Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-34704 State: PUBLISHED Published: 2024-05-13T19:13:27.510Z Last Updated: 2024-08-02T02:59:21.780Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: matter-labs Products: era-compiler-solidity Problem Types: CWE-682 Description: era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the `DAGCombine` phase while visiting the XOR operation. The issue arises when attempting to fold the expression `!(x cc y)` into `(x !cc y)`. To perform this transformation, the second operand of XOR should be a constant representing the true value. However, it was incorrectly assumed that -1 represents the t
nd of XOR should be a constant representing the true value. However, it was incorrectly assumed that -1 represents the true value, when in fact, 1 is the correct representation, so this transformation for this case should be skipped. This vulnerability is fixed in 1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/matter-labs/era-compiler-solidity/security/advisories/GHSA-22pj-7cvw-r3gc
CVE ID: CVE-2024-34706 State: PUBLISHED Published: 2024-05-13T16:02:28.694Z Last Updated: 2024-08-02T02:59:21.978Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: valtimo-platform Products: valtimo-frontend-libraries Problem Types: CWE-532 Description: Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io c
sts to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component. The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the `api.form.io` domain; the content of the `x-jwt-token` header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes. Versions 10.8.4, 11.1.6 and 11.2.2 have been patched. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - h
nd 11.2.2 have been patched. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r - https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/1aaba5ef5750dafebbc7476fb08bf2375a25f19e - https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/8c2dbf2a41180d2b0358d878290e4d37168f0fb6 - https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/d65e05fd2784bd4a628778b34a5b79ce2f0cef8c
CVE ID: CVE-2024-34707 State: PUBLISHED Published: 2024-05-13T19:22:41.202Z Last Updated: 2024-08-02T02:59:22.584Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L) Vendors: nautobot Products: nautobot Problem Types: CWE-79 Description: Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported tha
ttom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3 - https://github.com/nautobot/nautobot/pull/5697 - https://github.com/nautobot/nautobot/pull/5698 - https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c
.com/nautobot/nautobot/pull/5698 - https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c - https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423
CVE ID: CVE-2024-34708 State: PUBLISHED Published: 2024-05-13T19:33:55.305Z Last Updated: 2024-08-02T02:59:21.863Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-200 Description: Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redacted fields will return `**********` however if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field. This can be avoide
request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field. This can be avoided by removing permission to view the sensitive fields entirely from users or roles that should not be able to see them. This vulnerability is fixed in 10.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx - https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b
CVE ID: CVE-2024-34709 State: PUBLISHED Published: 2024-05-13T19:39:32.313Z Last Updated: 2024-08-02T02:59:22.093Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: directus Products: directus Problem Types: CWE-613 Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry time which is set to 1 day by default. Making it effectively a long lived unrevokable st
till work for the entire expiry time which is set to 1 day by default. Making it effectively a long lived unrevokable stateless token instead of the stateful session token it was meant to be. This vulnerability is fixed in 10.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/directus/directus/security/advisories/GHSA-g65h-35f3-x2w3 - https://github.com/directus/directus/commit/a6172f8a6a0f31a6bf4305a090de172ebfb63bcf
CVE ID: CVE-2024-34710 State: PUBLISHED Published: 2024-05-20T21:59:16.606Z Last Updated: 2024-08-02T02:59:22.635Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: requarks Products: wiki Problem Types: CWE-1336 Description: Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303. Additional Analyst Notes: - CISA
a template injection payload on the next line. This vulnerability is fixed in 2.5.303. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/requarks/wiki/security/advisories/GHSA-xjcj-p2qv-q3rf - https://github.com/requarks/wiki/commit/1238d614e1599fefadd4614ee4b5797a087f50ac
CVE ID: CVE-2024-34711 State: PUBLISHED Published: 2025-06-10T14:33:18.872Z Last Updated: 2025-06-10T15:08:27.117Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: geoserver Products: geoserver Problem Types: CWE-200, CWE-611, CWE-918 Description: GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP server. By default, GeoServer use PreventLocalEntityResolver class from GeoTools to filter out malicious URIs in XML entities before resolving them. The URI must
ocalEntityResolver class from GeoTools to filter out malicious URIs in XML entities before resolving them. The URI must match the regex (?i)(jar:file|http|vfs)[^?#;]*\\.xsd. But the regex leaves a chance for attackers to request to any HTTP server or limited file. Attacker can abuse this to scan internal networks and gain information about them then exploit further. GeoServer 2.25.0 and greater default to the use of ENTITY_RESOLUTION_ALLOWLIST and does not require you to provide a system property. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965 - https://docs.geoserver.org/latest/en/user/productio
ub.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965 - https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities
CVE ID: CVE-2024-34712 State: PUBLISHED Published: 2024-05-14T14:32:06.577Z Last Updated: 2024-08-02T02:59:22.230Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: OceanicJS Products: Oceanic Problem Types: CWE-23, CWE-22 Description: Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBan` is not url-encoded, resulting in specially crafted input such as `../../../channels/{id}` being normalized into the url `/api/v10/channels/{id}`, and deleting a channel rather than removing a ban. Version 1.10.4 fixes this issue. Some workarounds are available. One may sanitize user input
rather than removing a ban. Version 1.10.4 fixes this issue. Some workarounds are available. One may sanitize user input, ensuring strings are valid for the purpose they are being used for. One may also encode input with `encodeURIComponent` before providing it to the library. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OceanicJS/Oceanic/security/advisories/GHSA-5h5v-hw44-f6gg - https://github.com/OceanicJS/Oceanic/commit/8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe
CVE ID: CVE-2024-34713 State: PUBLISHED Published: 2024-05-14T14:38:24.770Z Last Updated: 2024-08-02T02:59:21.984Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: cea-hpc Products: sshproxy Problem Types: CWE-77 Description: sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but i
is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh - https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580
CVE ID: CVE-2024-34714 State: PUBLISHED Published: 2024-05-14T14:48:36.879Z Last Updated: 2024-08-02T02:59:22.606Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: hoppscotch Products: hoppscotch-extension Problem Types: CWE-354 Description: The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem. Due to an oversight during a change made to the extension in the commit d4e8e4830326f46ba17acd1307977ecd32a85b58, a critical check for the origin list was missed and allowed for messages to be sent to the extension which the extension gladly processed and responded back with the result
allowed for messages to be sent to the extension which the extension gladly processed and responded back with the results of, while this wasn't supposed to happen and be blocked by the origin not being present in the origin list. This vulnerability exposes Hoppscotch Extension users to sites which call into Hoppscotch Extension APIs internally. This fundamentally allows any site running on the browser with the extension installed to bypass CORS restrictions if the user is running extensions with the given version. This security hole was patched in the commit 7e364b928ab722dc682d0fcad713a96cc38477d6 which was released along with the extension version `0.35`. As a workaround, Chrome users can
c682d0fcad713a96cc38477d6 which was released along with the extension version `0.35`. As a workaround, Chrome users can use the Extensions Settings to disable the extension access to only the origins that you want. Firefox doesn't have an alternative to upgrading to a fixed version. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/hoppscotch/hoppscotch-extension/security/advisories/GHSA-jjh5-pvqx-gg5v - https://github.com/hoppscotch/hoppscotch-extension/commit/7e364b928ab722dc682d0fcad713a96cc38477d6 - https://github.com/hoppscotch/hoppscotch-extension/commit/d4e8e4830326f46ba17acd1307977ecd32a85b58 - https://server.yadhu.in/poc/hop
ub.com/hoppscotch/hoppscotch-extension/commit/d4e8e4830326f46ba17acd1307977ecd32a85b58 - https://server.yadhu.in/poc/hoppscotch-poc.html
CVE ID: CVE-2024-34715 State: PUBLISHED Published: 2024-05-29T16:35:46.375Z Last Updated: 2024-08-02T02:59:22.619Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: ethyca Products: fides Problem Types: CWE-532, CWE-116 Description: Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as `@` and `$`, webserver startup fails and the part of the password following the special character is exposed in webserver error logs. This is caused by improper es
e part of the password following the special character is exposed in webserver error logs. This is caused by improper escaping of the SQLAlchemy password string. As a result users are subject to a partial exposure of hosted database password in webserver logs. The vulnerability has been patched in Fides version `2.37.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ethyca/fides/security/advisories/GHSA-8cm5-jfj2-26q7 - https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b
b.com/ethyca/fides/security/advisories/GHSA-8cm5-jfj2-26q7 - https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b706a82f78e061086141c - https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords - https://github.com/sqlalchemy/sqlalchemy/discussions/6615
CVE ID: CVE-2024-34716 State: PUBLISHED Published: 2024-05-14T15:45:45.345Z Last Updated: 2024-08-02T02:59:22.218Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the
fice contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78 - https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
CVE ID: CVE-2024-34717 State: PUBLISHED Published: 2024-05-14T15:47:27.265Z Last Updated: 2024-08-02T02:59:22.270Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-200 Description: PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-7pj
lnrichment: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-7pjr-2rgh-fc5g - https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
CVE ID: CVE-2024-34719 State: PUBLISHED Published: 2024-11-13T17:13:19.624Z Last Updated: 2024-12-04T04:55:39.167Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b0e4375577ba7e21bd40edac5990bea418ecdc8c - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-34720 State: PUBLISHED Published: 2024-07-09T20:11:27.923Z Last Updated: 2024-08-02T02:59:22.237Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp, there is a possible method to perform arbitrary code execution in any app zygote processes due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.goo
loitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/293e9ac230851acbec73f5ab12928d113d6283e1 - https://source.android.com/security/bulletin/2024-07-01
CVE ID: CVE-2024-34721 State: PUBLISHED Published: 2024-07-09T20:11:28.009Z Last Updated: 2024-11-05T21:10:10.801Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/providers/MediaProvider/+/7a1cbf5a8e17e6bff7c835fdd30dcc42b681db0a - https
://android.googlesource.com/platform/packages/providers/MediaProvider/+/7a1cbf5a8e17e6bff7c835fdd30dcc42b681db0a - https://source.android.com/security/bulletin/2024-07-01
CVE ID: CVE-2024-34722 State: PUBLISHED Published: 2024-07-09T20:11:28.095Z Last Updated: 2025-01-21T23:04:42.418Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2025-01-01
CVE ID: CVE-2024-34723 State: PUBLISHED Published: 2024-07-09T20:11:28.186Z Last Updated: 2024-08-02T02:59:22.588Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/c702bb71811993960debe0c18fcf8834cfa2454f -
r: References: - https://android.googlesource.com/platform/frameworks/base/+/c702bb71811993960debe0c18fcf8834cfa2454f - https://source.android.com/security/bulletin/2024-07-01
CVE ID: CVE-2024-34724 State: PUBLISHED Published: 2024-07-09T20:11:28.274Z Last Updated: 2024-10-25T17:31:42.428Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In _UnrefAndMaybeDestroy of pmr.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2024-07-01
CVE ID: CVE-2024-34725 State: PUBLISHED Published: 2024-07-09T20:11:28.354Z Last Updated: 2024-08-02T02:59:21.787Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2024-07-01
CVE ID: CVE-2024-34726 State: PUBLISHED Published: 2024-07-09T20:11:28.444Z Last Updated: 2024-08-02T02:59:22.602Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2024-07-01