Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-36110 State: PUBLISHED Published: 2024-05-28T18:33:56.721Z Last Updated: 2024-08-02T03:30:12.971Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: ansibleguy Products: webui Problem Types: CWE-79 Description: ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
pgrade. There are no known workarounds for these issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj - https://github.com/ansibleguy/webui/issues/44 - https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522 - https://github.com/ansibleguy/webui/files/15358522/Report.pdf
CVE ID: CVE-2024-36111 State: PUBLISHED Published: 2024-07-25T13:26:13.257Z Last Updated: 2024-08-02T03:30:12.864Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: 1Panel-dev Products: KubePi Problem Types: CWE-1259 Description: KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the key is detected to be empty in the configuration file reading logic, the key is empty during actual verification. Using an empty key to generat
mpty in the configuration file reading logic, the key is empty during actual verification. Using an empty key to generate a JWT token can bypass the login verification and directly take over the back end. Version 1.8.0 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-8q5r-cvcw-4wx7
CVE ID: CVE-2024-36112 State: PUBLISHED Published: 2024-05-28T22:26:12.487Z Last Updated: 2024-08-02T03:30:13.120Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: nautobot Products: nautobot Problem Types: CWE-280, CWE-755 Description: Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI view (`/extras/dynamic-groups/<uuid>/`) and/or the members REST API view (`/api/extras/dynamic-groups/<uuid>/members/`) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where t
members/`) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's `dcim.view_device` permissions or lack thereof. This issue has been fixed in Nautobot versions 1.6.23 and 2.2.5. Users are advised to upgrade. This vulnerability can be partially mitigated by removing `extras.view_dynamicgroup` permission from users however a full fix will require upgrading.
tially mitigated by removing `extras.view_dynamicgroup` permission from users however a full fix will require upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nautobot/nautobot/security/advisories/GHSA-qmjf-wc2h-6x3q - https://github.com/nautobot/nautobot/pull/5757 - https://github.com/nautobot/nautobot/pull/5762
CVE ID: CVE-2024-36113 State: PUBLISHED Published: 2024-07-03T19:07:27.133Z Last Updated: 2024-08-02T03:30:13.048Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: discourse Products: discourse Problem Types: CWE-862 Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch, a rogue staff user could suspend other staff users preventing them from logging in to the site. The issue is patched in version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests
ersion 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-3w3f-76p7-3c4g - https://github.com/discourse/discourse/commit/8470546f59b04bd82ce9b711406758fd5439936d - https://github.com/discourse/discourse/commit/9c4a5f39d3ad351410a1453ff5e5f7ffce17cd7e
CVE ID: CVE-2024-36114 State: PUBLISHED Published: 2024-05-29T20:24:53.906Z Last Updated: 2024-08-02T03:30:13.037Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: airlift Products: aircompressor Problem Types: CWE-125, CWE-787 Description: Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java process (which could contain sensitive information). When decompressing certain data, the decompressors try to access memory outside t
could contain sensitive information). When decompressing certain data, the decompressors try to access memory outside the bounds of the given byte arrays or byte buffers. Because Aircompressor uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. Users should update to Aircompressor 0.27 or newer where these issues have been fixed. When decompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM, or to leak other sensitive information from th
this can be exploited for a denial-of-service attack by crashing the JVM, or to leak other sensitive information from the Java process. There are no known workarounds for this issue. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - https://github.com/airlift/aircompressor/security/advisories/GHSA-973x-65j7-xcf4 - https://github.com/airlift/aircompressor/commit/15e68df9eb0c2bfde7f796231ee7cd1982965071 - https://github.com/airlift/aircompressor/commit/2cea90a45534f9aacbb77426fb64e975504dee6e - https://github.com/airlift/aircompressor/commit/cf66151541edb062ea88b6f3baab3f95e48b7b7f - https://github.com/airlift/aircompressor/commit/d01ecb779375a092d00e224abe7869c
66151541edb062ea88b6f3baab3f95e48b7b7f - https://github.com/airlift/aircompressor/commit/d01ecb779375a092d00e224abe7869cdf49ddc3e
CVE ID: CVE-2024-36115 State: PUBLISHED Published: 2024-06-19T17:37:20.736Z Last Updated: 2024-08-02T03:30:13.082Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: dzikoysk Products: reposilite Problem Types: CWE-79 Description: Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The problem lies in the fact that the artifact's content is served via the same origin (protocol/host/port) as the Admin UI. If the artifact contains HTML conten
ifact's content is served via the same origin (protocol/host/port) as the Admin UI. If the artifact contains HTML content with javascript inside, the javascript is executed within the same origin. Therefore, if an authenticated user is viewing the artifacts content, the javascript inside can access the browser's local storage where the user's password (aka 'token-secret') is stored. It is especially dangerous in scenarios where Reposilite is configured to mirror third party repositories, like the Maven Central Repository. Since anyone can publish an artifact to Maven Central under its own name, such malicious packages can be used to attack the Reposilite instance. This issue may lead to the
l under its own name, such malicious packages can be used to attack the Reposilite instance. This issue may lead to the full Reposilite instance compromise. If this attack is performed against the admin user, it's possible to use the admin API to modify settings and artifacts on the instance. In the worst case scenario, an attacker would be able to obtain the Remote code execution on all systems that use artifacts from Reposilite. It's important to note that the attacker does not need to lure a victim user to use a malicious artifact, but just open a link in the browser. This link can be silently loaded among the other HTML content, making this attack unnoticeable. Even if the Reposilite ins
is link can be silently loaded among the other HTML content, making this attack unnoticeable. Even if the Reposilite instance is located in an isolated environment, such as behind a VPN or in the local network, this attack is still possible as it can be performed from the admin browser. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-072. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dzikoysk/reposilite/security/advisories/GHSA-9w8w-34vr-65j2
t: - CVE Program Container: References: - https://github.com/dzikoysk/reposilite/security/advisories/GHSA-9w8w-34vr-65j2 - https://github.com/dzikoysk/reposilite/commit/279a472015ec675c1da449d902dc82e4dd578484 - https://github.com/dzikoysk/reposilite/commit/d11609f427aba255e0f6f54b1105d5d20ab043cf - https://github.com/dzikoysk/reposilite/releases/tag/3.5.12
CVE ID: CVE-2024-36116 State: PUBLISHED Published: 2024-06-19T17:37:22.713Z Last Updated: 2024-08-02T03:30:12.926Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dzikoysk Products: reposilite Problem Types: CWE-22 Description: Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, JavadocEndpoints.kt controller allows to expand the javadoc archive into the server's file system and return its content. The problem is in the way how the archives are expanded, specifically how
server's file system and return its content. The problem is in the way how the archives are expanded, specifically how the new filename is created. The `file.name` taken from the archive can contain path traversal characters, such as '/../../../anything.txt', so the resulting extraction path can be outside the target directory. If the archive is taken from an untrusted source, such as Maven Central or JitPack for example, an attacker can craft a special archive to overwrite any local file on Reposilite instance. This could lead to remote code execution, for example by placing a new plugin into the '$workspace$/plugins' directory. Alternatively, an attacker can overwrite the content of any o
ing a new plugin into the '$workspace$/plugins' directory. Alternatively, an attacker can overwrite the content of any other package. Note that the attacker can use its own malicious package from Maven Central to overwrite any other package on Reposilite. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-073. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dzikoysk/reposilite/security/advisories/GHSA-frvj-cfq4-3228 - https://github.com/dzikoysk/r
rences: - https://github.com/dzikoysk/reposilite/security/advisories/GHSA-frvj-cfq4-3228 - https://github.com/dzikoysk/reposilite/commit/848173738e4375482c70365db5cebae29f125eaa - https://github.com/dzikoysk/reposilite/releases/tag/3.5.12
CVE ID: CVE-2024-36117 State: PUBLISHED Published: 2024-06-19T17:37:24.404Z Last Updated: 2024-11-04T18:25:47.436Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: dzikoysk Products: reposilite Problem Types: CWE-22 Description: Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tra
wn workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dzikoysk/reposilite/releases/tag/3.5.12 - https://github.com/dzikoysk/reposilite/security/advisories/GHSA-82j3-hf72-7x93 - https://github.com/dzikoysk/reposilite/commit/e172ae4b539c822d0d6e04cf090713c7202a79d6
CVE ID: CVE-2024-36118 State: PUBLISHED Published: 2024-05-30T16:51:19.236Z Last Updated: 2024-08-02T03:30:12.897Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: metersphere Products: metersphere Problem Types: CWE-200 Description: MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other workspaces beyond their authority. This issue has been addressed in version 2.10.15-lts. Users of MeterSphere are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
rounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/metersphere/metersphere/security/advisories/GHSA-qxx2-p3w2-w4r6
CVE ID: CVE-2024-36119 State: PUBLISHED Published: 2024-05-30T20:57:06.445Z Last Updated: 2024-08-02T03:30:12.952Z Severity: LOW (CVSS 1.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: statamic Products: cms Problem Types: CWE-312 Description: Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have their password confirmation stored in plain text in their user file. This only affects sites matching **all** of the following conditions: 1. Running Statamic versions between 5.3.0 and 5.6.1. (This version range represents only one calendar week), 2. Using the `user:register_form` tag. 3. U
een 5.3.0 and 5.6.1. (This version range represents only one calendar week), 2. Using the `user:register_form` tag. 3. Using file-based user accounts. (Does not affect users stored in a database.), 4. Has users that have registered during that time period. (Existing users are not affected.). Additionally passwords are only visible to users that have access to read user yaml files, typically developers of the application itself. This issue has been patched in version 5.6.2, however any users registered during that time period and using the affected version range will still have the the `password_confirmation` value in their yaml files. We recommend that affected users have their password rese
ave the the `password_confirmation` value in their yaml files. We recommend that affected users have their password reset. System administrators are advised to upgrade their deployments. There are no known workarounds for this vulnerability. Anyone who commits their files to a public git repo, may consider clearing the sensitive data from the git history as it is likely that passwords were uploaded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9 - https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e - https://dev.to/balogh08/cleaning-your-git-history-s
b.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e - https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5 - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository
CVE ID: CVE-2024-36120 State: PUBLISHED Published: 2024-05-31T16:29:14.773Z Last Updated: 2024-08-02T03:30:12.973Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ben-sb Products: javascript-deobfuscator Problem Types: CWE-94 Description: javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gi
lification feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ben-sb/javascript-deobfuscator/security/advisories/GHSA-9p6p-8v9r-8c9m - https://github.com/ben-sb/javascript-deobfuscator/commit/630d3caec83d5f31c5f7a07e6fadf613d06699d6
CVE ID: CVE-2024-36121 State: PUBLISHED Published: 2024-06-04T21:13:33.656Z Last Updated: 2024-08-06T18:58:19.539Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: netty Products: netty-incubator-codec-ohttp Problem Types: CWE-200, CWE-190, CWE-323 Description: netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which would allow an attacker to cause the sequence number to overflow and thus the nonce to repeat. Additional Anal
ine which would allow an attacker to cause the sequence number to overflow and thus the nonce to repeat. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-g762-h86w-8749 - https://github.com/netty/netty-incubator-codec-ohttp/blob/1ddadb6473cd3be5491d114431ed4c1a9f316001/codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAEADContext.java#L112-L114
CVE ID: CVE-2024-36122 State: PUBLISHED Published: 2024-07-03T19:10:45.955Z Last Updated: 2024-08-02T03:30:13.046Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses setting is disabled. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` bra
is issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. As possible workarounds, either prevent moderators from accessing the review queue or disable the approve suspect users site setting and the must approve users site setting to prevent users from being added to the review queue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-rr93-hcw4-cv3f - https://github.com/discourse/discourse/commit/8d5b21170efa4766e1a213ff07dc36d36cf3dfb4 - https://github.com/discourse/discourse/commit/e2a7265dba3d9e943338db21ca38c50276b22f4
0efa4766e1a213ff07dc36d36cf3dfb4 - https://github.com/discourse/discourse/commit/e2a7265dba3d9e943338db21ca38c50276b22f47
CVE ID: CVE-2024-36123 State: PUBLISHED Published: 2024-06-03T14:17:08.664Z Last Updated: 2024-08-02T03:30:13.034Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: StarCitizenTools Products: mediawiki-skins-Citizen Problem Types: CWE-79 Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0. Additional Analyst Notes: - CISA ADP Vulnrichment: -
ce` permission, or sysops). This vulnerability is fixed in 2.16.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-jhm6-qjhq-5mf9 - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/4a43280242f33e54643087da4a7f40970d2640c9 - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/c11fbf67a99366d5a40ef880469b222679e3b475/includes/Components/CitizenComponentPageHeading.php#L190-L195 - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/c11fbf67a99366d5a40ef880469b222679e3b475/includes/Components/CitizenComponentPageHeading.php#L19
wiki-skins-Citizen/blob/c11fbf67a99366d5a40ef880469b222679e3b475/includes/Components/CitizenComponentPageHeading.php#L197-L201 - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases
CVE ID: CVE-2024-36124 State: PUBLISHED Published: 2024-06-03T14:25:58.628Z Last Updated: 2024-09-05T14:44:12.984Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: dain Products: snappy Problem Types: CWE-125 Description: iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not activel
bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9