Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-32928 State: PUBLISHED Published: 2024-08-19T16:38:01.140Z Last Updated: 2025-03-14T15:47:28.052Z Vendors: Google Products: Nest Speakers Problem Types: Information disclosure Description: The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.google.com/product-documentation/answer/14771247?hl=en&ref_topic=12974021&sjid=9111851316942032590-NA#zippy=
CVE ID: CVE-2024-32929 State: PUBLISHED Published: 2024-06-13T20:48:11.839Z Last Updated: 2024-08-02T02:27:52.128Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In gpu_slc_get_region of pixel_gpu_slc.c, there is a possible EoP due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-05-01
CVE ID: CVE-2024-32930 State: PUBLISHED Published: 2024-06-13T21:02:02.767Z Last Updated: 2024-11-07T15:11:35.759Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In plugin_ipc_handler of slc_plugin.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure of 4 bytes of stack memory with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-06-01
CVE ID: CVE-2024-32931 State: PUBLISHED Published: 2024-08-01T21:18:07.426Z Last Updated: 2024-08-06T20:35:43.344Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Johnson Controls Products: exacqVision Problem Types: CWE-598 Description: Under certain circumstances the exacqVision Web Service can expose authentication token details within communications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-06
CVE ID: CVE-2024-32932 State: PUBLISHED Published: 2024-07-02T14:08:17.013Z Last Updated: 2024-08-02T02:27:52.390Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Johnson Controls Products: American Dynamics Illustra Essentials Gen 4 Problem Types: CWE-257 Description: Under certain circumstances the web interface users credentials may be recovered by an authenticated user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-07
CVE ID: CVE-2024-32936 State: PUBLISHED Published: 2024-06-24T13:56:48.054Z Last Updated: 2025-05-04T09:05:09.128Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: Fix races while restarting DMA After the frame is submitted to DMA, it may happen that the submitted list is not updated soon enough, and the DMA callback is triggered before that. This can lead to kernel crashes, so move everything in a single lock/unlock section to prevent such races. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569
Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea - https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b
CVE ID: CVE-2024-32937 State: PUBLISHED Published: 2024-07-03T14:05:35.575Z Last Updated: 2025-11-04T17:20:20.384Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Grandstream Products: GXP2135 Problem Types: CWE-78 Description: An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerabil
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1978
CVE ID: CVE-2024-32938 State: PUBLISHED Published: 2025-02-12T21:19:06.076Z Last Updated: 2025-02-13T20:19:29.906Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) MPI Library for Windows software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01207.html
CVE ID: CVE-2024-32939 State: PUBLISHED Published: 2024-08-22T06:29:01.203Z Last Updated: 2024-08-22T13:26:55.790Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-32940 State: PUBLISHED Published: 2024-09-16T16:38:36.385Z Last Updated: 2024-09-16T17:43:55.252Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) RAID Web Console software Problem Types: denial of service, CWE-284 Description: Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE ID: CVE-2024-32941 State: PUBLISHED Published: 2025-02-12T21:19:54.183Z Last Updated: 2025-02-18T19:55:17.831Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: n/a Products: Intel(R) MLC software Problem Types: Denial of Service, CWE-476 Description: NULL pointer dereference for some Intel(R) MLC software before version v3.11b may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01238.html
CVE ID: CVE-2024-32942 State: PUBLISHED Published: 2025-02-12T21:19:49.430Z Last Updated: 2025-02-18T19:55:41.388Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) DSA installer for Windows Problem Types: Escalation of Privilege, CWE-276 Description: Incorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19.5 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01156.html
CVE ID: CVE-2024-32943 State: PUBLISHED Published: 2024-06-20T22:12:34.239Z Last Updated: 2024-08-02T02:27:52.185Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Westermo Products: L210-F2G Lynx Problem Types: CWE-799 Description: An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-172-03
CVE ID: CVE-2024-32944 State: PUBLISHED Published: 2024-05-28T03:11:04.472Z Last Updated: 2024-10-29T14:51:18.432Z Vendors: ameya/ayame Products: UTAU Problem Types: Path traversal Description: Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip file) to UTAU, an arbitrary file may be placed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://utau2008.xrea.jp/ - https://jvn.jp/en/jp/JVN71404925/
CVE ID: CVE-2024-32945 State: PUBLISHED Published: 2024-07-15T08:42:19.268Z Last Updated: 2024-08-02T02:27:52.391Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-909 Description: Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LateX post, by creating another post with specific macro definitions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-32946 State: PUBLISHED Published: 2024-10-30T13:35:17.990Z Last Updated: 2024-10-30T15:03:10.149Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: LevelOne Products: WBR-6012 Problem Types: CWE-319 Description: A vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via Web and FTP services, exposing it to network sniffing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1983
CVE ID: CVE-2024-32947 State: PUBLISHED Published: 2024-04-24T14:48:57.172Z Last Updated: 2024-08-02T02:27:52.431Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: AlumniOnline Web Services LLC Products: WP ADA Compliance Check Basic Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in AlumniOnline Web Services LLC WP ADA Compliance Check Basic.This issue affects WP ADA Compliance Check Basic: from n/a through 3.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-ada-compliance-check-basic/wordpress-wp-ada-compliance-check-basic-plugin
tps://patchstack.com/database/vulnerability/wp-ada-compliance-check-basic/wordpress-wp-ada-compliance-check-basic-plugin-3-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32948 State: PUBLISHED Published: 2024-04-24T07:03:17.452Z Last Updated: 2024-08-02T02:27:52.125Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Repute Infosystems Products: ARMember Problem Types: CWE-862 Description: Missing Authorization vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.28. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-membership-plugin-plugin-4-0-28-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-32950 State: PUBLISHED Published: 2024-04-24T08:25:50.058Z Last Updated: 2024-08-02T02:27:52.358Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: DeBAAT Products: WP Media Category Management Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP Media Category Management allows Reflected XSS.This issue affects WP Media Category Management: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-media-category-management/wordpress-wp-media-category-m
: References: - https://patchstack.com/database/vulnerability/wp-media-category-management/wordpress-wp-media-category-management-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-32951 State: PUBLISHED Published: 2024-04-24T06:59:03.629Z Last Updated: 2024-08-02T02:27:52.391Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: BloomPixel Products: Max Addons Pro for Bricks Problem Types: CWE-862 Description: Missing Authorization vulnerability in BloomPixel Max Addons Pro for Bricks.This issue affects Max Addons Pro for Bricks: from n/a through 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/max-addons-pro-bricks/wordpress-max-addons-pro-for-bricks-plugin-1-6-1-unauthenticated-plugin-settings-reset-vulnerability?_s_id=cve
CVE ID: CVE-2024-32952 State: PUBLISHED Published: 2024-04-24T08:24:27.131Z Last Updated: 2024-08-02T02:27:52.400Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: BloomPixel Products: Max Addons Pro for Bricks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BloomPixel Max Addons Pro for Bricks allows Reflected XSS.This issue affects Max Addons Pro for Bricks: from n/a through 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/max-addons-pro-bricks/wordpress-max-addons-pro-for-bricks
r: References: - https://patchstack.com/database/vulnerability/max-addons-pro-bricks/wordpress-max-addons-pro-for-bricks-plugin-1-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-32953 State: PUBLISHED Published: 2024-04-24T07:36:06.123Z Last Updated: 2024-09-03T15:35:22.227Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Products: Newsletters Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in Newsletters.This issue affects Newsletters: from n/a through 4.9.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/newsletters-lite/wordpress-newsletters-plugin-4-9-5-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-32954 State: PUBLISHED Published: 2024-04-24T10:37:45.914Z Last Updated: 2024-08-02T02:27:52.423Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Tribulant Products: Newsletters Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/newsletters-lite/wordpress-newsletters-plugin-4-9-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-32955 State: PUBLISHED Published: 2024-04-24T07:05:43.260Z Last Updated: 2024-08-02T02:27:52.404Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Foliovision Products: FV Flowplayer Video Player Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.43.7212. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-43-7212-server-side-request-forgery-ssrf-v
ility/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-43-7212-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32956 State: PUBLISHED Published: 2024-04-24T08:23:04.043Z Last Updated: 2024-08-08T16:08:52.194Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Rometheme Products: RomethemeKit For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RomethemeKit For Elementor allows Stored XSS.This issue affects RomethemeKit For Elementor: from n/a through 1.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/rometheme-for-elementor/wordpress-romethemekit-for-elemen
t: References: - https://patchstack.com/database/vulnerability/rometheme-for-elementor/wordpress-romethemekit-for-elementor-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-32957 State: PUBLISHED Published: 2024-04-26T10:58:36.110Z Last Updated: 2024-08-02T02:27:52.172Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Live Composer Team Products: Page Builder: Live Composer Problem Types: CWE-862 Description: Missing Authorization vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.38. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/live-composer-page-builder/wordpress-page-builder-live-composer-plugin-1-5-38-broken-access-control-vulnerability?_
lity/live-composer-page-builder/wordpress-page-builder-live-composer-plugin-1-5-38-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-32958 State: PUBLISHED Published: 2024-04-24T14:47:43.539Z Last Updated: 2024-08-02T02:27:52.990Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Giorgos Sarigiannidis Products: Slash Admin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Giorgos Sarigiannidis Slash Admin allows Cross-Site Scripting (XSS).This issue affects Slash Admin: from n/a through 3.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/slash-admin/wordpress-slash-admin-plugin-3-8-1-csrf-to-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-32959 State: PUBLISHED Published: 2024-05-17T09:40:23.092Z Last Updated: 2024-08-02T02:27:53.183Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sirv Products: Sirv Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Sirv allows Privilege Escalation.This issue affects Sirv: from n/a through 7.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/sirv/wordpress-sirv-plugin-7-2-2-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-32960 State: PUBLISHED Published: 2024-05-17T09:40:45.585Z Last Updated: 2024-08-02T02:27:52.396Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Booking Ultra Pro Products: Booking Ultra Pro Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Booking Ultra Pro allows Privilege Escalation.This issue affects Booking Ultra Pro: from n/a through 1.1.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/booking-ultra-pro/wordpress-booking-ultra-pro-plugin-1-1-12-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-32961 State: PUBLISHED Published: 2024-04-25T09:16:38.869Z Last Updated: 2024-08-02T02:27:53.695Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Creative Themes HQ Products: Blocksy Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes HQ Blocksy allows Stored XSS.This issue affects Blocksy: from n/a through 2.0.33. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/blocksy/wordpress-blocksy-theme-2-0-33-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-32962 State: PUBLISHED Published: 2024-05-02T06:48:55.906Z Last Updated: 2025-02-13T17:52:18.895Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: node-saml Products: xml-crypto Problem Types: CWE-347 Description: xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional validation steps, the default configuration allows a malicious actor to re-sign an XML document, place the certificate in a `<KeyInfo />` el
e default configuration allows a malicious actor to re-sign an XML document, place the certificate in a `<KeyInfo />` element, and pass `xml-crypto` default validation checks. As a result `xml-crypto` trusts by default any certificate provided via digitally signed XML document's `<KeyInfo />`. `xml-crypto` prefers to use any certificate provided via digitally signed XML document's `<KeyInfo />` even if library was configured to use specific certificate (`publicCert`) for signature verification purposes. An attacker can spoof signature verification by modifying XML document and replacing existing signature with signature generated with malicious private key (created by attacker) and by attach
and replacing existing signature with signature generated with malicious private key (created by attacker) and by attaching that private key's certificate to `<KeyInfo />` element. This vulnerability is combination of changes introduced to `4.0.0` on pull request 301 / commit `c2b83f98` and has been addressed in version 6.0.0 with pull request 445 / commit `21201723d`. Users are advised to upgrade. Users unable to upgrade may either check the certificate extracted via `getCertFromKeyInfo` against trusted certificates before accepting the results of the validation or set `xml-crypto's getCertFromKeyInfo` to `() => undefined` forcing `xml-crypto` to use an explicitly configured `publicCert` or
l-crypto's getCertFromKeyInfo` to `() => undefined` forcing `xml-crypto` to use an explicitly configured `publicCert` or `privateKey` for signature verification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v - https://github.com/node-saml/xml-crypto/pull/301 - https://github.com/node-saml/xml-crypto/pull/445 - https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000 - https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca - https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation - https://s
84049edb68ad1d7c6ad0739ec92af11ca - https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation - https://security.netapp.com/advisory/ntap-20240705-0003/