Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45342 State: REJECTED Published: N/A Last Updated: 2025-01-08T19:12:27.393Z Description: No description available.
CVE ID: CVE-2024-45343 State: REJECTED Published: N/A Last Updated: 2025-01-08T19:12:38.950Z Description: No description available.
CVE ID: CVE-2024-45344 State: REJECTED Published: N/A Last Updated: 2025-01-08T19:12:50.071Z Description: No description available.
CVE ID: CVE-2024-45345 State: REJECTED Published: N/A Last Updated: 2025-01-08T19:13:01.915Z Description: No description available.
CVE ID: CVE-2024-45346 State: PUBLISHED Published: 2024-08-28T06:44:40.297Z Last Updated: 2025-04-08T20:42:58.880Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Xiaomi Products: GetApps application Problem Types: CWE-287 Description: The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
afe access of millions of Xiaomi users worldwide Life. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/misrc/bulletins/advisory?cveId=545
CVE ID: CVE-2024-45347 State: PUBLISHED Published: 2025-06-23T09:34:38.676Z Last Updated: 2025-06-23T12:03:52.156Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Xiaomi Products: Xiaomi Mi Connect Service Problem Types: CWE-287 Description: An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=548
CVE ID: CVE-2024-45348 State: PUBLISHED Published: 2024-09-23T08:25:47.868Z Last Updated: 2025-03-27T06:39:01.861Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Xiaomi Products: Xiaomi Router AX9000 Problem Types: CWE-77 Description: Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=547
CVE ID: CVE-2024-45351 State: PUBLISHED Published: 2025-03-26T13:17:07.014Z Last Updated: 2025-03-26T13:52:37.034Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Xiaomi Products: Game center application Problem Types: CWE-1284 Description: A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=549
CVE ID: CVE-2024-45352 State: PUBLISHED Published: 2025-03-27T02:02:34.511Z Last Updated: 2025-03-27T13:44:35.760Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Xiaomi Products: Xiaomi smarthome application Problem Types: CWE-346 Description: An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=550
CVE ID: CVE-2024-45353 State: PUBLISHED Published: 2025-03-27T06:12:57.059Z Last Updated: 2025-03-27T14:18:37.623Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Xiaomi Products: quick app framework Problem Types: CWE-346 Description: An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and can be exploited by attackers tointent redriction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=551
CVE ID: CVE-2024-45354 State: PUBLISHED Published: 2025-03-27T06:25:56.581Z Last Updated: 2025-03-27T13:37:21.226Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Xiaomi Products: Xiaomi shop application Problem Types: CWE-346 Description: A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=552
CVE ID: CVE-2024-45355 State: PUBLISHED Published: 2025-03-27T06:48:07.672Z Last Updated: 2025-03-27T13:32:01.178Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Xiaomi Products: Xiaomi phone framework Problem Types: CWE-306 Description: A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=553
CVE ID: CVE-2024-45356 State: PUBLISHED Published: 2025-03-27T07:11:41.754Z Last Updated: 2025-03-27T13:31:36.164Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H) Vendors: Xiaomi Products: Xiaomi phone framework has unauthorized access vulnerability Problem Types: CWE-306 Description: A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=554
CVE ID: CVE-2024-45361 State: PUBLISHED Published: 2025-03-27T07:16:21.898Z Last Updated: 2025-06-23T09:43:27.193Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Xiaomi Products: Xiaomi Mi Connect Service Problem Types: CWE-319 Description: A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=558
CVE ID: CVE-2024-45366 State: PUBLISHED Published: 2024-09-18T05:20:41.822Z Last Updated: 2024-11-05T21:19:16.615Z Vendors: Welcart Inc. Products: Welcart e-Commerce Problem Types: Cross-site scripting (XSS) Description: Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.welcart.com/archives/22581.html - https://jvn.jp/en/jp/JVN19766555/
CVE ID: CVE-2024-45367 State: PUBLISHED Published: 2024-10-03T22:19:35.215Z Last Updated: 2024-10-04T14:24:41.220Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Optigo Networks Products: ONS-S8 Spectra Aggregation Switch Problem Types: CWE-1390 Description: The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01
CVE ID: CVE-2024-45368 State: PUBLISHED Published: 2024-09-13T16:36:08.941Z Last Updated: 2024-09-13T17:41:54.617Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AutomationDirect Products: DirectLogic H2-DM1E Problem Types: CWE-384 Description: The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed anomaly in the H2-DM1E PLC's protocol execution, namely its acceptance of multiple distinct packets as valid authentication responses. This behavior deviates from standard security practices where a single, specific response or encoding pattern is expected for succe
or deviates from standard security practices where a single, specific response or encoding pattern is expected for successful authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-17
CVE ID: CVE-2024-45369 State: PUBLISHED Published: 2024-11-22T22:18:12.706Z Last Updated: 2024-11-26T15:58:05.563Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mySCADA Products: myPRO Manager, myPRO Runtime Problem Types: CWE-287 Description: The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07
CVE ID: CVE-2024-45371 State: PUBLISHED Published: 2025-05-13T21:03:15.324Z Last Updated: 2025-05-14T13:42:22.769Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H) Vendors: n/a Products: Intel(R) Arc™ &amp; Iris(R) Xe graphics software Problem Types: Denial of Service, CWE-284 Description: Improper access control for some Intel(R) Arc™ &amp; Iris(R) Xe graphics software before version 32.0.101.6077 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01253.html
CVE ID: CVE-2024-45372 State: PUBLISHED Published: 2024-09-26T04:06:47.174Z Last Updated: 2025-03-25T15:58:46.344Z Vendors: PLANEX COMMUNICATIONS INC. Products: MZK-DP300N Problem Types: CWE-352 Description: MZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability. Viewing a malicious page while logging in to the web management page of the affected product may lead the user to perform unintended operations such as changing the login password, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.planex.co.jp/support/download/mzk-dp300n/ - https://jvn.jp/en/jp/JVN81966868/
CVE ID: CVE-2024-45373 State: PUBLISHED Published: 2024-09-24T23:48:40.625Z Last Updated: 2024-09-25T16:57:09.490Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dover Fueling Solutions (DFS) Products: ProGauge MAGLINK LX CONSOLE, ProGauge MAGLINK LX4 CONSOLE Problem Types: CWE-269 Description: Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04
CVE ID: CVE-2024-45374 State: PUBLISHED Published: 2024-09-26T17:08:13.256Z Last Updated: 2025-03-12T21:17:01.057Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: goTenna Products: Pro ATAK Plugin Problem Types: CWE-521 Description: The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so i
dcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is advised to use local QR encryption key sharing for additional security on this and previous versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
CVE ID: CVE-2024-45380 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:15:22.065Z Description: No description available.
CVE ID: CVE-2024-45382 State: PUBLISHED Published: 2024-10-08T03:03:52.526Z Last Updated: 2024-10-08T13:53:04.427Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-787 Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through out-of-bounds write. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-10.md
CVE ID: CVE-2024-45383 State: PUBLISHED Published: 2024-09-12T18:19:23.682Z Last Updated: 2024-09-13T19:03:10.251Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Microsoft Products: HDAudBus.sys Problem Types: CWE-664 Description: A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101.0800). A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can execute malicious script/application to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
script/application to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2008
CVE ID: CVE-2024-45384 State: PUBLISHED Published: 2024-09-17T18:36:00.411Z Last Updated: 2025-03-14T19:45:27.172Z Vendors: Apache Software Foundation Products: Apache Druid Problem Types: Padding Oracle Description: Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by default, Druid installations not using the druid-pac4j extension are not affected by this vulnerability. While we are not aware of a way to meaningfully exploit this flaw, we nevertheless recommend upgrading to version 30.0
. While we are not aware of a way to meaningfully exploit this flaw, we nevertheless recommend upgrading to version 30.0.1 or higher which fixes the issue and ensuring you have a strong druid.auth.pac4j.cookiePassphrase as a precaution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/gr94fnp574plb50lsp8jw4smvgv1lbz1
CVE ID: CVE-2024-45385 State: PUBLISHED Published: 2025-01-14T10:30:02.825Z Last Updated: 2025-01-14T14:33:56.757Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: Siemens Products: Industrial Edge Management OS (IEM-OS) Problem Types: CWE-79 Description: A vulnerability has been identified in Industrial Edge Management OS (IEM-OS) (All versions). Affected components are vulnerable to reflected cross-site scripting (XSS) attacks. This could allow an attacker to extract sensitive information by tricking users into accessing a malicious link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productce
licious link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-416411.html
CVE ID: CVE-2024-45386 State: PUBLISHED Published: 2025-02-11T10:28:44.675Z Last Updated: 2025-02-11T14:38:30.854Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: SIMATIC PCS neo V4.0, SIMATIC PCS neo V4.1, SIMATIC PCS neo V5.0, SIMOCODE ES V19, SIRIUS Safety ES V19 (TIA Portal), SIRIUS Soft Starter ES V19 (TIA Portal), TIA Administrator Problem Types: CWE-613 Description: A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versio
versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19 Update 1), TIA Administrator (All versions < V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-342348.html
CVE ID: CVE-2024-45387 State: PUBLISHED Published: 2024-12-23T15:30:13.873Z Last Updated: 2024-12-24T01:47:40.228Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Apache Software Foundation Products: Apache Traffic Control Problem Types: CWE-89, CWE-285 Description: An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.
Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/t38nk5n7t8w3pb66z7z4pqfzt4443trr
CVE ID: CVE-2024-45388 State: PUBLISHED Published: 2024-09-02T16:07:17.599Z Last Updated: 2024-09-03T14:22:12.634Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SpectoLabs Products: hoverfly Problem Types: CWE-200 Description: Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the
ly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, "/")`). This issue is also tracked as GHSL-2023-274. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46
t Notes: - CISA ADP Vulnrichment: References: - https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897 - https://codeql.github.com/codeql-query-help/go/go-path-injection - https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3 - https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87
CVE ID: CVE-2024-45389 State: PUBLISHED Published: 2024-09-03T19:30:15.699Z Last Updated: 2024-09-03T20:03:17.823Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: CloudCannon Products: pagefind Problem Types: CWE-79 Description: Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script the user loads. This information is gathered by looking up the value of `document.currentScript.src`. Prior to Pagefind version 1.1.1, it is possible to "clobber" this lookup with otherwise benign HTML on the page. This will cause `document.currentScript.src` to resolve as an external domain,
with otherwise benign HTML on the page. This will cause `document.currentScript.src` to resolve as an external domain, which will then be used by Pagefind to load dependencies. This exploit would only work in the case that an attacker could inject HTML to a live, hosted, website. In these cases, this would act as a way to escalate the privilege available to an attacker. This assumes they have the ability to add some elements to the page (for example, `img` tags with a `name` attribute), but not others, as adding a `script` to the page would itself be the cross-site scripting vector. Pagefind has tightened this resolution in version 1.1.1 by ensuring the source is loaded from a valid script
ng vector. Pagefind has tightened this resolution in version 1.1.1 by ensuring the source is loaded from a valid script element. There are no reports of this being exploited in the wild via Pagefind. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CloudCannon/pagefind/security/advisories/GHSA-gprj-6m2f-j9hx - https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986 - https://github.com/CloudCannon/pagefind/commit/14ec96864eabaf1d7d809d5da0186a8856261eeb
CVE ID: CVE-2024-45390 State: PUBLISHED Published: 2024-09-03T19:37:31.763Z Last Updated: 2024-09-03T20:01:40.797Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: blakeembrey Products: js-template Problem Types: CWE-94 Description: @blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or don't use the display name feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/blakeembrey/js-tem
lay name feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/blakeembrey/js-template/security/advisories/GHSA-q765-wm9j-66qj - https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa
CVE ID: CVE-2024-45391 State: PUBLISHED Published: 2024-09-03T19:43:07.417Z Last Updated: 2024-09-03T20:23:59.611Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: tinacms Products: tinacms Problem Types: CWE-200 Description: Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search token may be vulnerable to the search token being leaked via lock file (tina-lock.json). Administrators of Tina-enabled websites with search setup should rotate their key immediately. This issue has been patched in @tinacms/cli version 1.6.2. Upgrading and rotating the search token is
key immediately. This issue has been patched in @tinacms/cli version 1.6.2. Upgrading and rotating the search token is required for the proper fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tinacms/tinacms/security/advisories/GHSA-4qrm-9h4r-v2fx - https://github.com/tinacms/tinacms/pull/4758 - https://github.com/tinacms/tinacms/commit/110f1ceea4574d636a64526648f7c8bf6539b26a