Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6038 State: PUBLISHED Published: 2024-06-27T18:41:45.405Z Last Updated: 2025-10-15T12:50:31.656Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py module. This function takes a user-provided keyword and attempts to match it against chat history filenames using a regular expression search. Due to the lack of sanitization or validation of the keyword parameter, an a
ilenames using a regular expression search. Due to the lack of sanitization or validation of the keyword parameter, an attacker can inject a specially crafted regular expression, leading to a denial of service condition. This can cause severe degradation of service performance and potential system unavailability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/d41cca0a-82bc-4cbf-a52a-928d304fb42d - https://github.com/gaizhenbiao/chuanhuchatgpt/commit/fcdd5fd6b05ef537a1db185ab115758d87e1ba3f
CVE ID: CVE-2024-6039 State: PUBLISHED Published: 2024-06-16T22:00:07.255Z Last Updated: 2024-08-01T21:25:03.238Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Feng Office Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipulation of the argument dim leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268752. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:
rability is VDB-268752. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268752 - https://vuldb.com/?ctiid.268752 - https://seclists.org/fulldisclosure/2024/Jun/2 - https://msecureltd.blogspot.com/2024/05/friday-fun-pentest-series-6.html
CVE ID: CVE-2024-6040 State: PUBLISHED Published: 2024-08-01T15:32:43.624Z Last Updated: 2025-10-15T12:50:32.126Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-352 Description: In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized act
re susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim's machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ac0bbb1d-89aa-42ba-bc48-1b59bd16acc7
CVE ID: CVE-2024-6041 State: PUBLISHED Published: 2024-06-16T23:00:05.773Z Last Updated: 2024-08-01T21:25:03.151Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Gym Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268765 was assigned to this vulnerability. Additional Analyst Notes: - CISA
public and may be used. The identifier VDB-268765 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268765 - https://vuldb.com/?ctiid.268765 - https://vuldb.com/?submit.357816 - https://github.com/ssiicckk/cve/issues/1
CVE ID: CVE-2024-6042 State: PUBLISHED Published: 2024-06-16T23:31:04.402Z Last Updated: 2024-08-01T21:25:03.189Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Real Estate Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Real Estate Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file property-detail.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-268766 is the identifier assigned to this vulnerability. Additional Analyst Note
osed to the public and may be used. VDB-268766 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268766 - https://vuldb.com/?ctiid.268766 - https://vuldb.com/?submit.357851 - https://github.com/Cormac315/cve/issues/1
CVE ID: CVE-2024-6043 State: PUBLISHED Published: 2024-06-17T00:00:05.428Z Last Updated: 2024-08-01T21:25:03.187Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects the function login of the file admin_class.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268767. Additional Analy
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268767. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268767 - https://vuldb.com/?ctiid.268767 - https://vuldb.com/?submit.358176 - https://github.com/yezzzo/y3/blob/main/SourceCodester%20Best%20house%20rental%20management%20system%20project%20in%20php%201.0%20SQL%20Injection.md
CVE ID: CVE-2024-6044 State: PUBLISHED Published: 2024-06-17T02:30:04.564Z Last Updated: 2024-08-01T21:25:03.216Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: D-Link Products: G403, G415, G416, M18, R03, R04, R12, R18, E30, M30, M32, M60, R32, E15, R15 Problem Types: CWE-22 Description: Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html - https://www.twcert.org.tw/en/cp-139-
am Container: References: - https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html - https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398
CVE ID: CVE-2024-6045 State: PUBLISHED Published: 2024-06-17T03:12:14.137Z Last Updated: 2024-08-01T21:25:03.244Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: G403, G415, G416, M18, R03, R04, R12, R18, E30, M30, M32, M60, R32, E15, R15 Problem Types: CWE-912, CWE-798 Description: Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by using the administrator credentials obtained from analyzing the firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE P
ministrator credentials obtained from analyzing the firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7879-da630-1.html - https://www.twcert.org.tw/en/cp-139-7880-629f5-2.html - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398
CVE ID: CVE-2024-6046 State: REJECTED Published: 2024-06-17T03:33:19.048Z Last Updated: 2024-06-18T10:24:33.473Z Description: No description available.
CVE ID: CVE-2024-6047 State: PUBLISHED Published: 2024-06-17T05:48:42.779Z Last Updated: 2025-10-21T22:56:21.904Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GeoVision Products: GV_DSP_LPR_V2, GV_IPCAMD_GV_BX1500, GV_IPCAMD_GV_CB220, GV_IPCAMD_GV_EBL1100, GV_IPCAMD_GV_EFD1100, GV_IPCAMD_GV_FD2410, GV_IPCAMD_GV_FD3400, GV_IPCAMD_GV_FE3401, GV_IPCAMD_GV_FE420, GV-VS14_VS14, GV_VS03, GV_VS2410, GV_VS28XX, GV_VS216XX, GV VS04A, GV VS04H, GVLX 4 V2, GVLX 4 V3, GV_IPCAMD_GV_BX130, GV_GM8186_VS14 Problem Types: CWE-78 Description: Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers
L GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html - https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html
CVE ID: CVE-2024-6048 State: PUBLISHED Published: 2024-06-17T07:28:48.935Z Last Updated: 2024-08-01T21:25:03.197Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Openfind Products: MailGates 5.0, MailAudit 5.0, MailGates 6.0, MailAudit 6.0 Problem Types: CWE-78 Description: Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vulnerability to inject system commands and execute them on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7885-a8013-1.html - https://
DP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7885-a8013-1.html - https://www.twcert.org.tw/en/cp-139-7886-20b61-2.html
CVE ID: CVE-2024-6049 State: PUBLISHED Published: 2024-10-24T07:47:40.320Z Last Updated: 2024-10-25T06:03:39.593Z Vendors: Lawo AG Products: vsm LTC Time Sync (vTimeSync) Problem Types: CWE-32 Description: The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/
xt. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/lawo - https://lawo.com/lawo-downloads/
CVE ID: CVE-2024-6050 State: PUBLISHED Published: 2024-07-01T13:40:48.134Z Last Updated: 2024-08-01T21:25:03.198Z Vendors: SOKRATES-software Products: SOWA OPAC Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects SOWA OPAC software in versions from 4.0 before 4.9.10, from 5.0 before 6.2.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/07/CVE-2024-6050/ -
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/07/CVE-2024-6050/ - https://cert.pl/posts/2024/07/CVE-2024-6050/
CVE ID: CVE-2024-6051 State: PUBLISHED Published: 2024-09-30T12:33:25.438Z Last Updated: 2025-10-03T09:04:28.944Z Vendors: Vercom S.A. Products: Redlink SDK Problem Types: CWE-926 Description: Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate the view of a vulnerable application.This issue affects Redlink SDK versions through 1.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/09/CVE-2024-6051/ - https://cert.pl/posts/2024/09/CVE-2024-6051/
CVE ID: CVE-2024-6052 State: PUBLISHED Published: 2024-07-03T14:30:31.332Z Last Updated: 2024-09-16T13:57:30.913Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-80 Description: Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HTML elements Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://checkmk.com/werk/17010
CVE ID: CVE-2024-6053 State: PUBLISHED Published: 2024-08-28T16:30:58.925Z Last Updated: 2024-08-28T17:47:14.592Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: TeamViewer Products: Meeting, Remote Full Client Problem Types: CWE-359 Description: Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can lead to unintentional sharing of the clipboard with the current presenter of a meeting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1007/
CVE ID: CVE-2024-6054 State: PUBLISHED Published: 2024-06-27T02:03:00.212Z Last Updated: 2024-08-01T21:25:03.219Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ka-yue Products: Auto Featured Image Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post_attachment_from_url' function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make re
with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1512c2-75c1-405b-8bb4-f42ec69159a7?source=cve - https://plugins.trac.wordpress.org/browser/auto-featured-image/tags/1.2/auto-featured-image.php#L167
CVE ID: CVE-2024-6055 State: PUBLISHED Published: 2024-06-17T12:55:28.759Z Last Updated: 2024-10-30T19:14:03.801Z Vendors: Devolutions Products: Remote Desktop Manager Description: Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2024-0008
CVE ID: CVE-2024-6056 State: PUBLISHED Published: 2024-06-17T17:31:04.907Z Last Updated: 2024-09-03T17:54:05.487Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nasirkhan Products: Laravel Starter Problem Types: CWE-204 Description: A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /forgot-password of the component Password Reset Handler. The manipulation of the argument Email leads to observable response discrepancy. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The
ck may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268784. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.268784 - https://vuldb.com/?ctiid.268784 - https://vuldb.com/?submit.352978 - https://powerful-bulb-c36.notion.site/idor-c6eb58e8fc40416ba53c7915ca0174c4?pvs=4
CVE ID: CVE-2024-6057 State: PUBLISHED Published: 2024-06-17T13:10:42.462Z Last Updated: 2024-08-29T20:09:51.084Z Vendors: Devolutions Products: Remote Desktop Manager Description: Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2024-0008
CVE ID: CVE-2024-6058 State: PUBLISHED Published: 2024-06-17T18:00:04.540Z Last Updated: 2024-08-01T21:25:03.367Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: LabVantage Products: LIMS Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in LabVantage LIMS 2017. This affects an unknown part of the file /labvantage/rc?command=page&page=SampleHistoricalList&_iframename=list&__crc=crc_1701669816260. The manipulation of the argument height/width leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268785 was assigned to this vulnerability
e exploit has been disclosed to the public and may be used. The identifier VDB-268785 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268785 - https://vuldb.com/?ctiid.268785 - https://vuldb.com/?submit.353198 - https://gentle-khaan-c53.notion.site/Reflected-XSS-in-Labvantage-LIMS-cc960e84650a4df58ecabe82338e0272
CVE ID: CVE-2024-6059 State: PUBLISHED Published: 2024-06-17T18:31:04.757Z Last Updated: 2024-08-01T21:25:03.235Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Ingenico Products: Estate Manager Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown processing of the file /emgui/rest/ums/messages of the component News Feed. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268787. NOTE: The v
been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268787 - https://vuldb.com/?ctiid.268787 - https://vuldb.com/?submit.353237 - https://gentle-khaan-c53.notion.site/Stored-XSS-in-Ingenico-The-Estate-Manager-90089eaef5574b929fe019c3d0686b63
CVE ID: CVE-2024-6060 State: PUBLISHED Published: 2024-06-25T21:36:33.840Z Last Updated: 2024-09-18T15:47:18.064Z Vendors: Phloc Products: Webscopes Problem Types: CWE-532 Description: An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP requests that contain user passwords or other sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sites.google.com/sonatype.com/vulnerabilities/cve-2024-6060
CVE ID: CVE-2024-6061 State: PUBLISHED Published: 2024-06-17T19:31:07.053Z Last Updated: 2024-08-01T21:25:03.228Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: GPAC Problem Types: CWE-835 Description: A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681
ploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268789 - https://vuldb.com/?ctiid.268789 - https://vuldb.com/?submit.356308 - https://github.com/gpac/gpac/issues/2871 - https://github.com/user-attachments/files/15801058/poc1.zip - https://github.com/gpac/gpac/commit/20c0f29139a82779b86453ce7f68d0681ec7624c
CVE ID: CVE-2024-6062 State: PUBLISHED Published: 2024-06-17T19:31:10.855Z Last Updated: 2024-08-01T21:25:03.218Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: GPAC Problem Types: CWE-476 Description: A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample of the file src/filters/load_text.c of the component MP4Box. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 31e499d310a48bd17c8b055a0bfe0fe35887a7cd. It is
been disclosed to the public and may be used. The patch is identified as 31e499d310a48bd17c8b055a0bfe0fe35887a7cd. It is recommended to apply a patch to fix this issue. VDB-268790 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268790 - https://vuldb.com/?ctiid.268790 - https://vuldb.com/?submit.356314 - https://github.com/gpac/gpac/issues/2872 - https://github.com/user-attachments/files/15801126/poc2.zip - https://github.com/gpac/gpac/commit/31e499d310a48bd17c8b055a0bfe0fe35887a7cd
CVE ID: CVE-2024-6063 State: PUBLISHED Published: 2024-06-17T20:31:04.316Z Last Updated: 2024-08-01T21:25:03.373Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: GPAC Problem Types: CWE-476 Description: A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply