Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23608 State: PUBLISHED Published: 2024-03-11T15:10:16.963Z Last Updated: 2024-08-22T19:05:18.989Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-787 Description: An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-
nt: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html
CVE ID: CVE-2024-23609 State: PUBLISHED Published: 2024-03-11T15:17:59.351Z Last Updated: 2025-04-16T15:48:24.638Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-1285 Description: An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-han
ces: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html
CVE ID: CVE-2024-23610 State: PUBLISHED Published: 2024-03-11T15:12:33.108Z Last Updated: 2024-08-08T15:09:09.675Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-787 Description: An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-
CVE ID: CVE-2024-23611 State: PUBLISHED Published: 2024-03-11T15:14:22.944Z Last Updated: 2024-08-28T19:57:08.855Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-787 Description: An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-
CVE ID: CVE-2024-23612 State: PUBLISHED Published: 2024-03-11T15:19:34.788Z Last Updated: 2024-10-10T20:30:00.781Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-1285 Description: An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-han
CVE ID: CVE-2024-23613 State: PUBLISHED Published: 2024-01-25T23:32:17.046Z Last Updated: 2025-05-29T15:18:44.816Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Symantec Products: Deployment Solution Problem Types: CWE-119 Description: A buffer overflow vulnerability exists in Symantec Deployment Solution version 7.9 when parsing UpdateComputer tokens. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/symantec-deployment-solution-axengine-exe-buffer-overflow-remote-code-exec
es: - https://blog.exodusintel.com/2024/01/25/symantec-deployment-solution-axengine-exe-buffer-overflow-remote-code-execution
CVE ID: CVE-2024-23614 State: PUBLISHED Published: 2024-01-25T23:32:21.154Z Last Updated: 2024-09-05T18:28:07.954Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Symantec Products: Messaging Gateway Problem Types: CWE-119 Description: A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/symantec-messaging-gateway-stack-buffer-overflow-remote-code-execution/
CVE ID: CVE-2024-23615 State: PUBLISHED Published: 2024-01-25T23:32:23.512Z Last Updated: 2025-05-29T15:18:38.298Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Symantec Products: Messaging Gateway Problem Types: CWE-119 Description: A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/symantec-messaging-gateway-libdec2lha-so-stack-buffer-overflow-remote-code-execution/
CVE ID: CVE-2024-23616 State: PUBLISHED Published: 2024-01-25T23:32:25.827Z Last Updated: 2024-08-23T19:17:09.619Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Symantec Products: Server Management Suite Problem Types: CWE-119 Description: A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/symantec-server-management-suite-axengine-exe-buffer-overflow-remote-code-execution/
CVE ID: CVE-2024-23617 State: PUBLISHED Published: 2024-01-25T23:32:28.763Z Last Updated: 2024-10-18T15:22:15.396Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Symantec Products: Data Loss Prevention Problem Types: CWE-119 Description: A buffer overflow vulnerability exists in Symantec Data Loss Prevention version 14.0.2 and before. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a crafted document to achieve code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/symantec-data-loss-prevention-wp6sr-dll-stack-buffer-over
ichment: References: - https://blog.exodusintel.com/2024/01/25/symantec-data-loss-prevention-wp6sr-dll-stack-buffer-overflow-remote-code-execution/
CVE ID: CVE-2024-23618 State: PUBLISHED Published: 2024-01-25T23:35:54.558Z Last Updated: 2025-06-17T21:19:30.651Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Arris Products: SURFboard SBG6950AC2 Problem Types: CWE-306 Description: An arbitrary code execution vulnerability exists in Arris SURFboard SGB6950AC2 devices. An unauthenticated attacker can exploit this vulnerability to achieve code execution as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/arris-surfboard-sbg6950ac2-arbitrary-command-execution-vulnerability/
CVE ID: CVE-2024-23619 State: PUBLISHED Published: 2024-01-25T23:35:56.192Z Last Updated: 2025-06-16T19:31:21.425Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: IBM Merge Healthcare Products: eFilm Workstation Problem Types: CWE-798 Description: A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to achieve information disclosure or remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-information-disclosure/
CVE ID: CVE-2024-23620 State: PUBLISHED Published: 2024-01-25T23:35:58.433Z Last Updated: 2024-11-13T15:04:16.032Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Merge Healthcare Products: eFilm Workstation Problem Types: CWE-269 Description: An improper privilege management vulnerability exists in IBM Merge Healthcare eFilm Workstation. A local, authenticated attacker can exploit this vulnerability to escalate privileges to SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-system-privilege-escalation/
CVE ID: CVE-2024-23621 State: PUBLISHED Published: 2024-01-25T23:36:01.148Z Last Updated: 2025-06-03T18:17:08.975Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Merge Healthcare Products: eFilm Workstation Problem Types: CWE-131 Description: A buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerability to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-license-server-buffer-overflow/
CVE ID: CVE-2024-23622 State: PUBLISHED Published: 2024-01-25T23:36:03.728Z Last Updated: 2025-06-17T21:19:30.781Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Merge Healthcare Products: eFilm Workstation Problem Types: CWE-131 Description: A stack-based buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerability to achieve remote code execution with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-license-server-copysls_request
erences: - https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-license-server-copysls_request3-buffer-overflow/
CVE ID: CVE-2024-23624 State: PUBLISHED Published: 2024-01-25T23:41:18.424Z Last Updated: 2025-06-17T21:19:30.921Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: D-Link Products: DAP-1650 Problem Types: CWE-77 Description: A command injection vulnerability exists in the gena.cgi module of D-Link DAP-1650 devices. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/d-link-dap-1650-gena-cgi-subscribe-command-injection-vulnerability/
CVE ID: CVE-2024-23625 State: PUBLISHED Published: 2024-01-25T23:41:20.687Z Last Updated: 2025-05-29T15:18:31.325Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: D-Link Products: DAP-1650 Problem Types: CWE-77 Description: A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/d-link-dap-1650-subscribe-callback-command-injection-vulnerability/
CVE ID: CVE-2024-23626 State: PUBLISHED Published: 2024-01-25T23:41:22.774Z Last Updated: 2024-08-29T18:50:32.388Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Motorola Products: MR2600 Problem Types: CWE-77 Description: A command injection vulnerability exists in the ‘SaveSysLogParams’ parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/motorola-mr2600-savesyslogparams-command-injection-vulnerability/
CVE ID: CVE-2024-23627 State: PUBLISHED Published: 2024-01-25T23:41:25.037Z Last Updated: 2025-05-29T15:18:25.186Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Motorola Products: MR2600 Problem Types: CWE-77 Description: A command injection vulnerability exists in the 'SaveStaticRouteIPv4Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/motorola-mr2600-savestaticrouteipv4params-command-injection-vulnerabil
rences: - https://blog.exodusintel.com/2024/01/25/motorola-mr2600-savestaticrouteipv4params-command-injection-vulnerability/
CVE ID: CVE-2024-23628 State: PUBLISHED Published: 2024-01-25T23:41:27.462Z Last Updated: 2024-08-23T19:14:40.486Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Motorola Products: MR2600 Problem Types: CWE-77 Description: A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/motorola-mr2600-savestaticrouteipv6params-command-injection-vulnerabil
rences: - https://blog.exodusintel.com/2024/01/25/motorola-mr2600-savestaticrouteipv6params-command-injection-vulnerability/
CVE ID: CVE-2024-23629 State: PUBLISHED Published: 2024-01-25T23:41:29.663Z Last Updated: 2024-10-18T15:20:28.277Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Motorola Products: MR2600 Problem Types: CWE-287 Description: An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs and retrieve sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/motorola-mr2600-authentication-bypass-vulnerability/
CVE ID: CVE-2024-23630 State: PUBLISHED Published: 2024-01-25T23:41:32.024Z Last Updated: 2025-06-17T14:17:53.349Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Motorola Products: MR2600 Problem Types: CWE-434 Description: An arbitrary firmware upload vulnerability exists in the Motorola MR2600. An attacker can exploit this vulnerability to achieve code execution on the device. Authentication is required, however can be bypassed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/25/motorola-mr2600-arbitrary-firmware-upload-vulnerability/
CVE ID: CVE-2024-23633 State: PUBLISHED Published: 2024-01-23T23:15:09.044Z Last Updated: 2024-11-13T15:24:01.901Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: HumanSignal Products: label-studio Problem Types: CWE-79 Description: Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious JavaScript code in the context of the Label Studio website. Executing arbitrary JavaScript could result in an attacker performing maliciou
the context of the Label Studio website. Executing arbitrary JavaScript could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For an example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. `data_import/uploader.py` lines 125C5 through 146 showed that if a URL passed the server side request forgery verification checks, the contents of the file would be downloaded using the filename in the URL. The downloaded file path could then be retrieved by sending a request to `/api/projects/{project_id}/file-uploads?ids=[{download_id}]` where `{project
then be retrieved by sending a request to `/api/projects/{project_id}/file-uploads?ids=[{download_id}]` where `{project_id}` was the ID of the project and `{download_id}` was the ID of the downloaded file. Once the downloaded file path was retrieved by the previous API endpoint, `data_import/api.py`lines 595C1 through 616C62 demonstrated that the `Content-Type` of the response was determined by the file extension, since `mimetypes.guess_type` guesses the `Content-Type` based on the file extension. Since the `Content-Type` was determined by the file extension of the downloaded file, an attacker could import in a `.html` file that would execute JavaScript when visited. Version 1.10.1 contains
ded file, an attacker could import in a `.html` file that would execute JavaScript when visited. Version 1.10.1 contains a patch for this issue. Other remediation strategies are also available. For all user provided files that are downloaded by Label Studio, set the `Content-Security-Policy: sandbox;` response header when viewed on the site. The `sandbox` directive restricts a page's actions to prevent popups, execution of plugins and scripts and enforces a `same-origin` policy. Alternatively, restrict the allowed file extensions that may be downloaded. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HumanSignal/label-studio/securi
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HumanSignal/label-studio/security/advisories/GHSA-fq23-g58m-799r - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox - https://github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/api.py#L595C1-L616C62 - https://github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/uploader.py#L125C5-L146
CVE ID: CVE-2024-23634 State: PUBLISHED Published: 2024-03-20T15:22:41.431Z Last Updated: 2024-08-01T23:06:25.331Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: geoserver Products: geoserver Problem Types: CWE-20, CWE-73 Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file renaming vulnerability exists in versions prior to 2.23.5 and 2.24.2 that enables an authenticated administrator with permissions to modify stores through the REST Coverage Store or Data Store API to rename arbitrary files and directories with a name that does not end in `.zip`. Store file uploads re
Data Store API to rename arbitrary files and directories with a name that does not end in `.zip`. Store file uploads rename zip files to have a `.zip` extension if it doesn't already have one before unzipping the file. This is fine for file and url upload methods where the files will be in a specific subdirectory of the data directory but, when using the external upload method, this allows arbitrary files and directories to be renamed. Renaming GeoServer files will most likely result in a denial of service, either completely preventing GeoServer from running or effectively deleting specific resources (such as a workspace, layer or style). In some cases, renaming GeoServer files could revert
deleting specific resources (such as a workspace, layer or style). In some cases, renaming GeoServer files could revert to the default settings for that file which could be relatively harmless like removing contact information or have more serious consequences like allowing users to make OGC requests that the customized settings would have prevented them from making. The impact of renaming non-GeoServer files depends on the specific environment although some sort of denial of service is a likely outcome. Versions 2.23.5 and 2.24.2 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/geoserver/geoserver/sec
nalyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-75m5-hh4r-q9gx - https://github.com/geoserver/geoserver/pull/7289 - https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772 - https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a - https://osgeo-org.atlassian.net/browse/GEOS-11213
CVE ID: CVE-2024-23635 State: PUBLISHED Published: 2024-02-02T16:32:50.470Z Last Updated: 2024-08-01T23:06:25.335Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nahsra Products: antisamy Problem Types: CWE-79 Description: AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpre
be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patched in AntiSamy 1.7.5 and later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nahsra/antisamy/security/advisories/GHSA-2mrq-w8pv-5pvq
CVE ID: CVE-2024-23636 State: PUBLISHED Published: 2024-01-23T17:22:52.857Z Last Updated: 2024-10-18T16:00:41.941Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: sofastack Products: sofa-rpc Problem Types: CWE-502 Description: SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rel
at can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-7q8p-9953-pxvr - https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76