Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
set `SIBLING_CONTAINERS_ENABLED=true` by default for new installs. It is recommended that any existing installations using the previous default setting migrate to using sibling containers. Existing installations can set `SIBLING_CONTAINERS_ENABLED=true` in `config/overleaf.rc` as a mitigation. In legacy docker-compose/custom deployments `SANDBOXED_COMPILES=true` should be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/overleaf/overleaf/security/advisories/GHSA-m95q-g8qg-wgj4 - https://github.com/overleaf/toolkit/commit/7a8401897b24777b47338452ff8d12e2fb6dd5ff - https://github.com/overleaf/overleaf/wiki/Server-Pro:-Sandboxed-Compiles - https://github
777b47338452ff8d12e2fb6dd5ff - https://github.com/overleaf/overleaf/wiki/Server-Pro:-Sandboxed-Compiles - https://github.com/overleaf/toolkit/blob/master/doc/sandboxed-compiles.md#enabling-sibling-containers
CVE ID: CVE-2024-45314 State: PUBLISHED Published: 2024-09-04T16:08:41.004Z Last Updated: 2024-09-04T17:43:05.895Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: dpgaspar Products: Flask-AppBuilder Problem Types: CWE-525 Description: Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for `/login` per the directions provided in the
possible, configure one's web server to send the specific HTTP headers for `/login` per the directions provided in the GitHub Security Advisory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fw5r-6m3x-rh7p - https://github.com/dpgaspar/Flask-AppBuilder/commit/3030e881d2e44f4021764e18e489fe940a9b3636
CVE ID: CVE-2024-45315 State: PUBLISHED Published: 2024-10-11T08:17:13.448Z Last Updated: 2024-11-01T15:59:56.980Z Vendors: SonicWall Products: Connect Tunnel Problem Types: CWE-59 Description: The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to create arbitrary folders and files, potentially leading to local Denial of Service (DoS) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0017
CVE ID: CVE-2024-45316 State: PUBLISHED Published: 2024-10-11T08:20:57.727Z Last Updated: 2024-10-11T15:38:20.692Z Vendors: SonicWall Products: Connect Tunnel Problem Types: CWE-59 Description: The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to delete arbitrary folders and files, potentially leading to local privilege escalation attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0017
CVE ID: CVE-2024-45317 State: PUBLISHED Published: 2024-10-11T08:30:23.707Z Last Updated: 2025-03-22T14:18:23.745Z Vendors: SonicWall Products: SMA1000 Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allows a remote, unauthenticated attacker to cause the SMA1000 server-side application to make requests to an unintended IP address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0017
CVE ID: CVE-2024-45318 State: PUBLISHED Published: 2024-12-05T13:43:31.716Z Last Updated: 2024-12-09T14:21:22.642Z Vendors: SonicWall Products: SMA100 Problem Types: CWE-121 Description: A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018
CVE ID: CVE-2024-45319 State: PUBLISHED Published: 2024-12-05T13:50:28.768Z Last Updated: 2024-12-05T16:56:09.484Z Vendors: SonicWall Products: SMA100 Problem Types: CWE-798 Description: A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certificate requirement during authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018
CVE ID: CVE-2024-45320 State: PUBLISHED Published: 2025-02-18T05:20:23.570Z Last Updated: 2025-02-18T14:58:44.985Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: FUJIFILM Business Innovation Corp. Products: DocuPrint CP225w, DocuPrint CP228w, DocuPrint CM225fw, DocuPrint CM228fw Problem Types: CWE-787 Description: Out-of-bounds write vulnerability exists in DocuPrint CP225w 01.22.01 and earlier, DocuPrint CP228w 01.22.01 and earlier, DocuPrint CM225fw 01.10.01 and earlier, and DocuPrint CM228fw 01.10.01 and earlier. If an affected MFP processes a specially crafted printer job file, a denial-of-service (DoS) condition may occur. Additional Analyst Notes: - C
esses a specially crafted printer job file, a denial-of-service (DoS) condition may occur. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0217_announce.html - https://jvn.jp/en/vu/JVNVU96297631/
CVE ID: CVE-2024-45321 State: PUBLISHED Published: 2024-08-27T00:00:00 Last Updated: 2024-09-06T13:33:38.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html - https://github.com/miyagawa/cpanminus/issues/611 - https://github.com/miyagawa/cpanminus/pull/674
CVE ID: CVE-2024-45323 State: PUBLISHED Published: 2024-09-10T14:37:42.131Z Last Updated: 2024-09-10T16:01:31.689Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiEDR Manager Problem Types: CWE-284 Description: An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissions in his profile and restricted to a specific organization to access backend logs that include information related to other organizations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://for
information related to other organizations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-371
CVE ID: CVE-2024-45324 State: PUBLISHED Published: 2025-03-11T14:54:33.810Z Last Updated: 2025-10-16T09:43:58.579Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiOS, FortiPAM, FortiSRA, FortiProxy, FortiWeb Problem Types: CWE-134 Description: A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 through 1.4.2 and before 1.3.1 and F
0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 through 1.4.2 and before 1.3.1 and FortiWeb version 7.4.0 through 7.4.5, version 7.2.0 through 7.2.10 and before 7.0.10 allows a privileged attacker to execute unauthorized code or commands via specially crafted HTTP or HTTPS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-325
CVE ID: CVE-2024-45325 State: PUBLISHED Published: 2025-09-09T13:50:41.345Z Last Updated: 2025-09-09T14:11:17.710Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiDDoS-F Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiDDoS-F version 7.0.0 through 7.02 and before 6.6.3 may allow a privileged attacker to execute unauthorized code or commands via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-344
CVE ID: CVE-2024-45326 State: PUBLISHED Published: 2025-01-14T14:09:55.772Z Last Updated: 2025-01-14T20:53:58.952Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiDeceptor Problem Types: CWE-284 Description: An Improper Access Control vulnerability [CWE-284] in FortiDeceptor version 6.0.0, version 5.3.3 and below, version 5.2.1 and below, version 5.1.0, version 5.0.0 may allow an authenticated attacker with none privileges to perform operations on the central management appliance via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-285
CVE ID: CVE-2024-45327 State: PUBLISHED Published: 2024-09-11T09:53:46.087Z Last Updated: 2024-09-12T03:55:24.954Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSOAR Problem Types: CWE-307 Description: An improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-048
CVE ID: CVE-2024-45328 State: PUBLISHED Published: 2025-03-11T14:54:28.909Z Last Updated: 2025-03-12T04:00:56.211Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-863 Description: An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-261
CVE ID: CVE-2024-45329 State: PUBLISHED Published: 2025-06-10T16:36:06.068Z Last Updated: 2025-06-10T19:40:21.931Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-639 Description: A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may allow an authenticated attacker to view unauthorized device information via key modification in API requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-274
CVE ID: CVE-2024-45330 State: PUBLISHED Published: 2024-10-08T14:19:03.894Z Last Updated: 2024-10-08T16:00:13.750Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiAnalyzer Problem Types: CWE-134 Description: A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-196
CVE ID: CVE-2024-45331 State: PUBLISHED Published: 2025-01-16T08:59:23.201Z Last Updated: 2025-01-16T14:19:20.943Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-266 Description: A incorrect privilege assignment in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15, FortiManager versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15, FortiAnalyzer Cloud versions 7.4.1 through 7.4.2, 7.2.1 through 7.2.6, 7.0.1 through 7.0.13, 6.4.1 through 6.4.7 allows attacker to escalate pri
ions 7.4.1 through 7.4.2, 7.2.1 through 7.2.6, 7.0.1 through 7.0.13, 6.4.1 through 6.4.7 allows attacker to escalate privilege via specific shell commands Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-127
CVE ID: CVE-2024-45332 State: PUBLISHED Published: 2025-05-13T21:03:12.207Z Last Updated: 2025-11-03T19:30:52.919Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Processors Problem Types: Information Disclosure, CWE-1423 Description: Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/se
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01247.html
CVE ID: CVE-2024-45333 State: PUBLISHED Published: 2025-05-13T21:03:13.722Z Last Updated: 2025-05-14T13:50:24.886Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H) Vendors: n/a Products: Intel(R) Data Center GPU Flex Series for Windows driver Problem Types: Denial of Service, CWE-284 Description: Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01253.html
CVE ID: CVE-2024-45334 State: PUBLISHED Published: 2024-10-22T18:27:10.686Z Last Updated: 2025-03-13T16:20:53.780Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Antivirus One Description: Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthorized access to product configurations and functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-14461
CVE ID: CVE-2024-45335 State: PUBLISHED Published: 2024-10-22T18:27:58.171Z Last Updated: 2025-03-13T15:02:04.676Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Antivirus One Description: Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted virus to allow itself to bypass and evade a virus scan detection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-07255
CVE ID: CVE-2024-45336 State: PUBLISHED Published: 2025-01-28T01:03:24.869Z Last Updated: 2025-09-18T18:41:11.116Z Vendors: Go standard library Products: net/http Problem Types: CWE-201: Insertion of Sensitive Information Into Sent Data Description: The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Aut
stored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/643100 - https://go.dev/issue/70530 - https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ - https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ - https://pkg.go.dev/vuln/GO-2025-3420
CVE ID: CVE-2024-45337 State: PUBLISHED Published: 2024-12-11T18:55:58.506Z Last Updated: 2025-02-18T20:48:40.404Z Vendors: golang.org/x/crypto Products: golang.org/x/crypto/ssh Problem Types: CWE-1108: Excessive Reliance on Global Variables Description: Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving c
ate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first w
tacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key pa
now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the
tication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 - https://go.dev/cl/635315 - https://go.dev/issue/70779 - https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ - https://pkg.go.dev/vuln/GO-2024-3321
CVE ID: CVE-2024-45338 State: PUBLISHED Published: 2024-12-18T20:38:22.660Z Last Updated: 2025-02-21T18:03:32.301Z Vendors: golang.org/x/net Products: golang.org/x/net/html Problem Types: CWE-405: Asymmetric Resource Consumption (Amplification) Description: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/637536 - https://go.dev/issue/70906 - https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ - https://pkg.go.dev/vuln/GO-
dev/issue/70906 - https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ - https://pkg.go.dev/vuln/GO-2024-3333
CVE ID: CVE-2024-45339 State: PUBLISHED Published: 2025-01-28T01:03:24.105Z Last Updated: 2025-02-17T11:02:36.886Z Vendors: github.com/golang/glog Products: github.com/golang/glog Problem Types: CWE-61: UNIX Symbolic Link (Symlink) Following Description: When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists. Addi
glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2 - https://github.com/golang/glog/pull/74 - https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs - https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File - https://pkg.go.dev/vuln/GO-2025-3372
CVE ID: CVE-2024-45340 State: PUBLISHED Published: 2025-01-28T01:03:24.605Z Last Updated: 2025-01-30T19:14:21.639Z Vendors: Go toolchain Products: cmd/go Problem Types: CWE-201: Insertion of Sensitive Information Into Sent Data Description: Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.dev/cl/643097 - https://go.dev/issue/71249 - https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lC
https://go.dev/cl/643097 - https://go.dev/issue/71249 - https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ - https://pkg.go.dev/vuln/GO-2025-3383
CVE ID: CVE-2024-45341 State: PUBLISHED Published: 2025-01-28T01:03:24.353Z Last Updated: 2025-02-21T18:03:33.296Z Vendors: Go standard library Products: crypto/x509 Problem Types: CWE-295: Improper Certificate Validation Description: A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/643099 - https://go.dev/issue/71156 - https://groups.google.com/g/golang-dev/
Container: References: - https://go.dev/cl/643099 - https://go.dev/issue/71156 - https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ - https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ - https://pkg.go.dev/vuln/GO-2025-3373