Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45564 State: PUBLISHED Published: 2025-05-06T08:31:57.537Z Last Updated: 2025-05-07T03:55:44.729Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption during concurrent access to server info object due to incorrect reference count update. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45565 State: PUBLISHED Published: 2025-05-06T08:31:58.778Z Last Updated: 2025-05-07T03:55:47.625Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-367 Description: Memory corruption when blob structure is modified by user-space after kernel verification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45566 State: PUBLISHED Published: 2025-05-06T08:31:59.981Z Last Updated: 2025-05-07T03:55:49.482Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption during concurrent buffer access due to modification of the reference count. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45567 State: PUBLISHED Published: 2025-05-06T08:32:01.269Z Last Updated: 2025-05-07T03:55:51.423Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while encoding JPEG format. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45568 State: PUBLISHED Published: 2025-05-06T08:32:02.561Z Last Updated: 2025-05-07T03:55:54.144Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Memory corruption due to improper bounds check while command handling in camera-kernel driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45569 State: PUBLISHED Published: 2025-02-03T16:51:27.070Z Last Updated: 2025-02-28T04:55:35.634Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-129 Description: Memory corruption while parsing the ML IE due to invalid frame content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE ID: CVE-2024-45570 State: PUBLISHED Published: 2025-05-06T08:32:03.782Z Last Updated: 2025-05-06T13:16:58.613Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-823 Description: Memory corruption may occur during IO configuration processing when the IO port count is invalid. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45571 State: PUBLISHED Published: 2025-02-03T16:51:28.301Z Last Updated: 2025-02-12T20:51:23.877Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE ID: CVE-2024-45573 State: PUBLISHED Published: 2025-02-03T16:51:29.474Z Last Updated: 2025-02-12T20:51:23.653Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-823 Description: Memory corruption may occour while generating test pattern due to negative indexing of display ID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE ID: CVE-2024-45574 State: PUBLISHED Published: 2025-05-06T08:32:04.985Z Last Updated: 2025-05-07T03:55:55.510Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-129 Description: Memory corruption during array access in Camera kernel due to invalid index from invalid command data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45575 State: PUBLISHED Published: 2025-05-06T08:32:06.199Z Last Updated: 2025-05-07T03:55:56.826Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-190 Description: Memory corruption Camera kernel when large number of devices are attached through userspace. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45576 State: PUBLISHED Published: 2025-05-06T08:32:07.417Z Last Updated: 2025-05-07T03:55:58.442Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-129 Description: Memory corruption while prociesing command buffer buffer in OPE module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45577 State: PUBLISHED Published: 2025-05-06T08:32:08.586Z Last Updated: 2025-05-07T03:55:59.774Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-20 Description: Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45578 State: PUBLISHED Published: 2025-05-06T08:32:09.792Z Last Updated: 2025-05-07T03:56:01.087Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-129 Description: Memory corruption while acquire and update IOCTLs during IFE output resource ID validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45579 State: PUBLISHED Published: 2025-05-06T08:32:11.031Z Last Updated: 2025-05-07T03:56:02.467Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-20 Description: Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requirement check. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45580 State: PUBLISHED Published: 2025-03-03T10:07:30.301Z Last Updated: 2025-03-05T04:55:13.162Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while handling multuple IOCTL calls from userspace for remote invocation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
CVE ID: CVE-2024-45581 State: PUBLISHED Published: 2025-05-06T08:32:12.241Z Last Updated: 2025-05-07T03:55:40.584Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-787 Description: Memory corruption while sound model registration for voice activation with audio kernel driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45582 State: PUBLISHED Published: 2025-02-03T16:51:30.678Z Last Updated: 2025-02-03T17:35:31.808Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-129 Description: Memory corruption while validating number of devices in Camera kernel . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE ID: CVE-2024-45583 State: PUBLISHED Published: 2025-05-06T08:32:13.494Z Last Updated: 2025-05-07T03:55:39.086Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
CVE ID: CVE-2024-45584 State: PUBLISHED Published: 2025-02-03T16:51:31.898Z Last Updated: 2025-02-03T17:34:39.632Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-822 Description: Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE ID: CVE-2024-45586 State: PUBLISHED Published: 2024-09-03T10:02:29.682Z Last Updated: 2024-09-04T11:18:59.113Z Vendors: Symphony Fintech Products: XTS Web Trader, XTS Mobile Trader Problem Types: CWE-863 Description: This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pagei
users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281
CVE ID: CVE-2024-45587 State: PUBLISHED Published: 2024-09-03T10:09:28.369Z Last Updated: 2024-09-04T11:22:31.528Z Vendors: Symphony Fintech Products: XTS Web Trader Problem Types: CWE-863 Description: This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281
CVE ID: CVE-2024-45588 State: PUBLISHED Published: 2024-09-03T10:13:37.795Z Last Updated: 2024-09-04T11:26:21.170Z Vendors: Symphony Fintech Products: XTS Web Trader Problem Types: CWE-863 Description: This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized access and modification of sensitive information belonging to other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?
other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281
CVE ID: CVE-2024-45589 State: PUBLISHED Published: 2024-09-05T00:00:00 Last Updated: 2024-09-05T18:00:23.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.rapididentity.com/docs/rapididentity-lts-release-notes - https://benrogozinski.github.io/CVE-2024-45589/
CVE ID: CVE-2024-45590 State: PUBLISHED Published: 2024-09-10T15:54:02.330Z Last Updated: 2024-09-10T18:47:22.965Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: expressjs Products: body-parser Problem Types: CWE-405 Description: body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/expressjs/body-parser/security/advisories/GHSA-
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7 - https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce
CVE ID: CVE-2024-45591 State: PUBLISHED Published: 2024-09-10T15:56:53.484Z Last Updated: 2024-09-10T19:22:03.317Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-862, CWE-359 Description: XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki i
ayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm - https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f - https://github.com/xwiki/xwiki-platform/commit/9cbca9808300
i-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f - https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8 - https://jira.xwiki.org/browse/XWIKI-22052
CVE ID: CVE-2024-45592 State: PUBLISHED Published: 2024-09-10T16:00:14.887Z Last Updated: 2024-09-20T18:10:49.795Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: DamienHarper Products: auditor-bundle Problem Types: CWE-79 Description: auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because `%source_label%` in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6. Additional Analyst Notes: - CISA ADP V
nserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67 - https://github.com/DamienHarper/auditor-bundle/commit/42ba2940d8b99467de0c806ea5655cc1c6882cd1 - https://github.com/DamienHarper/auditor-bundle/commit/e7deb377fa89677d44973b486d26d6a7374233ae
CVE ID: CVE-2024-45593 State: PUBLISHED Published: 2024-09-10T15:51:07.881Z Last Updated: 2024-09-10T16:06:16.016Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: NixOS Products: nix Problem Types: CWE-22 Description: Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.co
n. This issue is fixed in Nix 2.24.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NixOS/nix/security/advisories/GHSA-h4vv-h3jq-v493 - https://github.com/NixOS/nix/commit/eb11c1499876cd4c9c188cbda5b1003b36ce2e59
CVE ID: CVE-2024-45594 State: PUBLISHED Published: 2024-11-13T16:21:37.850Z Last Updated: 2024-11-13T18:43:57.042Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: decidim Products: decidim Problem Types: CWE-79 Description: Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/decidim/decidim/security/advisories/GHSA-j4h6-gcj7-7v9v
CVE ID: CVE-2024-45595 State: PUBLISHED Published: 2024-09-10T16:03:56.717Z Last Updated: 2024-09-10T18:56:57.922Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: man-group Products: dtale Problem Types: CWE-79 Description: D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/man-group/dtale/security/advisories/GHSA-pw44-4h99-wqff - https://github.com/man-
ment: References: - https://github.com/man-group/dtale/security/advisories/GHSA-pw44-4h99-wqff - https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8 - https://github.com/man-group/dtale#custom-filter
CVE ID: CVE-2024-45596 State: PUBLISHED Published: 2024-09-10T18:43:33.413Z Last Updated: 2024-09-10T19:20:32.884Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-524 Description: Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those
using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials. This vulnerability is fixed in 10.13.3 and 11.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8 - https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b - https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52
CVE ID: CVE-2024-45597 State: PUBLISHED Published: 2024-09-10T21:42:47.530Z Last Updated: 2024-09-11T13:28:10.303Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PlutoLang Products: Pluto Problem Types: CWE-93 Description: Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PlutoLang/Pluto/security/advisories/GHSA-w8xp-pmx2-37w7 - https
CISA ADP Vulnrichment: References: - https://github.com/PlutoLang/Pluto/security/advisories/GHSA-w8xp-pmx2-37w7 - https://github.com/PlutoLang/Pluto/pull/945
CVE ID: CVE-2024-45598 State: PUBLISHED Published: 2025-01-27T15:46:02.425Z Last Updated: 2025-11-03T20:39:10.786Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) Vendors: Cacti Products: cacti Problem Types: CWE-22 Description: Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab and selecting the name of the local file will show its content on the web UI. This vulnerability is fixed in 1.2.29. Additional Analyst Notes: - CISA AD
cal file will show its content on the web UI. This vulnerability is fixed in 1.2.29. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-pv2c-97pp-vxwg - https://github.com/Cacti/cacti/commit/eca52c6bb3e76c55d66b1040baa6dbf37471a0ae
CVE ID: CVE-2024-45599 State: PUBLISHED Published: 2024-09-24T18:02:18.777Z Last Updated: 2024-09-24T18:35:10.233Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: getcursor Products: cursor Problem Types: CWE-277 Description: Cursor is an artificial intelligence code editor. Prior to version 0.41.0, if a user on macOS has granted Cursor access to the camera or microphone, any program that is run on the machine is able to access the camera or the microphone without explicitly being granted access, through a DyLib Injection using DYLD_INSERT_LIBRARIES environment variable. The usage of `com.apple.security.cs.allow-dyld-environment-variables` and `com.apple.securi
RARIES environment variable. The usage of `com.apple.security.cs.allow-dyld-environment-variables` and `com.apple.security.cs.disable-library-validation` allows an external dynamic library to be injected into the application using DYLD_INSERT_LIBRARIES environment variable. Moreover, the entitlement `com.apple.security.device.camera` allows the application to use the host camera and `com.apple.security.device.audio-input` allows the application to use the microphone. This means that untrusted code that is executed on the user's machine can access the camera or the microphone, if the user has already given permission for Cursor to do so. In version 0.41.0, the entitlements have been split by