDC3.3 Problem Types: CWE-400 Description: Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products - http
es: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products - https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html
CVE ID: CVE-2024-1015 State: PUBLISHED Published: 2024-01-29T13:46:32.256Z Last Updated: 2025-06-02T19:00:37.610Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SE-elektronic GmbH Products: E-DDC3.3 Problem Types: CWE-94 Description: Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektroni
Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products - https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html
CVE ID: CVE-2024-1016 State: PUBLISHED Published: 2024-01-29T17:31:04.845Z Last Updated: 2025-06-17T21:29:17.571Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Solar Products: FTP Server Problem Types: CWE-404 Description: A vulnerability was found in Solar FTP Server 2.1.1/2.1.2. It has been declared as problematic. This vulnerability affects unknown code of the component PASV Command Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-252286 is the identifier assigned to this vulnerability. Additi
t is recommended to apply a patch to fix this issue. VDB-252286 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252286 - https://vuldb.com/?ctiid.252286 - https://packetstormsecurity.com/files/176675/Solar-FTP-Server-2.1.2-Denial-Of-Service.html
CVE ID: CVE-2024-1017 State: PUBLISHED Published: 2024-01-29T18:31:04.658Z Last Updated: 2024-08-23T18:59:51.176Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Gabriels Products: FTP Server Problem Types: CWE-404 Description: A vulnerability was found in Gabriels FTP Server 1.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation of the argument USERNAME leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-252287. Additional Analyst
d to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-252287. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252287 - https://vuldb.com/?ctiid.252287 - https://packetstormsecurity.com/files/176714/Gabriels-FTP-Server-1.2-Denial-Of-Service.html - https://www.youtube.com/watch?v=wwHuXfYS8yQ
CVE ID: CVE-2024-1018 State: PUBLISHED Published: 2024-01-29T20:00:08.200Z Last Updated: 2024-11-12T21:31:04.955Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: PbootCMS Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in PbootCMS 3.2.5-20230421. Affected is an unknown function of the file /admin.php?p=/Area/index#tab=t2. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252288. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
tifier of this vulnerability is VDB-252288. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252288 - https://vuldb.com/?ctiid.252288 - https://github.com/1MurasaKi/PboostCMS_XSS/blob/main/README.md
CVE ID: CVE-2024-1019 State: PUBLISHED Published: 2024-01-30T16:09:42.428Z Last Updated: 2025-06-17T21:29:18.248Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: OWASP ModSecurity Products: ModSecurity Problem Types: CWE-20 Description: ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in th
lts in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://owasp.org/www-project-modsecurity/tab_cves#cve-2024-1019-2024-01-30 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/34KDQNZE2RS3CWFG5654LNHKXXDPIW5I/ -
sts.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/34KDQNZE2RS3CWFG5654LNHKXXDPIW5I/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K6ZGABPJK2JPVH2JDFHZ5LQLWGONUH7V/
CVE ID: CVE-2024-1020 State: PUBLISHED Published: 2024-01-29T21:31:04.591Z Last Updated: 2024-10-18T14:11:55.989Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Rebuild Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Rebuild up to 3.5.5. Affected by this vulnerability is the function getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252289 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
fier VDB-252289 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252289 - https://vuldb.com/?ctiid.252289 - https://www.yuque.com/mailemonyeyongjuan/tha8tr/gdd3hiwz8uo6ylab
CVE ID: CVE-2024-1021 State: PUBLISHED Published: 2024-01-29T22:00:08.338Z Last Updated: 2025-06-06T20:16:06.549Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Rebuild Problem Types: CWE-918 Description: A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252290 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: -
used. VDB-252290 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252290 - https://vuldb.com/?ctiid.252290 - https://www.yuque.com/mailemonyeyongjuan/tha8tr/yemvnt5uo53gfem5
CVE ID: CVE-2024-1022 State: PUBLISHED Published: 2024-01-29T23:00:09.074Z Last Updated: 2025-05-29T15:08:20.692Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: CodeAstro Products: Simple Student Result Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in CodeAstro Simple Student Result Management System 5.6. This affects an unknown part of the file /add_classes.php of the component Add Class Page. The manipulation of the argument Class Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of thi
iate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252291. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252291 - https://vuldb.com/?ctiid.252291 - https://drive.google.com/file/d/1lPZ1yL9UlU-uB03xz17q4OR9338X_1am/view?usp=sharing
CVE ID: CVE-2024-1023 State: PUBLISHED Published: 2024-03-27T07:51:15.716Z Last Updated: 2025-11-07T10:49:20.769Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: CEQ 3.2, Cryostat 2 on RHEL 8, MTA-6.2-RHEL-9, Red Hat AMQ Streams 2.7.0, Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2, Red Hat build of Quarkus 3.2.11.Final, RHINT Service Registry 2.5.11 GA, A-MQ Clients 2, Migration Toolkit for Runtimes, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat build of Apache Camel for Spring Boot 3, Red Hat Build of Keycloak, Red Hat build of OptaPlanner 8, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Integration
loak, Red Hat build of OptaPlanner 8, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Integration Camel K 1, Red Hat Integration Camel Quarkus 2, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Process Automation 7 Problem Types: CWE-401 Description: A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate
lient establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1662 - https://access.redhat.com/errata/RHSA-2024:1706 - https://access.redhat.com/errata/RHSA-2024:2088 - https://access.redhat.com/errata/RHSA-2024:2833 - https://access.redhat.com/errata/RHSA-2024:3527 - htt