Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-53850 State: PUBLISHED Published: 2024-12-26T21:41:55.270Z Last Updated: 2024-12-27T16:18:41.207Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: pluginsGLPI Products: addressing Problem Types: CWE-470 Description: The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.0 and before 3.0.3, a poor security check allows an unauthenticated attacker to determine whether data exists (by name) in GLPI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-fw42-79gw-7qr9 - https://github.com
nt: References: - https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-fw42-79gw-7qr9 - https://github.com/pluginsGLPI/addressing/commit/b334187a99206abbd7d0bc84f720b0a6e69e92f0
CVE ID: CVE-2024-53851 State: PUBLISHED Published: 2025-02-04T21:16:42.089Z Last Updated: 2025-02-04T21:40:59.102Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-400 Description: Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs wasn't enforcing limits on the number of URLs that it accepted, allowing a malicious user to inflict denial of service on some parts of the app. This vulnerability is only exploitable by authenticated users. This issue has been patched in the latest stable, beta and tests-passed versions of Discours
ble by authenticated users. This issue has been patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. Users unable to upgrade should turn off the `enable inline onebox on all domains` site setting and remove all entries from the `allowed inline onebox domains` site setting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-49rv-574x-wgpc - https://github.com/discourse/discourse/commit/416ec83ae57924d721e6e374f4cda78bd77a4599
CVE ID: CVE-2024-53855 State: PUBLISHED Published: 2024-11-27T18:27:04.960Z Last Updated: 2024-11-27T19:32:45.198Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nofusscomputing Products: centurion_erp Problem Types: CWE-653 Description: Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis on the IT Service Management (ITSM) modules. A user who is authenticated and has view permissions for a ticket, can view the tickets of another organization they are not apart of. Users with following permissions are applicable: 1. `view_ticket_change` permission can view change tickets fro
part of. Users with following permissions are applicable: 1. `view_ticket_change` permission can view change tickets from organizations they are not apart of. 2. `view_ticket_incident` permission can view incident tickets from organizations they are not apart of. 3. `view_ticket_request` permission can view request tickets from organizations they are not apart of. 4. `view_ticket_problem` permission can view problem tickets from organizations they are not apart of. The access to view the tickets from different organizations is only applicable when browsing the API endpoints for the tickets in question. The Centurion UI is not affected. Project Tasks, although a "ticket type" are also **Not**
for the tickets in question. The Centurion UI is not affected. Project Tasks, although a "ticket type" are also **Not** affected. This issue has been addressed in release version 1.3.1 and users are advised to upgrade. Users unable to upgrade may remove the ticket view permissions from users which would alleviate this vulnerability, if this is deemed not-viable, Upgrading is recommended. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-h9q2-fcc6-r65c - https://github.com/nofusscomputing/centurion_erp/pull/399 - https://github.com/nofusscomputing/centurion_erp/pull/399/commits/61f34876ed0f8362f7185bd5ee
ng/centurion_erp/pull/399 - https://github.com/nofusscomputing/centurion_erp/pull/399/commits/61f34876ed0f8362f7185bd5eecfc830a9de5cb0 - https://github.com/nofusscomputing/centurion_erp/releases/tag/1.3.1
CVE ID: CVE-2024-53856 State: PUBLISHED Published: 2024-12-05T15:24:36.049Z Last Updated: 2024-12-09T20:23:09.592Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: rpgp Products: rpgp Problem Types: CWE-130, CWE-148, CWE-617 Description: rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rpgp/rpgp/security/advisories/GHSA-9rmp-2568-59rv
CVE ID: CVE-2024-53857 State: PUBLISHED Published: 2024-12-05T15:22:09.049Z Last Updated: 2024-12-05T16:34:13.917Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: rpgp Products: rpgp Problem Types: CWE-770 Description: rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285
CVE ID: CVE-2024-53858 State: PUBLISHED Published: 2024-11-27T21:25:14.071Z Last Updated: 2024-12-03T15:04:45.637Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: cli Products: cli Problem Types: CWE-200 Description: The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, and `gh pr checkout`. These GitHub CLI c
th submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, and `gh pr checkout`. These GitHub CLI commands invoke git with instructions to retrieve authentication tokens using the `credential.helper` configuration variable for any host encountered. Prior to version `2.63.0`, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage: 1. `GITHUB_ENTERPRISE_TOKEN`, 2. `GH_ENTERPRISE_TOKEN` and 3. `GITHUB_TOKEN` when the `CODESPACES` environment variable is set. The result being `git` sending au
RPRISE_TOKEN` and 3. `GITHUB_TOKEN` when the `CODESPACES` environment variable is set. The result being `git` sending authentication tokens when cloning submodules. In version `2.63.0`, these GitHub CLI commands will limit the hosts for which `gh` acts as a credential helper to source authentication tokens. Additionally, `GITHUB_TOKEN` will only be used for GitHub.com and ghe.com. Users are advised to upgrade. Additionally users are advised to revoke authentication tokens used with the GitHub CLI and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
ons associated with their account or enterprise Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cli/cli/security/advisories/GHSA-jwcm-9g39-pmcw - https://git-scm.com/docs/gitcredentials
CVE ID: CVE-2024-53859 State: PUBLISHED Published: 2024-11-27T21:25:12.391Z Last Updated: 2024-12-03T16:15:49.930Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: cli Products: go-gh Problem Types: CWE-200 Description: go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. `go-gh` sources authentication tokens from different environment variables depending on the host involved: 1. `GITHUB_TOKEN`, `GH_TOKEN` for GitHub.com and ghe.com and 2. `GITHUB_EN
ent variables depending on the host involved: 1. `GITHUB_TOKEN`, `GH_TOKEN` for GitHub.com and ghe.com and 2. `GITHUB_ENTERPRISE_TOKEN`, `GH_ENTERPRISE_TOKEN` for GitHub Enterprise Server. Prior to version `2.11.1`, `auth.TokenForHost` could source a token from the `GITHUB_TOKEN` environment variable for a host other than GitHub.com or ghe.com when within a codespace. In version `2.11.1`, `auth.TokenForHost` will only source a token from the `GITHUB_TOKEN` environment variable for GitHub.com or ghe.com hosts. Successful exploitation could send authentication token to an unintended host. This issue has been addressed in version 2.11.1 and all users are advised to upgrade. Users are also advis
ntended host. This issue has been addressed in version 2.11.1 and all users are advised to upgrade. Users are also advised to regenerate authentication tokens and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cli/go-gh/security/advisories/GHSA-55v3-xh23-96gh - https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps#reviewing-your-authorized-github-apps - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log - https://docs.github.com/en/
hub.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token - https://docs.github.com/en/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens - https://github.com/cli/go-gh/blob/71770357e0cb12867d3e3e288854c0aa09d440b7/pkg/auth/auth.go#L73-L77
CVE ID: CVE-2024-53860 State: PUBLISHED Published: 2024-11-27T21:31:07.431Z Last Updated: 2024-12-02T22:27:22.606Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Spencer14420 Products: SPEmailHandler-PHP Problem Types: CWE-74 Description: sp-php-email-handler is a PHP package for handling contact form submissions. Messages sent using this script are vulnerable to abuse, as the script allows anybody to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable malicious actors to use your server to send spam, phishing emails, or other malicious content, potentially damaging your domain's reputation and leadin
rver to send spam, phishing emails, or other malicious content, potentially damaging your domain's reputation and leading to blacklisting by email providers. Patched in version 1.0.0 by removing user-provided content from confirmation emails. All pre-release versions (alpha and beta) are vulnerable to this issue and should not be used. There are no workarounds for this issue. Users must upgrade to version 1.0.0 to mitigate the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Spencer14420/SPEmailHandler-PHP/security/advisories/GHSA-mj5r-x73q-fjw6 - https://github.com/Spencer14420/SPEmailHandler-PHP/commit/6f00dd0d44ff27889aed2980a5ba06e60d8354
s/GHSA-mj5r-x73q-fjw6 - https://github.com/Spencer14420/SPEmailHandler-PHP/commit/6f00dd0d44ff27889aed2980a5ba06e60d83549d
CVE ID: CVE-2024-53861 State: PUBLISHED Published: 2024-11-29T18:43:07.644Z Last Updated: 2024-12-02T18:10:35.507Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: jpadilla Products: pyjwt Problem Types: CWE-697 Description: pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issuer, list)` to `isinstance(issuer, Sequence)`. Since str is a Sequnce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked
ce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature checks are still present so real world impact is likely limited to denial of service scenarios. This issue has been patched in version 2.10.1. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm - https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366 - h
t/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366 - https://github.com/jpadilla/pyjwt/commit/33022c25525c1020869c71ce2a4109e44ae4ced1
CVE ID: CVE-2024-53862 State: PUBLISHED Published: 2024-12-02T16:08:17.618Z Last Updated: 2024-12-02T19:41:07.391Z Vendors: argoproj Products: argo-workflows Problem Types: CWE-200, CWE-290 Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}` or when using `--auth-mode=sso`, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}`. No authentication is performed by the Server itself o
the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}`. No authentication is performed by the Server itself on `client` tokens. Authentication & authorization is instead delegated to the k8s API server. However, the Workflow Archive does not interact with k8s, and so any token that looks valid will be considered authenticated, even if it is not a k8s token or even if the token has no RBAC for Argo. To handle the lack of pass-through k8s authN/authZ, the Workflow Archive specifically does the equivalent of a `kubectl auth can-i` check for respective methods. In 3.5.7 and 3.5.8, the auth check was accidentally removed on the GET Workflow endpoint's fallback to archived workflows on
5.7 and 3.5.8, the auth check was accidentally removed on the GET Workflow endpoint's fallback to archived workflows on these lines, allowing archived workflows to be retrieved with a fake token. This vulnerability is fixed in 3.6.2 and 3.5.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-workflows/security/advisories/GHSA-h36c-m3rf-34h9 - https://github.com/argoproj/argo-workflows/pull/13021/files#diff-a5b255abaceddc9cc20bf6da6ae92c3a5d3605d94366af503ed754c079a1171aL668-R715
CVE ID: CVE-2024-53863 State: PUBLISHED Published: 2024-12-03T16:48:29.722Z Last Updated: 2024-12-03T19:08:30.218Z Vendors: element-hq Products: synapse Problem Types: CWE-434 Description: Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing. This significantly expands the attack surface in a historically vulnerable area, presenting a risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or wi
presenting a risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or within the Matrix ecosystem. Synapse 1.120.1 addresses the issue by restricting thumbnail generation to images in the following widely used formats: PNG, JPEG, GIF, and WebP. This vulnerability is fixed in 1.120.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/synapse/security/advisories/GHSA-vp6v-whfm-rv3g
CVE ID: CVE-2024-53864 State: PUBLISHED Published: 2024-11-29T18:45:31.131Z Last Updated: 2024-12-02T11:09:34.840Z Vendors: ibexa Products: admin-ui Problem Types: CWE-79 Description: Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is required to exploit it. After the fix, any existing injected XSS will not run. This issue has been patched in version 4.6.14. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrich
advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ibexa/admin-ui/security/advisories/GHSA-8w3p-gf85-qcch - https://github.com/ibexa/admin-ui/commit/8ec824a8cf06c566ed88e4c21cc66f7ed42649fc - https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates - https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614
CVE ID: CVE-2024-53865 State: PUBLISHED Published: 2024-11-29T18:48:17.680Z Last Updated: 2024-12-02T20:54:26.445Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: zhmcclient Products: python-zhmcclient Problem Types: CWE-312 Description: zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs. 2. The 'ssc-master-pw' and 'zaware-master-pw' properties
g a partition in DPM mode, in the zhmcclient API and HMC logs. 2. The 'ssc-master-pw' and 'zaware-master-pw' properties when updating an LPAR in classic mode, in the zhmcclient API and HMC logs. 3. The 'ssc-master-pw' and 'zaware-master-pw' properties when creating or updating an image activation profile in classic mode, in the zhmcclient API and HMC logs. 4. The 'password' property when creating or updating an HMC user, in the zhmcclient API log. 5. The 'bind-password' property when creating or updating an LDAP server definition, in the zhmcclient API and HMC logs. This issue affects only users of the zhmcclient package that have enabled the Python loggers named "zhmcclient.api" (for the AP
sue affects only users of the zhmcclient package that have enabled the Python loggers named "zhmcclient.api" (for the API log) or "zhmcclient.hmc" (for the HMC log) and that use the functions listed above. This issue has been fixed in zhmcclient version 1.18.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zhmcclient/python-zhmcclient/security/advisories/GHSA-p57h-3cmc-xpjq - https://github.com/zhmcclient/python-zhmcclient/commit/ad32781e782d0f604c6da4680fce48e4cc1f4433
CVE ID: CVE-2024-53866 State: PUBLISHED Published: 2024-12-10T17:12:44.629Z Last Updated: 2024-12-11T17:12:08.750Z Vendors: pnpm Products: pnpm Problem Types: CWE-426 Description: The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data (including on first lockfile generation). This can make workspace A (even running with `ignore-scripts=true`) posion global cache and execute scripts in workspace B. Users generally expect `ignore-scripts` to be sufficient to prevent immediat
l cache and execute scripts in workspace B. Users generally expect `ignore-scripts` to be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it). Here, that expectation is broken. Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs. Version 9.15.0 fixes the issue. As a work-around, use separate cache and store dirs in each workspace. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r - https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc
ub.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r - https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743
CVE ID: CVE-2024-53867 State: PUBLISHED Published: 2024-12-03T16:52:01.596Z Last Updated: 2024-12-03T19:07:19.919Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: element-hq Products: synapse Problem Types: CWE-497 Description: Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/synapse/security/advisories/GHSA-56w4-5538-8v8h - https://github.co
ichment: References: - https://github.com/element-hq/synapse/security/advisories/GHSA-56w4-5538-8v8h - https://github.com/matrix-org/matrix-spec-proposals/pull/4186
CVE ID: CVE-2024-53868 State: PUBLISHED Published: 2025-04-03T08:59:02.557Z Last Updated: 2025-04-18T14:38:03.477Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-444 Description: Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/rwyx91rsrnmpjbm04footfjjf6m9d1c9
CVE ID: CVE-2024-53869 State: PUBLISHED Published: 2025-01-28T04:07:47.554Z Last Updated: 2025-01-28T15:15:04.737Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: NVIDIA Products: NVIDIA GPU Display Driver, vGPU software Problem Types: CWE-459 Description: NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of this vulnerability might lead to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5614
CVE ID: CVE-2024-53870 State: PUBLISHED Published: 2025-02-25T20:27:43.547Z Last Updated: 2025-02-25T21:20:39.884Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: NVIDIA Products: CUDA Toolkit Problem Types: CWE-125 Description: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5594