Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38308 State: PUBLISHED Published: 2024-09-27T17:28:34.284Z Last Updated: 2024-09-27T18:07:54.921Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: ADAM 5550 Problem Types: CWE-79 Description: Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user. The device doesn't correctly neutralize malicious code when parsing HTTP requests to generate page output. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-01
CVE ID: CVE-2024-38309 State: PUBLISHED Published: 2024-11-28T02:10:32.213Z Last Updated: 2024-11-29T20:52:09.295Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: V-SFT, TELLUS, TELLUS Lite Problem Types: CWE-121 Description: There are multiple stack-based buffer overflow vulnerabilities in V-SFT (v6.2.2.0 and earlier), TELLUS (v4.0.19.0 and earlier), and TELLUS Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU9
t: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU97531313/
CVE ID: CVE-2024-38310 State: PUBLISHED Published: 2025-02-12T21:18:48.842Z Last Updated: 2025-02-13T15:20:43.379Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Graphics Driver software installers Problem Types: Escalation of Privilege, CWE-284 Description: Improper access control in some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01235.html
CVE ID: CVE-2024-38311 State: PUBLISHED Published: 2025-03-06T11:34:16.289Z Last Updated: 2025-03-06T15:35:49.759Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l1819x01023
CVE ID: CVE-2024-38312 State: PUBLISHED Published: 2024-06-13T20:01:13.543Z Last Updated: 2025-03-19T14:17:43.824Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Private tabs could result in residual data related to browsing history in app bundle Description: When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This vulnerability affects Firefox for iOS < 127. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1878578 - https://www.mozilla.org/security/advisories/mfsa2024-27/
CVE ID: CVE-2024-38313 State: PUBLISHED Published: 2024-06-13T20:01:13.281Z Last Updated: 2025-03-14T15:50:21.911Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Location URL bar could be visually spoofed with a fake toolbar Description: In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects Firefox for iOS < 127. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1878489 - https://www.mozilla.org/security/advisories/mfsa2024-27/
CVE ID: CVE-2024-38314 State: PUBLISHED Published: 2024-10-24T17:23:06.127Z Last Updated: 2024-10-24T19:43:18.678Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Maximo Application Suite - Monitor Component Problem Types: CWE-321 Description: IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173988
CVE ID: CVE-2024-38315 State: PUBLISHED Published: 2024-09-16T15:05:49.347Z Last Updated: 2024-09-16T15:16:30.485Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Aspera Shares Problem Types: CWE-613 Description: IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7168379 - https://exchange.xforce.ibmcloud.com/vulnerabilities/294742
CVE ID: CVE-2024-38316 State: PUBLISHED Published: 2025-02-05T22:30:35.881Z Last Updated: 2025-02-22T20:55:15.673Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: IBM Products: Aspera Shares Problem Types: CWE-770 Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182490
CVE ID: CVE-2024-38317 State: PUBLISHED Published: 2025-02-05T22:43:49.501Z Last Updated: 2025-02-22T20:55:52.211Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Aspera Shares Problem Types: CWE-79 Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182490
CVE ID: CVE-2024-38318 State: PUBLISHED Published: 2025-02-05T22:49:18.237Z Last Updated: 2025-02-22T20:56:28.409Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Aspera Shares Problem Types: CWE-80 Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182490
CVE ID: CVE-2024-38319 State: PUBLISHED Published: 2024-06-22T18:56:34.854Z Last Updated: 2024-08-02T04:04:25.264Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security SOAR Problem Types: CWE-94 Description: IBM Security SOAR 51.0.2.0 could allow an authenticated user to execute malicious code loaded from a specially crafted script. IBM X-Force ID: 294830. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158261 - https://exchange.xforce.ibmcloud.com/vulnerabilities/294830
CVE ID: CVE-2024-38320 State: PUBLISHED Published: 2025-01-27T15:43:06.712Z Last Updated: 2025-01-27T17:58:26.315Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Protect for Virtual Environments: Data Protection for VMware, Storage Protect Backup-Archive Client Problem Types: CWE-327 Description: IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8.1.0.0 through 8.1.23.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com
crypt highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173465 - https://www.ibm.com/support/pages/node/7173462
CVE ID: CVE-2024-38321 State: PUBLISHED Published: 2024-08-03T13:34:16.845Z Last Updated: 2024-08-03T18:49:24.893Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Business Automation Workflow Problem Types: CWE-532 Description: IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7162334 - https://exchange.xforce.ibmcloud.com/vulnerabilities/294868
CVE ID: CVE-2024-38322 State: PUBLISHED Published: 2024-06-28T18:34:40.769Z Last Updated: 2024-08-02T04:04:25.244Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Defender - Resiliency Service Problem Types: CWE-204 Description: IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158446 - https://exchange.xforce.ibmcloud.com/vulnerabilities/294869
CVE ID: CVE-2024-38324 State: PUBLISHED Published: 2024-09-24T10:24:43.447Z Last Updated: 2024-09-24T13:48:52.386Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Defender - Resiliency Service Problem Types: CWE-297 Description: IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an attacker with access to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7168640
CVE ID: CVE-2024-38325 State: PUBLISHED Published: 2025-01-27T15:27:18.934Z Last Updated: 2025-01-27T15:40:30.461Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Defender - Resiliency Service Problem Types: CWE-311 Description: IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI could allow a remote attacker to obtain sensitive information, caused by sending network requests over an insecure channel. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7
le techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7168640
CVE ID: CVE-2024-38327 State: PUBLISHED Published: 2025-07-10T14:14:40.562Z Last Updated: 2025-08-18T01:35:53.589Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Analytics Content Hub Problem Types: CWE-540 Description: IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 is vulnerable to information exposure and further attacks due to an exposed JavaScript source map which could assist an attacker to read and debug JavaScript used in the application's API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234122
CVE ID: CVE-2024-38329 State: PUBLISHED Published: 2024-06-19T13:43:41.191Z Last Updated: 2024-08-03T11:22:42.851Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: IBM Products: Storage Protect for Virtual Environments: Data Protection for VMware Problem Types: CWE-863 Description: IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this vulnerability to change its settings, trigger backups, restore backups, and also delete al
n attacker could exploit this vulnerability to change its settings, trigger backups, restore backups, and also delete all previous backups via log rotation. IBM X-Force ID: 294994. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7157929 - https://exchange.xforce.ibmcloud.com/vulnerabilities/294994
CVE ID: CVE-2024-38330 State: PUBLISHED Published: 2024-07-08T01:12:50.812Z Last Updated: 2024-08-02T04:04:25.398Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: i Problem Types: CWE-427 Description: IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 295227. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7159615 - https://exchange.xforce.ibmcloud.com/vulnerabilities/295227
CVE ID: CVE-2024-38335 State: PUBLISHED Published: 2025-07-22T17:13:15.250Z Last Updated: 2025-08-18T01:32:02.108Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Security QRadar Network Threat Analytics Problem Types: CWE-770 Description: IBM Security QRadar Network Threat Analytics 1.0.0 through 1.3.1 could allow a privileged user to cause a denial of service due to improper allocation of resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240244
CVE ID: CVE-2024-38337 State: PUBLISHED Published: 2025-01-19T14:56:18.995Z Last Updated: 2025-01-21T15:06:33.565Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: IBM Products: Sterling Secure Proxy Problem Types: CWE-732 Description: IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow an unauthorized attacker to retrieve or alter sensitive information contents due to incorrect permission assignments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179166
CVE ID: CVE-2024-38341 State: PUBLISHED Published: 2025-05-28T15:21:00.248Z Last Updated: 2025-08-16T23:41:17.022Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Sterling Secure Proxy Problem Types: CWE-328 Description: IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234888
CVE ID: CVE-2024-38344 State: PUBLISHED Published: 2024-07-04T00:18:52.631Z Last Updated: 2024-12-06T18:09:06.902Z Vendors: Sola Plugins Products: WP Tweet Walls Problem Types: Cross-site request forgery (CSRF) Description: A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/wp-tweet-walls/ - https
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/wp-tweet-walls/ - https://jvn.jp/en/jp/JVN34977158/
CVE ID: CVE-2024-38345 State: PUBLISHED Published: 2024-07-04T00:19:15.326Z Last Updated: 2025-03-13T14:13:02.793Z Vendors: Sola Plugins Products: Sola Testimonials Problem Types: Cross-site request forgery (CSRF) Description: A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/sola-testimonials
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/sola-testimonials/ - https://jvn.jp/en/jp/JVN34977158/
CVE ID: CVE-2024-38346 State: PUBLISHED Published: 2024-07-05T13:40:57.246Z Last Updated: 2025-02-13T17:53:05.631Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-94 Description: The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code execution via agents on the hosts that may run as a privileged user. An attacker that can reach the cluster service on the unauthenticated port (default 9090), can exploit this to perform rem
attacker that can reach the cluster service on the unauthenticated port (default 9090), can exploit this to perform remote code execution on CloudStack managed hosts and result in complete compromise of the confidentiality, integrity, and availability of CloudStack managed infrastructure. Users are recommended to restrict the network access to the cluster service port (default 9090) on a CloudStack management server host to only its peer CloudStack management server hosts. Users are recommended to upgrade to version 4.18.2.1, 4.19.0.2 or later, which addresses this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/threa
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/6l51r00csrct61plkyd3qg3fj99215d1 - https://cloudstack.apache.org/blog/security-release-advisory-4.19.0.2-4.18.2.1 - https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-1-and-4-19-0-2/ - http://www.openwall.com/lists/oss-security/2024/07/05/1
CVE ID: CVE-2024-38347 State: PUBLISHED Published: 2024-06-18T00:00:00 Last Updated: 2024-08-02T04:04:25.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Room Information module via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://code-projects.org/health-care-hospital-in-php-css-js-and-mysql-free-download/ - https://github.com/SandeepRajauriya/CVEs/blob/main/CVE-2024-38347
CVE ID: CVE-2024-38348 State: PUBLISHED Published: 2024-06-18T00:00:00 Last Updated: 2024-08-02T04:04:25.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Staff Info module via the searvalu parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://code-projects.org/health-care-hospital-in-php-css-js-and-mysql-free-download/ - https://github.com/SandeepRajauriya/CVEs/blob/main/CVE-2024-38348
CVE ID: CVE-2024-38351 State: PUBLISHED Published: 2024-06-18T17:00:38.595Z Last Updated: 2024-08-02T04:04:25.276Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: pocketbase Products: pocketbase Problem Types: CWE-287 Description: Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register with the targeted user's email (it is unverified), 2. at some later point in time the targeted user stumble on your app and decides to sign
ser's email (it is unverified), 2. at some later point in time the targeted user stumble on your app and decides to sign-up with OAuth2 (_this step could be also initiated by the attacker by sending an invite email to the targeted user_), 3. on successful OAuth2 auth we search for an existing PocketBase user matching with the OAuth2 user's email and associate them, 4. because we haven't changed the password of the existing PocketBase user during the linking, the malicious actor has access to the targeted user account and will be able to login with the initially created email/password. To prevent this for happening we now reset the password for this specific case if the previously created use
l/password. To prevent this for happening we now reset the password for this specific case if the previously created user wasn't verified (an exception to this is if the linking is explicit/manual, aka. when you send `Authorization:TOKEN` with the OAuth2 auth call). Additionally to warn existing users we now send an email alert in case the user has logged in with password but has at least one OAuth2 account linked. The flow will be further improved with ongoing refactoring and we will start sending emails for "unrecognized device" logins (OTP and MFA is already implemented and will be available with the next v0.23.0 release in the near future). For the time being users are advised to update
and will be available with the next v0.23.0 release in the near future). For the time being users are advised to update to version 0.22.14. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pocketbase/pocketbase/security/advisories/GHSA-m93w-4fxv-r35v - https://github.com/pocketbase/pocketbase/discussions/4355
CVE ID: CVE-2024-38352 State: REJECTED Published: N/A Last Updated: 2024-06-19T17:59:44.037Z Description: No description available.
CVE ID: CVE-2024-38353 State: PUBLISHED Published: 2024-07-10T19:50:05.935Z Last Updated: 2024-08-02T04:04:25.209Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: hackmdio Products: codimd Problem Types: CWE-338, CWE-862 Description: CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access t
images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased. This vulnerability is fixed in 2.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/hackmdio/codimd/security/advisories/GHSA-2764-jppc-p2hm