Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
versions < V14.3.0.12), Teamcenter Visualization V2312 (All versions < V2312.0008), Teamcenter Visualization V2406 (All versions < V2406.0005), Tecnomatix Plant Simulation V2302 (All versions < V2302.0018), Tecnomatix Plant Simulation V2404 (All versions < V2404.0007). The affected applications contain an out of bounds write vulnerability when parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-24521) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-824503.html - https://cert-portal.siemens.com/productcert/html/ssa-645131.html
CVE ID: CVE-2024-52574 State: PUBLISHED Published: 2024-11-18T15:39:38.552Z Last Updated: 2024-12-10T13:54:10.791Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Teamcenter Visualization V14.2, Teamcenter Visualization V14.3, Teamcenter Visualization V2312, Teamcenter Visualization V2406, Tecnomatix Plant Simulation V2302, Tecnomatix Plant Simulation V2404 Problem Types: CWE-125 Description: A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12), Teamcenter Visualization V2312 (All versions < V2312.0008), Teamcenter Visualization V2406 (All
versions < V14.3.0.12), Teamcenter Visualization V2312 (All versions < V2312.0008), Teamcenter Visualization V2406 (All versions < V2406.0005), Tecnomatix Plant Simulation V2302 (All versions < V2302.0018), Tecnomatix Plant Simulation V2404 (All versions < V2404.0007). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-24543) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-824503.html - https://cert-portal.siemens.com/productcert/html/ssa-645131
CVE ID: CVE-2024-52577 State: PUBLISHED Published: 2025-02-14T09:55:40.520Z Last Updated: 2025-02-14T17:02:36.182Z Vendors: Apache Software Foundation Products: Apache Ignite Problem Types: CWE-502 Description: In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side. Addition
a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/1bst0n27m9kb3b6f6hvlghn182vqb2hh
CVE ID: CVE-2024-52579 State: PUBLISHED Published: 2024-12-18T19:22:31.869Z Last Updated: 2024-12-19T16:46:52.543Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: misskey-dev Products: misskey Problem Types: CWE-918, CWE-20 Description: Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or GET requests (with some controllable URL parameters) to private IPs, enabling further attacks on internal servers. This issue has
ts (with some controllable URL parameters) to private IPs, enabling further attacks on internal servers. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-5q3h-wpfw-hjjw
CVE ID: CVE-2024-52581 State: PUBLISHED Published: 2024-11-20T20:50:19.679Z Last Updated: 2024-11-25T13:46:28.592Z Vendors: litestar-org Products: litestar Problem Types: CWE-770 Description: Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to upload arbitrary large files wrapped in a `multipart/form-data` request and cause excessive memory consumption on the server. The multipart form parser in affected versions is vulnerable to this type of attack b
memory consumption on the server. The multipart form parser in affected versions is vulnerable to this type of attack by design. The public method signature as well as its implementation both expect the entire request body to be available as a single byte string. It is not possible to accept large file uploads in a safe way using this parser. This may be a regression, as a variation of this issue was already reported in CVE-2023-25578. Limiting the part number is not sufficient to prevent out-of-memory errors on the server. A patch is available in version 2.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/litestar-org/litestar/security/advisories/GHS
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/litestar-org/litestar/security/advisories/GHSA-gjcc-jvgw-wvwj - https://github.com/litestar-org/litestar/security/advisories/GHSA-p24m-863f-fm6q - https://github.com/litestar-org/litestar/commit/53c1473b5ff7502816a9a339ffc90731bb0c2138 - https://github.com/litestar-org/litestar/blob/main/litestar/_multipart.py#L97
CVE ID: CVE-2024-52582 State: PUBLISHED Published: 2024-11-19T15:32:26.579Z Last Updated: 2024-11-19T16:24:58.503Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: containerbuildsystem Products: cachi2 Problem Types: CWE-497 Description: Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This may uncover secrets if tool used in CI/build pipelines as it's the main use case. Version 0.14.0 contains a patch for the issue. No
secrets if tool used in CI/build pipelines as it's the main use case. Version 0.14.0 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/containerbuildsystem/cachi2/security/advisories/GHSA-w9qc-9m5h-qqmh - https://github.com/containerbuildsystem/cachi2/commit/d6638e5e14474061a1ab1ba5d0ee72f58b9a11a9 - https://typer.tiangolo.com/tutorial/exceptions/?h=#disable-local-variables-for-security
CVE ID: CVE-2024-52583 State: PUBLISHED Published: 2024-11-18T20:35:16.220Z Last Updated: 2024-11-19T15:34:20.168Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: DefinetlyNotAI Products: WesHacks Problem Types: CWE-494 Description: The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` before 17 November 2024 or commit 93dfb83 contains links to `Leostop`, a site that hosts a malicious injected JavaScript file that occurs when bootstrap is run as well as jquery. `Leostop` may be a tracking malware and creates 2 JavaScript files, but little else is known about
n as well as jquery. `Leostop` may be a tracking malware and creates 2 JavaScript files, but little else is known about it. The WesHacks website remove all references to `Leostop` as of 17 November 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DefinetlyNotAI/WesHacks/security/advisories/GHSA-462m-5c66-4pmh - https://github.com/DefinetlyNotAI/WesHacks/commit/93dfb83cb23a8d44e81dc12424ad8a5ea05e8f96 - https://github.com/DefinetlyNotAI/WesHacks/commit/ea5a4112d94bfe47beb74b8a1ba9b631d10f64f0
CVE ID: CVE-2024-52584 State: PUBLISHED Published: 2024-11-18T20:43:21.893Z Last Updated: 2024-11-21T14:54:45.418Z Vendors: autolab Products: Autolab Problem Types: CWE-863 Description: Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs have the authorization level of a CA in the class in the endpoint, which is not necessarily the class the submission is attached to. Version 3.0.2 contains a patch. No known workarounds are available. Additional Analyst
s the submission is attached to. Version 3.0.2 contains a patch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/autolab/Autolab/security/advisories/GHSA-rjg4-cf66-x6gr - https://github.com/autolab/Autolab/commit/96006d532a392eeca2d350d1811f8e8ab9625bda
CVE ID: CVE-2024-52585 State: PUBLISHED Published: 2024-11-18T20:45:19.561Z Last Updated: 2024-11-21T14:47:11.984Z Vendors: autolab Products: Autolab Problem Types: CWE-79 Description: Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing line 589 on `gradesheet.js.erb` to take in feedback as text rather than html. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/autolab/Autolab/security/advisories/GHSA-8qhp-jhhw-45r2
otes: - CISA ADP Vulnrichment: References: - https://github.com/autolab/Autolab/security/advisories/GHSA-8qhp-jhhw-45r2 - https://github.com/autolab/Autolab/commit/2429983b6caa245fea1b37f0dc236ccbcad9554c
CVE ID: CVE-2024-52586 State: PUBLISHED Published: 2024-12-09T18:38:42.856Z Last Updated: 2024-12-10T16:20:39.487Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: elabftw Products: elabftw Problem Types: CWE-288, CWE-303 Description: eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that allows an attacker to bypass eLabFTW's built-in multifactor authentication mechanism. An attacker who can authenticate locally (by knowing or guessing the password of a user) can thus log in regardless of MFA requirements. This does not affect MFA that are performed by sing
password of a user) can thus log in regardless of MFA requirements. This does not affect MFA that are performed by single sign-on services. Users are advised to upgrade to at least version 5.1.9 to receive a fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/elabftw/elabftw/security/advisories/GHSA-pvxr-39g3-m28c
CVE ID: CVE-2024-52587 State: PUBLISHED Published: 2024-11-18T22:03:15.657Z Last Updated: 2024-11-19T14:38:08.418Z Vendors: step-security Products: harden-runner Problem Types: CWE-78 Description: StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the H
ub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. Version 2.10.2 contains a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/step-security/harden-runner/security/advisories/GHSA-g85v-wf27-67xc - https://github.com/step-security/harden-runner/commit/0080882f6c36860b6ba35c610c98ce87d4e2f26f - https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L40-L44 - https://github.com/step-security/harden-runner/blob/951
48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L40-L44 - https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L53 - https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L57 - https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L61 - https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L169 - https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L229
CVE ID: CVE-2024-52588 State: PUBLISHED Published: 2025-05-29T09:02:15.144Z Last Updated: 2025-05-29T13:44:40.528Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: strapi Products: strapi Problem Types: CWE-918 Description: Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery (SSRF). This issue has been patched in version 4.25.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/strapi/strapi/security/advisories/GHSA-v8wj-f5c7-pvxf
CVE ID: CVE-2024-52589 State: PUBLISHED Published: 2024-12-19T19:13:51.333Z Last Updated: 2024-12-20T20:01:32.479Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from untrusted users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GH
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-cqw6-rr3v-8fff
CVE ID: CVE-2024-52590 State: PUBLISHED Published: 2024-12-18T19:21:32.872Z Last Updated: 2024-12-19T16:59:27.043Z Vendors: misskey-dev Products: misskey Problem Types: CWE-20 Description: Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to impersonate existing users from the target instance. Vulnerable Misskey instances will accept spoofed users as valid, allowing an attacker to impersonate users on another instance. Attackers have full control of the s
ofed users as valid, allowing an attacker to impersonate users on another instance. Attackers have full control of the spoofed user and can post, renote, or otherwise interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-7vgr-p3vc-p4h2
CVE ID: CVE-2024-52591 State: PUBLISHED Published: 2024-12-18T19:20:31.238Z Last Updated: 2024-12-19T17:08:34.023Z Vendors: misskey-dev Products: misskey Problem Types: CWE-20 Description: Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.getActivityJson` allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance than the one where they actually exist, and the forged notes will appear to be posted by a different user. Vulnerable Misskey instances will accept the spoofed objects as valid, allowing an attacker to imperson
different user. Vulnerable Misskey instances will accept the spoofed objects as valid, allowing an attacker to impersonate other users and instances. The attacker retains full control of the spoofed user / note and can interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-m2gq-69fp-6hv4
CVE ID: CVE-2024-52592 State: PUBLISHED Published: 2024-12-18T19:19:17.863Z Last Updated: 2024-12-18T21:30:10.754Z Vendors: misskey-dev Products: misskey Problem Types: CWE-20 Description: Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instance. Vulnerable Misskey instances will accept spoofed updates for remote polls. Local polls are unaffected. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no kno
e unaffected. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-5h8r-gq97-xv69
CVE ID: CVE-2024-52593 State: PUBLISHED Published: 2024-12-18T19:17:49.041Z Last Updated: 2024-12-18T21:31:19.011Z Vendors: misskey-dev Products: misskey Problem Types: CWE-20 Description: Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and `ApPersonService.updatePerson` allows an attacker to control the target of any "origin" links (such as the "view on remote instance" banner). Any HTTPS URL can be set, even if it belongs to a different domain than the note / user. Vulnerable Misskey instances will use the unverified URL for several clickable links, allowing an attacker to
e / user. Vulnerable Misskey instances will use the unverified URL for several clickable links, allowing an attacker to conduct phishing or other attacks against remote users. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-675w-hf2m-qwmj
CVE ID: CVE-2024-52594 State: PUBLISHED Published: 2025-01-16T18:57:29.333Z Last Updated: 2025-02-12T20:31:20.951Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: matrix-org Products: gomatrixserverlib Problem Types: CWE-918 Description: Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access. Additional Analyst
ocal firewall to limit the network segments and hosts the service using gomatrixserverlib can access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822 - https://github.com/matrix-org/gomatrixserverlib/commit/c4f1e01eab0dd435709ad15463ed38a079ad6128
CVE ID: CVE-2024-52595 State: PUBLISHED Published: 2024-11-19T21:27:08.871Z Last Updated: 2024-11-20T15:19:10.677Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: fedora-python Products: lxml_html_clean Problem Types: CWE-79, CWE-83, CWE-184 Description: lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `<svg>`, `<math>` and `<noscript>`. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be interpr
rs parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the exploitation of this vulnerability. Via `remove_tags`, one may
ml_html_clean with the following settings to prevent the exploitation of this vulnerability. Via `remove_tags`, one may specify tags to remove - their content is moved to their parents' tags. Via `kill_tags`, one may specify tags to be removed completely. Via `allow_tags`, one may restrict the set of permissible tags, excluding context-switching tags like `<svg>`, `<math>` and `<noscript>`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-5jfw-gq64-q45f - https://github.com/fedora-python/lxml_html_clean/pull/19 - https://github.com/fedora-python/lxml_html_clean/commit/c5d816f86eb3707d72a8ecf5f3823e0daa1
on/lxml_html_clean/pull/19 - https://github.com/fedora-python/lxml_html_clean/commit/c5d816f86eb3707d72a8ecf5f3823e0daa1b3808
CVE ID: CVE-2024-52596 State: PUBLISHED Published: 2024-12-02T16:24:49.591Z Last Updated: 2024-12-02T18:36:23.399Z Vendors: simplesamlphp Products: xml-common Problem Types: CWE-611 Description: SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 1.19.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/simplesamlphp/xml-common/security/advisories/GHSA-2x65-fpch-2fcm - https://github.com/simplesamlphp/xml-common/commit/fa4ade391c3194466acf5fbfd5d2ecdbf5e831f5
CVE ID: CVE-2024-52597 State: PUBLISHED Published: 2024-11-20T14:01:37.062Z Last Updated: 2024-11-20T14:31:57.628Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Bubka Products: 2FAuth Problem Types: CWE-79, CWE-80 Description: 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attack