Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-21480 State: PUBLISHED Published: 2024-05-06T14:32:19.583Z Last Updated: 2024-08-01T22:20:40.887Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-120 Description: Memory corruption while playing audio file having large-sized input buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2024-bulletin.html
CVE ID: CVE-2024-21481 State: PUBLISHED Published: 2024-08-05T14:21:17.518Z Last Updated: 2024-08-15T03:55:39.689Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-119 Description: Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE ID: CVE-2024-21482 State: PUBLISHED Published: 2024-07-01T14:17:16.594Z Last Updated: 2024-08-01T22:20:40.623Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-119 Description: Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html
CVE ID: CVE-2024-21483 State: PUBLISHED Published: 2024-03-12T10:21:52.434Z Last Updated: 2025-04-15T15:27:19.384Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: SENTRON 7KM PAC3120 AC/DC, SENTRON 7KM PAC3120 DC, SENTRON 7KM PAC3220 AC/DC, SENTRON 7KM PAC3220 DC Problem Types: CWE-284 Description: A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with
KM3120-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)). The read out protection of the internal flash of affected devices was not properly set at the end of the manufacturing process. An attacker with physical access to the device could read out the data. Additional Analyst Notes: - CISA ADP Vu
process. An attacker with physical access to the device could read out the data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-792319.html
CVE ID: CVE-2024-21484 State: PUBLISHED Published: 2024-01-22T05:00:02.087Z Last Updated: 2024-10-21T10:56:23.141Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L/E:P) Vendors: n/a Products: jsrsasign, org.webjars.npm:jsrsasign, org.webjars.bowergithub.kjur:jsrsasign, org.webjars.bower:jsrsasign Problem Types: CWE-203 Description: Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key.
g this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-6070731 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6070732 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-6070733 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6070734 - https://github.com/kjur/jsrsasign/issues/598 - https://github.com/kjur/jsrsasign/releases/tag/11.0.
BJARSBOWER-6070734 - https://github.com/kjur/jsrsasign/issues/598 - https://github.com/kjur/jsrsasign/releases/tag/11.0.0 - https://people.redhat.com/~hkario/marvin/
CVE ID: CVE-2024-21485 State: PUBLISHED Published: 2024-02-02T05:00:01.368Z Last Updated: 2025-05-15T19:50:30.280Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N/E:P) Vendors: n/a Products: dash-core-components, dash, dash-html-components Problem Types: CWE-79 Description: Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated
are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server. **Note:** This is only exploitable in Dash apps that include some mechanism to store user input to be r
the same server. **Note:** This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-DASHCORECOMPONENTS-6183084 - https://security.snyk.io/vuln/SNYK-PYTHON-DASHCORECOMPONENTS-6226334 - https://security.snyk.io/vuln/SNYK-PYTHON-DASH-6226335 - https://security.snyk.io/vuln/SNYK-PYTHON-DASHHTMLCOMPONENTS-6226336 - https://security.snyk.io/vuln/SNYK-JS-DASHHTMLCOMPONENTS-6226337 - https://github.com/plotly/dash/issues/2729 - https://github.com/plotly/dash/pull/2732 - https://github.com/plotly/dash/releases/
github.com/plotly/dash/issues/2729 - https://github.com/plotly/dash/pull/2732 - https://github.com/plotly/dash/releases/tag/v2.15.0 - https://github.com/plotly/dash/commit/9920073c9a8619ae8f90fcec1924f2f3a4332a8c
CVE ID: CVE-2024-21488 State: PUBLISHED Published: 2024-01-30T05:00:01.547Z Last Updated: 2025-06-17T21:29:18.642Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: network Problem Types: CWE-77 Description: Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
he operating system that this package is being run on. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371 - https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c - https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5 - https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7 - https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7
CVE ID: CVE-2024-21489 State: PUBLISHED Published: 2024-10-01T05:00:02.644Z Last Updated: 2024-10-07T14:08:35.115Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P) Vendors: n/a Products: uplot Problem Types: CWE-1321 Description: Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224 - https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js%23L437-L452 - https://github.com/leeoniya/uPlot/
eoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js%23L437-L452 - https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983
CVE ID: CVE-2024-21490 State: PUBLISHED Published: 2024-02-10T05:00:01.641Z Last Updated: 2025-11-03T19:29:20.093Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: angular, org.webjars.bower:angular, org.webjars.npm:angular Problem Types: CWE-1333 Description: This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. User
nd cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747 - https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos
CVE ID: CVE-2024-21491 State: PUBLISHED Published: 2024-02-13T05:00:02.196Z Last Updated: 2025-05-09T18:25:35.884Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: n/a Products: svix Problem Types: CWE-288 Description: Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature. **Note:** The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that;
he attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729 - https://github.com/svix/svix-webhooks/pull/1190 - https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6 - https://rustsec.org/advisories/RUSTSEC-2024-0010.html
CVE ID: CVE-2024-21492 State: PUBLISHED Published: 2024-02-17T05:00:03.171Z Last Updated: 2024-12-06T18:30:09.279Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: github.com/greenpau/caddy-security Problem Types: CWE-613 Description: All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to /logout and /oauth2/google/logout. Attackers who gain access to an active but supposedly logged-out session can perform unauthorized actions on behalf of the user. Add
o gain access to an active but supposedly logged-out session can perform unauthorized actions on behalf of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5920787 - https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ - https://github.com/greenpau/caddy-security/issues/272
CVE ID: CVE-2024-21493 State: PUBLISHED Published: 2024-02-17T05:00:08.927Z Last Updated: 2024-08-01T22:20:40.991Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: github.com/greenpau/caddy-security Problem Types: CWE-129 Description: All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing functions in the affected library do not validate whether their input values are nil before attempting to access elements, which can lead to a panic (index out of range). Panics during the parsing of a configuration file may introduce ambiguity and vulner
ad to a panic (index out of range). Panics during the parsing of a configuration file may introduce ambiguity and vulnerabilities, hindering the correct interpretation and configuration of the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5961078 - https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ - https://github.com/greenpau/caddy-security/issues/263
CVE ID: CVE-2024-21494 State: PUBLISHED Published: 2024-02-17T05:00:07.518Z Last Updated: 2025-04-24T15:12:20.920Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: github.com/greenpau/caddy-security Problem Types: CWE-290 Description: All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improper input sanitization. An attacker can spoof an IP address used in the user identity module (/whoami API endpoint). This could lead to unauthorized access if the system trusts this spoofed IP address. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
unauthorized access if the system trusts this spoofed IP address. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249859 - https://github.com/greenpau/caddy-security/issues/266 - https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
CVE ID: CVE-2024-21495 State: PUBLISHED Published: 2024-02-17T05:00:08.241Z Last Updated: 2024-09-05T13:47:17.512Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: github.com/greenpau/caddy-security Problem Types: CWE-330 Description: Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used
for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275 - https://github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2 - https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ - https://github.com/greenpau/caddy-security/issues/265
CVE ID: CVE-2024-21496 State: PUBLISHED Published: 2024-02-17T05:00:02.407Z Last Updated: 2024-11-06T18:53:52.043Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: github.com/greenpau/caddy-security Problem Types: CWE-79 Description: All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], ["], [']), it does not account for the attack based on the JavaScript URL scheme (e.g., javascript:alert(document.domain)// payload). Exp
s not account for the attack based on the JavaScript URL scheme (e.g., javascript:alert(document.domain)// payload). Exploiting this vulnerability may not be trivial, but it could lead to the execution of malicious scripts in the context of the target user’s browser, compromising user sessions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249860 - https://github.com/greenpau/caddy-security/issues/267 - https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
CVE ID: CVE-2024-21497 State: PUBLISHED Published: 2024-02-17T05:00:04.298Z Last Updated: 2024-08-15T17:51:11.026Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: github.com/greenpau/caddy-security Problem Types: CWE-601 Description: All versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this vulnerability, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger
bility, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249861 - https://github.com/greenpau/caddy-security/issues/268 - https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
CVE ID: CVE-2024-21498 State: PUBLISHED Published: 2024-02-17T05:00:05.493Z Last Updated: 2024-08-01T22:20:40.839Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P) Vendors: n/a Products: github.com/greenpau/caddy-security Problem Types: CWE-918 Description: All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - h
ploiting this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249862 - https://github.com/greenpau/caddy-security/issues/269 - https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
CVE ID: CVE-2024-21499 State: PUBLISHED Published: 2024-02-17T05:00:06.256Z Last Updated: 2024-08-01T22:20:40.619Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P) Vendors: n/a Products: github.com/greenpau/caddy-security Problem Types: CWE-644 Description: All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of security mechanisms or confusion in handling TLS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLAN
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863 - https://github.com/greenpau/caddy-security/issues/270 - https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
CVE ID: CVE-2024-21500 State: PUBLISHED Published: 2024-02-17T05:00:06.899Z Last Updated: 2024-12-05T20:33:44.652Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: github.com/greenpau/caddy-security Problem Types: CWE-307 Description: All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication (2FA). Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this blocking mechanism by automating the application’s full multistep 2FA process. Additional Analyst Notes: - CVE Program
blocking mechanism by automating the application’s full multistep 2FA process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249864 - https://github.com/greenpau/caddy-security/issues/271 - https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
CVE ID: CVE-2024-21501 State: PUBLISHED Published: 2024-02-24T05:00:02.731Z Last Updated: 2025-02-13T17:33:15.082Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P) Vendors: n/a Products: sanitize-html, org.webjars.npm:sanitize-html Problem Types: CWE-200 Description: Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server. Additional Analyst Notes: - CVE Prog
er details about the file system structure and dependencies of the targeted server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 - https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf - https://github.com/apostrophecms/sanitize-html/pull/650 - https://github.com/apostrophecms/apostrophe/discussions/4436 - https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4B
4 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/