Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3. This issue affects Apache Roller: from 5.0.0 before 6.1.3. Users are recommended to upgrade to version 6.1.3, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/lb50jqyxwf8jrfpydl6dc5zpqtpgrrwd
CVE ID: CVE-2024-25091 State: PUBLISHED Published: 2024-03-01T08:59:12.827Z Last Updated: 2024-08-05T18:52:12.867Z Vendors: J's Communications Co., Ltd. Products: RevoWorks SCVX, RevoWorks Browser Problem Types: Protection Mechanism Failure Description: Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks Browser prior to 2.2.95 (when using 'VirusChecker' or 'ThreatChecker' feature). If data containing malware is saved in a specific file format (eml, dmg, vhd, iso, msi), malware may be taken outside the sandboxed environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP
, malware may be taken outside the sandboxed environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jscom.jp/news-20240229/ - https://jvn.jp/en/jp/JVN35928117/
CVE ID: CVE-2024-25092 State: PUBLISHED Published: 2024-06-09T10:28:39.912Z Last Updated: 2024-08-09T19:42:16.495Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: XLPlugins Products: NextMove Lite Problem Types: CWE-862 Description: Missing Authorization vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.17.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-thank-you-page-nextmove-lite/wordpress-nextmove-lite-plugin-2-17-0-subscriber-arbitrary-plugin-installation-activation-vulnerability?_s_id=cve
CVE ID: CVE-2024-25093 State: PUBLISHED Published: 2024-02-29T05:43:28.496Z Last Updated: 2024-08-01T23:36:21.265Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Milan Petrovic Products: GD Rating System Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Rating System allows Stored XSS.This issue affects GD Rating System: from n/a through 3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/gd-rating-system/wordpress-gd-rating-system-plugin-3-5-unauthenticated-stored-cro
/patchstack.com/database/vulnerability/gd-rating-system/wordpress-gd-rating-system-plugin-3-5-unauthenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25094 State: PUBLISHED Published: 2024-02-29T06:02:51.394Z Last Updated: 2024-08-01T23:36:21.633Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Paul Jura & Nicolas Montigny Products: PJ News Ticker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Jura & Nicolas Montigny PJ News Ticker allows Stored XSS.This issue affects PJ News Ticker: from n/a through 1.9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/pj-news-ticker/wordpress-pj-news-ticker-plugin-1-9-5-cr
ner: References: - https://patchstack.com/database/vulnerability/pj-news-ticker/wordpress-pj-news-ticker-plugin-1-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25095 State: PUBLISHED Published: 2024-06-04T18:37:50.250Z Last Updated: 2024-08-01T23:36:21.634Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Code Parrots Products: Easy Forms for Mailchimp Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/yikes-inc-easy-mailchimp-extender/wordpress-easy-forms-for-mailchimp-plugin-6-8-10-sensitive-data-exposure-via-l
ability/yikes-inc-easy-mailchimp-extender/wordpress-easy-forms-for-mailchimp-plugin-6-8-10-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2024-25096 State: PUBLISHED Published: 2024-04-03T12:18:29.902Z Last Updated: 2024-08-01T23:36:21.597Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Canto Inc. Products: Canto Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-6-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2024-25097 State: PUBLISHED Published: 2024-03-13T15:58:36.703Z Last Updated: 2024-08-01T23:36:21.578Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemeNcode LLC Products: TNC PDF viewer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issue affects TNC PDF viewer: from n/a through 2.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/pdf-viewer-by-themencode/wordpress-tnc-pdf-viewer-plugin-2-8-0-cross-site-scripting
atchstack.com/database/vulnerability/pdf-viewer-by-themencode/wordpress-tnc-pdf-viewer-plugin-2-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25098 State: PUBLISHED Published: 2024-02-29T06:07:25.365Z Last Updated: 2024-08-01T23:36:21.404Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Pascal Bajorat Products: PB oEmbed HTML5 Audio – with Cache Support Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB oEmbed HTML5 Audio – with Cache Support allows Stored XSS.This issue affects PB oEmbed HTML5 Audio – with Cache Support: from n/a through 2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/p
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/pb-oembed-html5-audio-with-cache-support/wordpress-pb-oembed-html5-audio-plugin-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25099 State: PUBLISHED Published: 2024-03-13T16:02:20.549Z Last Updated: 2024-08-01T23:36:21.640Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: David de Boer Products: Paytium: Mollie payment forms & donations Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David de Boer Paytium: Mollie payment forms & donations allows Stored XSS.This issue affects Paytium: Mollie payment forms & donations: from n/a through 4.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/payt
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/paytium/wordpress-paytium-mollie-payment-forms-donations-plugin-4-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25100 State: PUBLISHED Published: 2024-02-12T07:04:34.123Z Last Updated: 2025-09-08T09:52:43.888Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: WP Swings Products: Coupon Referral Program Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program allows Object Injection.This issue affects Coupon Referral Program: from n/a before 1.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/wordpress/plugin/coupon-referral-program/vulnerability/wordpress-coupon-referral-program-plugin-1-7-2-unauthenticated-php-ob
press/plugin/coupon-referral-program/vulnerability/wordpress-coupon-referral-program-plugin-1-7-2-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-25101 State: PUBLISHED Published: 2024-03-13T16:05:16.975Z Last Updated: 2024-08-01T23:36:21.590Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: yonifre Products: Maspik – Spam Blacklist Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik – Spam Blacklist allows Stored XSS.This issue affects Maspik – Spam Blacklist: from n/a through 0.10.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-10-6
s: - https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-10-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25102 State: PUBLISHED Published: 2024-03-06T11:34:42.570Z Last Updated: 2024-09-23T11:17:20.089Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CDAC Products: AppSamvid Software Problem Types: CWE-326 Description: This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. An attacker with local administrative privileges could exploit this to obtain the password of AppSamvid on the targeted system. Successful exploitation of this vulnerability could allow the attacker to take complete control of the application on the targeted system. Additional Analyst Notes: - CI
ld allow the attacker to take complete control of the application on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0081
CVE ID: CVE-2024-25103 State: PUBLISHED Published: 2024-03-06T11:42:58.575Z Last Updated: 2024-09-23T11:19:05.925Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: CDAC Products: AppSamvid Software Problem Types: CWE-426 Description: This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could exploit this by placing malicious DLLs on the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on the targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
code on the targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0081
CVE ID: CVE-2024-25106 State: PUBLISHED Published: 2024-02-08T23:05:46.143Z Last Updated: 2024-08-01T23:36:21.580Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: openobserve Products: openobserve Problem Types: CWE-284, CWE-272, CWE-269, CWE-285, CWE-287 Description: OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any authenticated user within an organization to remove any other user from that same organization, irrespective of their respective roles. T
r within an organization to remove any other user from that same organization, irrespective of their respective roles. This includes the ability to remove users with "Admin" and "Root" roles. By enabling any organizational member to unilaterally alter the user base, it opens the door to unauthorized access and can cause considerable disruptions in operations. The core of the vulnerability lies in the `remove_user_from_org` function in the user management system. This function is designed to allow organizational users to remove members from their organization. The function does not check if the user initiating the request has the appropriate administrative privileges to remove a user. Any use
oes not check if the user initiating the request has the appropriate administrative privileges to remove a user. Any user who is part of the organization, irrespective of their role, can remove any other user, including those with higher privileges. This vulnerability is categorized as an Authorization issue leading to Unauthorized User Removal. The impact is severe, as it compromises the integrity of user management within organizations. By exploiting this vulnerability, any user within an organization, without the need for administrative privileges, can remove critical users, including "Admins" and "Root" users. This could result in unauthorized system access, administrative lockout, or op
ers, including "Admins" and "Root" users. This could result in unauthorized system access, administrative lockout, or operational disruptions. Given that user accounts are typically created by "Admins" or "Root" users, this vulnerability can be exploited by any user who has been granted access to an organization, thereby posing a critical risk to the security and operational stability of the application. This issue has been addressed in release version 0.8.0. Users are advised to upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/openobserve/openobserve/security/advisories/GHSA-3m5f-9m66-xgp7
CVE ID: CVE-2024-25107 State: PUBLISHED Published: 2024-02-08T22:46:39.144Z Last Updated: 2025-06-17T21:29:29.418Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: miraheze Products: WikiDiscover Problem Types: CWE-79 Description: WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used when making the human-readable timestamp for inclusion on the wiki_creation column. This function uses interface messages to translate the names of months and days. It uses the `->text()` output mode, returning unescaped interface messages. Since the output is not escaped later
days. It uses the `->text()` output mode, returning unescaped interface messages. Since the output is not escaped later, the unescaped interface message is included on the output, resulting in an XSS vulnerability. Exploiting this on-wiki requires the `(editinterface)` right. This vulnerability has been addressed in commit `267e763a0`. Users are advised to update their installations. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/miraheze/WikiDiscover/security/advisories/GHSA-cfcf-94jv-455f - https://github.com/miraheze/WikiDiscover/commit/267e763a0d7460f001693c42f67717a0fc3f
ty/advisories/GHSA-cfcf-94jv-455f - https://github.com/miraheze/WikiDiscover/commit/267e763a0d7460f001693c42f67717a0fc3fd6bb - https://issue-tracker.miraheze.org/T11814
CVE ID: CVE-2024-25108 State: PUBLISHED Published: 2024-02-12T20:05:23.549Z Last Updated: 2025-05-07T21:03:35.510Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: pixelfed Products: pixelfed Problem Types: CWE-280, CWE-285, CWE-863 Description: Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerabi
erability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pixelfed/pixelfed/security/advisories/GHSA-gccq-h3xj-jgvf - https://github.com/pixelfed/pixelfed/commit/7e47d6dccb0393a2e95c42813c562c854882b037
CVE ID: CVE-2024-25109 State: PUBLISHED Published: 2024-02-09T22:25:48.347Z Last Updated: 2024-08-01T23:36:21.701Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: miraheze Products: ManageWiki Problem Types: CWE-79 Description: ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vu
ce)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/miraheze/ManageWiki/security/advisories/GHSA-4jr2-jhfm-2r84 - https://github.com/miraheze/ManageWiki/commit/2ef0f50880d7695ca2874dc8dd515b2b9bbb02e5 - https://github.com/miraheze/ManageWiki/commit/6942e8b2c01dc33c2c41a471f91ef3f6ca726073 - https://github.com/miraheze/ManageWiki/commit/886cc6b94587f1c7387caa26ca9fe612e01836a0 - https://issue-tracker.miraheze.org/T11812
CVE ID: CVE-2024-25110 State: PUBLISHED Published: 2024-02-12T19:58:36.362Z Last Updated: 2024-11-07T19:12:40.403Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Azure Products: azure-uamqp-c Problem Types: CWE-94 Description: The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CIS
865c9c`. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-c646-4whf-r67v - https://github.com/Azure/azure-uamqp-c/commit/30865c9ccedaa32ddb036e87a8ebb52c3f18f695
CVE ID: CVE-2024-25111 State: PUBLISHED Published: 2024-03-06T18:14:28.889Z Last Updated: 2025-11-03T20:36:53.752Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: squid-cache Products: squid Problem Types: CWE-674 Description: Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be fou
This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc - http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ - https://security.net
/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ - https://security.netapp.com/advisory/ntap-20240605-0001/
CVE ID: CVE-2024-25112 State: PUBLISHED Published: 2024-02-12T22:11:13.693Z Last Updated: 2024-08-01T23:36:21.619Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-400, CWE-674 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function, `QuickTimeVideo::multipleEntriesDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The denial-of-service is triggered when Exiv2
`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted video file. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-crmj-qh74-2r36 - https://github.com/Exiv2/exiv2/pull/2337
CVE ID: CVE-2024-25113 State: REJECTED Published: N/A Last Updated: 2024-02-17T21:56:53.393Z Description: No description available.
CVE ID: CVE-2024-25114 State: PUBLISHED Published: 2024-03-11T21:32:12.513Z Last Updated: 2025-04-16T15:43:32.209Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: CollaboraOnline Products: online Problem Types: CWE-200 Description: Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "Kit" instance in a different "jail" with a unique directory "jailID" name. For security reasons, this directory name is randomly generated and should not be given out to the client. In affected versions of Collabora Online it is possible to use the CELL() function, with the "filename" arg
the client. In affected versions of Collabora Online it is possible to use the CELL() function, with the "filename" argument, in the spreadsheet component to get a path which includes this JailID. The impact of this vulnerability in its own is low because it requires to be chained with another vulnerability. Users should upgrade to Collabora Online 23.05.9; Collabora Online 22.05.22; Collabora Online 21.11.10 or higher. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CollaboraOnline/online/security/advisories/GHSA-2fh2-ppjf-p3xv - https://github.com/LibreOffice/online/blob/mas
thub.com/CollaboraOnline/online/security/advisories/GHSA-2fh2-ppjf-p3xv - https://github.com/LibreOffice/online/blob/master/wsd/README