Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25675 State: PUBLISHED Published: 2024-02-09T00:00:00.000Z Last Updated: 2025-06-16T18:08:48.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/compare/v2.4.183...v2.4.184 - https://github.com/MISP/MISP/commit/0ac2468c2896f4be4ef9219cfe02bff164411594
CVE ID: CVE-2024-25676 State: PUBLISHED Published: 2024-05-01T00:00:00.000Z Last Updated: 2025-05-30T16:03:06.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leads to both open redirection and out-of-band resource loading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/cve-2024-25676 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2024-25676
CVE ID: CVE-2024-25677 State: PUBLISHED Published: 2024-02-09T00:00:00.000Z Last Updated: 2025-06-16T18:12:14.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For example, a local file may request other local files through an XML document. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minbrowser/min/security/advisories/GHSA-4w9v-7h8h-rv8x
CVE ID: CVE-2024-25678 State: PUBLISHED Published: 2024-02-09T00:00:00.000Z Last Updated: 2025-06-20T20:26:13.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rfc-editor.org/rfc/rfc9001 - https://github.com/litespeedtech/lsquic/commit/515f453556c99d27c4dddb5424898dc1a5537708 - https://github.com/litespeedtech/lsquic/releases/tag/v4.0.4
CVE ID: CVE-2024-25679 State: PUBLISHED Published: 2024-02-09T00:00:00.000Z Last Updated: 2025-06-16T18:18:14.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by sending a CONNECTION_CLOSE frame that is encrypted via the initial key computed. Network traffic sniffing is needed as part of exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rfc-editor.org/rfc/rfc9001#name-discarding-unused-keys - https://github.com/p-quic/pquic/pull/39 - https://github.com/p-quic/pquic/issues/35
CVE ID: CVE-2024-25690 State: PUBLISHED Published: 2024-04-04T17:53:03.966Z Last Updated: 2025-04-10T19:03:39.985Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Esri Products: ArcGIS Enterprise Web App Builder Problem Types: CWE-80 Description: There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgi
ram Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE ID: CVE-2024-25691 State: PUBLISHED Published: 2024-10-04T17:18:52.963Z Last Updated: 2025-04-10T19:18:32.234Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-
erences: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
CVE ID: CVE-2024-25692 State: PUBLISHED Published: 2024-04-04T17:51:48.127Z Last Updated: 2025-04-10T19:01:34.842Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-352 Description: There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote, unauthenticated attacker to trick an authorized user into executing unwanted actions via a crafted form. The impact to Confidentiality and Integrity vectors is limited and of low severity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.es
f low severity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE ID: CVE-2024-25693 State: PUBLISHED Published: 2024-04-04T17:54:33.882Z Last Updated: 2024-08-01T23:52:04.660Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-22 Description: There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-upda
ences: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE ID: CVE-2024-25694 State: PUBLISHED Published: 2024-10-04T17:17:58.818Z Last Updated: 2025-04-10T19:17:37.686Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Enterprise Web App Builder Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the Layer Showcase application configuration which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclo
avaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
CVE ID: CVE-2024-25695 State: PUBLISHED Published: 2024-04-04T17:54:23.089Z Last Updated: 2025-04-10T19:05:16.291Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/adminis
Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-2/
CVE ID: CVE-2024-25696 State: PUBLISHED Published: 2024-04-04T17:53:55.765Z Last Updated: 2025-04-10T19:04:24.119Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when accessing the page editor an image will render in the victim’s browser. The privileges required to execute this attack are high. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/produ
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE ID: CVE-2024-25697 State: PUBLISHED Published: 2024-04-04T17:53:25.722Z Last Updated: 2025-04-10T19:02:47.833Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which when opening an authenticated users bio page will render an image in the victims browser. The privileges required to execute this attack are low. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgi
ow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE ID: CVE-2024-25698 State: PUBLISHED Published: 2024-04-04T17:54:47.747Z Last Updated: 2025-04-10T19:06:55.698Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linux that allows a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/pr
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE ID: CVE-2024-25699 State: PUBLISHED Published: 2024-04-04T17:56:25.557Z Last Updated: 2025-04-10T19:08:07.093Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-287 Description: There is a difficult to exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise 11.1 and below on Kubernetes which, under unique circumstances, could potentially allow a remote, unauthenticated attacker to compromise the confidentiality, integrity, and availability of the software. Additional Analyst Notes: - CISA ADP Vulnrichment: -
e the confidentiality, integrity, and availability of the software. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE ID: CVE-2024-25700 State: PUBLISHED Published: 2024-04-04T17:55:01.734Z Last Updated: 2025-05-12T15:19:11.410Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: ArcGIS Enterprise Builder Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in a web map link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. Additional Analyst Notes: - CISA ADP V
in the victim’s browser. The privileges required to execute this attack are high. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-2/
CVE ID: CVE-2024-25701 State: PUBLISHED Published: 2024-10-04T17:17:34.464Z Last Updated: 2025-04-10T19:16:16.784Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Enterprise Experience Builder Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the Experience Builder Embed widget which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are
otentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
CVE ID: CVE-2024-25702 State: PUBLISHED Published: 2024-10-04T17:17:12.593Z Last Updated: 2025-04-10T19:15:30.314Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: ArcGIS Enterprise Web App Builder Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the site configuration which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a priv
code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
CVE ID: CVE-2024-25703 State: REJECTED Published: 2024-04-04T17:55:42.538Z Last Updated: 2024-04-25T18:20:28.471Z Description: No description available.
CVE ID: CVE-2024-25704 State: REJECTED Published: 2024-04-04T17:56:09.842Z Last Updated: 2024-04-25T18:21:10.150Z Description: No description available.
CVE ID: CVE-2024-25705 State: PUBLISHED Published: 2024-04-04T17:55:55.942Z Last Updated: 2025-05-12T15:19:35.244Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a cross site scripting vulnerability in the Esri Portal for ArcGIS Experience Builder 11.1 and below on Windows and Linux that allows a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are low. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esr
equired to execute this attack are low. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/the-portal-for-arcgis-security-2024-update-2-is-available-install-these-patches-at-your-earliest-opportunity-to-address-these-vulnerabilities/
CVE ID: CVE-2024-25706 State: PUBLISHED Published: 2024-04-04T17:55:30.732Z Last Updated: 2025-04-10T19:00:17.232Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-94 Description: There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterpri
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-2/
CVE ID: CVE-2024-25707 State: PUBLISHED Published: 2024-10-04T17:16:47.983Z Last Updated: 2025-04-10T19:14:34.300Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to supply a crafted string which could potentially execute arbitrary JavaScript code in the their own browser (Self XSS). A user cannot be phished into clicking a link to execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
ished into clicking a link to execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
CVE ID: CVE-2024-25708 State: PUBLISHED Published: 2024-04-04T17:52:48.621Z Last Updated: 2025-04-10T18:50:40.932Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: ArcGIS Enterprise Web App Builder Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Prog
. The privileges required to execute this attack are high. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE ID: CVE-2024-25709 State: PUBLISHED Published: 2024-04-04T17:55:17.893Z Last Updated: 2025-05-12T15:20:10.422Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item which will potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
rowser. The privileges required to execute this attack are high. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE ID: CVE-2024-25710 State: PUBLISHED Published: 2024-02-19T08:33:40.627Z Last Updated: 2025-11-04T16:11:24.559Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Apache Software Foundation Products: Apache Commons Compress Problem Types: CWE-835 Description: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf - http://www.o
: - CVE Program Container: References: - https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf - http://www.openwall.com/lists/oss-security/2024/02/19/1 - https://security.netapp.com/advisory/ntap-20240307-0010/
CVE ID: CVE-2024-25711 State: PUBLISHED Published: 2024-02-11T00:00:00.000Z Last Updated: 2025-11-04T18:29:37.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 - https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e - http
s/361 - https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/
CVE ID: CVE-2024-25712 State: PUBLISHED Published: 2024-02-11T00:00:00.000Z Last Updated: 2025-06-16T18:20:18.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Re
een blocked without blocking large files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cosmosofcyberspace.github.io/improper_http_method_leads_to_xss/poc.html - https://github.com/swaggo/http-swagger/releases/tag/v1.2.6
CVE ID: CVE-2024-25713 State: PUBLISHED Published: 2024-02-11T00:00:00.000Z Last Updated: 2025-11-04T22:05:58.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ibireme/yyjson/security/advisories/GHSA-q4m7-9pcm-fpxh - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX/
ts.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2/