Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-22032 State: PUBLISHED Published: 2024-10-16T13:26:01.883Z Last Updated: 2024-10-16T14:17:49.299Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SUSE Products: rancher Problem Types: CWE-200 Description: A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members (for projects within the cluster), all have RBAC permissions to view the cluster object from the apiserver. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ve RBAC permissions to view the cluster object from the apiserver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22032 - https://github.com/rancher/rancher/security/advisories/GHSA-q6c7-56cq-g2wm
CVE ID: CVE-2024-22033 State: PUBLISHED Published: 2024-10-16T13:42:46.559Z Last Updated: 2024-10-16T14:07:57.318Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SUSE Products: SUSE Package Hub 15 SP5, SUSE Package Hub 15 SP6, openSUSE Leap 15.5, openSUSE Leap 15.6, openSUSE Tumbleweed Problem Types: CWE-78 Description: The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22033
CVE ID: CVE-2024-22034 State: PUBLISHED Published: 2024-10-16T13:46:08.416Z Last Updated: 2024-10-31T13:34:34.435Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: SUSE Products: SUSE Linux Enterprise Desktop 15 SP5, SUSE Linux Enterprise High Performance Computing 15 SP5, SUSE Linux Enterprise Module for Development Tools 15 SP5, SUSE Linux Enterprise Server 15 SP5, SUSE Linux Enterprise Server for SAP Applications 15 SP5, SUSE Linux Enterprise Desktop 15 SP6, SUSE Linux Enterprise High Performance Computing 15 SP6, SUSE Linux Enterprise Module for Development Tools 15 SP6, SUSE Linux Enterprise Server 15 SP6, SUSE Linux Enterprise Server for SAP Application
dule for Development Tools 15 SP6, SUSE Linux Enterprise Server 15 SP6, SUSE Linux Enterprise Server for SAP Applications 15 SP6, SUSE Linux Enterprise Server 12 SP5, SUSE Linux Enterprise Server for SAP Applications 12 SP5, SUSE Linux Enterprise Software Development Kit 12 SP5, openSUSE Leap 15.5, openSUSE Leap 15.6, openSUSE Tumbleweed Description: Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22034
CVE ID: CVE-2024-22036 State: PUBLISHED Published: 2025-04-16T08:37:54.218Z Last Updated: 2025-04-18T03:55:40.915Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-269 Description: A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living off the land within the Rancher container itself. For the test and development environments, based on a –privileged Docker container, it is possible to escape the Docker container and
and development environments, based on a –privileged Docker container, it is possible to escape the Docker container and gain execution access on the host system. This issue affects rancher: from 2.7.0 before 2.7.16, from 2.8.0 before 2.8.9, from 2.9.0 before 2.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22036 - https://github.com/rancher/rancher/security/advisories/GHSA-h99m-6755-rgwc
CVE ID: CVE-2024-22037 State: PUBLISHED Published: 2024-11-28T09:46:07.525Z Last Updated: 2024-11-28T12:15:16.583Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SUSE Products: SUSE Manager Server 5.0 Problem Types: CWE-497 Description: The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22037
CVE ID: CVE-2024-22038 State: PUBLISHED Published: 2024-11-28T09:38:03.449Z Last Updated: 2024-11-28T12:15:16.693Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: SUSE Products: openSUSE Factory Problem Types: CWE-59 Description: Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22038
CVE ID: CVE-2024-22039 State: PUBLISHED Published: 2024-03-12T10:21:53.634Z Last Updated: 2024-08-01T22:35:34.899Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Cerberus PRO EN Engineering Tool, Cerberus PRO EN Fire Panel FC72x IP6, Cerberus PRO EN Fire Panel FC72x IP7, Cerberus PRO EN X200 Cloud Distribution IP7, Cerberus PRO EN X200 Cloud Distribution IP8, Cerberus PRO EN X300 Cloud Distribution IP7, Cerberus PRO EN X300 Cloud Distribution IP8, Cerberus PRO UL Compact Panel FC922/924, Cerberus PRO UL Engineering Tool, Cerberus PRO UL X300 Cloud Distribution, Desigo Fire Safety UL Compact Panel FC2025/2050, Desigo Fire Saf
ineering Tool, Cerberus PRO UL X300 Cloud Distribution, Desigo Fire Safety UL Compact Panel FC2025/2050, Desigo Fire Safety UL Engineering Tool, Desigo Fire Safety UL X300 Cloud Distribution, Sinteso FS20 EN Engineering Tool, Sinteso FS20 EN Fire Panel FC20 MP6, Sinteso FS20 EN Fire Panel FC20 MP7, Sinteso FS20 EN X200 Cloud Distribution MP7, Sinteso FS20 EN X200 Cloud Distribution MP8, Sinteso FS20 EN X300 Cloud Distribution MP7, Sinteso FS20 EN X300 Cloud Distribution MP8, Sinteso Mobile Problem Types: CWE-120 Description: A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All versions < IP6 SR3), Cerberus PRO
RO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All versions < IP6 SR3), Cerberus PRO EN Fire Panel FC72x IP7 (All versions < IP7 SR5), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions < V3.0.6602), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.0.5016), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions < V3.2.6601), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.2.5015), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All ver
erus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All versions < MP4), Desigo Fire Safety UL Engineering Tool (All versions < MP4), Desigo Fire Safety UL X300 Cloud Distribution (All versions < V4.3.0001), Sinteso FS20 EN Engineering Tool (All versions < MP8), Sinteso FS20 EN Fire Panel FC20 MP6 (All versions < MP6 SR3), Sinteso FS20 EN Fire Panel FC20 MP7 (All versions < MP7 SR5), Sinteso FS20 EN X200 Cloud Distribution MP7 (All versions < V3.0.6602), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.0.5016), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions < V3.2.6601), Sinteso FS20 EN X300 Cloud Distribut
V4.0.5016), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions < V3.2.6601), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.2.5015), Sinteso Mobile (All versions < V3.0.0). The network communication library in affected systems does not validate the length of certain X.509 certificate attributes which might result in a stack-based buffer overflow. This could allow an unauthenticated remote attacker to execute code on the underlying operating system with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-225840.html - https://cert-portal.siemens.com/productcert/ht
ces: - https://cert-portal.siemens.com/productcert/html/ssa-225840.html - https://cert-portal.siemens.com/productcert/html/ssa-953710.html
CVE ID: CVE-2024-22040 State: PUBLISHED Published: 2024-03-12T10:21:54.934Z Last Updated: 2024-08-01T22:35:34.860Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Cerberus PRO EN Engineering Tool, Cerberus PRO EN Fire Panel FC72x IP6, Cerberus PRO EN Fire Panel FC72x IP7, Cerberus PRO EN Fire Panel FC72x IP8, Cerberus PRO EN X200 Cloud Distribution IP7, Cerberus PRO EN X200 Cloud Distribution IP8, Cerberus PRO EN X300 Cloud Distribution IP7, Cerberus PRO EN X300 Cloud Distribution IP8, Cerberus PRO UL Compact Panel FC922/924, Cerberus PRO UL Engineering Tool, Cerberus PRO UL X300 Cloud Distribution, Desigo Fire Safety UL Compact
anel FC922/924, Cerberus PRO UL Engineering Tool, Cerberus PRO UL X300 Cloud Distribution, Desigo Fire Safety UL Compact Panel FC2025/2050, Desigo Fire Safety UL Engineering Tool, Desigo Fire Safety UL X300 Cloud Distribution, Sinteso FS20 EN Engineering Tool, Sinteso FS20 EN Fire Panel FC20 MP6, Sinteso FS20 EN Fire Panel FC20 MP7, Sinteso FS20 EN Fire Panel FC20 MP8, Sinteso FS20 EN X200 Cloud Distribution MP7, Sinteso FS20 EN X200 Cloud Distribution MP8, Sinteso FS20 EN X300 Cloud Distribution MP7, Sinteso FS20 EN X300 Cloud Distribution MP8, Sinteso Mobile Problem Types: CWE-125 Description: A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus
: CWE-125 Description: A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions), Cerberus PRO EN Fire Panel FC72x IP7 (All versions), Cerberus PRO EN Fire Panel FC72x IP8 (All versions < IP8 SR4), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.3.5618), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.3.5617), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution
924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All versions < MP4), Desigo Fire Safety UL Engineering Tool (All versions < MP4), Desigo Fire Safety UL X300 Cloud Distribution (All versions < V4.3.0001), Sinteso FS20 EN Engineering Tool (All versions), Sinteso FS20 EN Fire Panel FC20 MP6 (All versions), Sinteso FS20 EN Fire Panel FC20 MP7 (All versions), Sinteso FS20 EN Fire Panel FC20 MP8 (All versions < MP8 SR4), Sinteso FS20 EN X200 Cloud Distribution MP7 (All versions), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.3.5618),
0 EN X200 Cloud Distribution MP7 (All versions), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.3.5618), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.3.5617), Sinteso Mobile (All versions). The network communication library in affected systems insufficiently validates HMAC values which might result in a buffer overread. This could allow an unauthenticated remote attacker to crash the network service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-225840.html - https://cert-portal.siemens.com/productcert/h
nces: - https://cert-portal.siemens.com/productcert/html/ssa-225840.html - https://cert-portal.siemens.com/productcert/html/ssa-953710.html
CVE ID: CVE-2024-22041 State: PUBLISHED Published: 2024-03-12T10:21:56.212Z Last Updated: 2024-08-01T22:35:34.720Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Cerberus PRO EN Engineering Tool, Cerberus PRO EN Fire Panel FC72x IP6, Cerberus PRO EN Fire Panel FC72x IP7, Cerberus PRO EN Fire Panel FC72x IP8, Cerberus PRO EN X200 Cloud Distribution IP7, Cerberus PRO EN X200 Cloud Distribution IP8, Cerberus PRO EN X300 Cloud Distribution IP7, Cerberus PRO EN X300 Cloud Distribution IP8, Cerberus PRO UL Compact Panel FC922/924, Cerberus PRO UL Engineering Tool, Cerberus PRO UL X300 Cloud Distribution, Desigo Fire Safety UL Compact
anel FC922/924, Cerberus PRO UL Engineering Tool, Cerberus PRO UL X300 Cloud Distribution, Desigo Fire Safety UL Compact Panel FC2025/2050, Desigo Fire Safety UL Engineering Tool, Desigo Fire Safety UL X300 Cloud Distribution, Sinteso FS20 EN Engineering Tool, Sinteso FS20 EN Fire Panel FC20 MP6, Sinteso FS20 EN Fire Panel FC20 MP7, Sinteso FS20 EN Fire Panel FC20 MP8, Sinteso FS20 EN X200 Cloud Distribution MP7, Sinteso FS20 EN X200 Cloud Distribution MP8, Sinteso FS20 EN X300 Cloud Distribution MP7, Sinteso FS20 EN X300 Cloud Distribution MP8, Sinteso Mobile Problem Types: CWE-119 Description: A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus
: CWE-119 Description: A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions), Cerberus PRO EN Fire Panel FC72x IP7 (All versions), Cerberus PRO EN Fire Panel FC72x IP8 (All versions < IP8 SR4), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.3.5618), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.3.5617), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution
0 EN X200 Cloud Distribution MP7 (All versions), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.3.5618), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.3.5617), Sinteso Mobile (All versions). The network communication library in affected systems improperly handles memory buffers when parsing X.509 certificates. This could allow an unauthenticated remote attacker to crash the network service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-225840.html - https://cert-portal.siemens.com/productcert/html/ssa-953
ps://cert-portal.siemens.com/productcert/html/ssa-225840.html - https://cert-portal.siemens.com/productcert/html/ssa-953710.html
CVE ID: CVE-2024-22042 State: PUBLISHED Published: 2024-02-13T09:00:06.519Z Last Updated: 2025-04-10T19:06:36.268Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Siemens Products: Unicam FX Problem Types: CWE-648 Description: A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product contains incorrect use of privileged APIs that trigger the Windows Console Host (conhost.exe) as a child process with SYSTEM privileges. This could be exploited by an attacker to perform a local privilege escalation attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
local privilege escalation attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-543502.html
CVE ID: CVE-2024-22043 State: PUBLISHED Published: 2024-02-13T09:00:08.086Z Last Updated: 2024-08-01T22:35:34.843Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: Parasolid V35.0, Parasolid V35.1 Problem Types: CWE-476 Description: A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.251), Parasolid V35.1 (All versions < V35.1.170). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted XT files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: -
lity to crash the application causing denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-797296.html
CVE ID: CVE-2024-22044 State: PUBLISHED Published: 2024-03-12T10:21:57.477Z Last Updated: 2024-08-26T18:02:43.748Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: SENTRON 3KC ATC6 Expansion Module Ethernet Problem Types: CWE-912 Description: A vulnerability has been identified in SENTRON 3KC ATC6 Expansion Module Ethernet (3KC9000-8TL75) (All versions). Affected devices expose an unused, unstable http service at port 80/tcp on the Modbus-TCP Ethernet. This could allow an attacker on the same Modbus network to create a denial of service condition that forces the device to reboot. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
of service condition that forces the device to reboot. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-918992.html
CVE ID: CVE-2024-22045 State: PUBLISHED Published: 2024-03-12T10:21:58.614Z Last Updated: 2024-08-01T22:35:34.833Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SINEMA Remote Connect Client Problem Types: CWE-538 Description: A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.1 SP1). The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. This information is also available via the web interface of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
ion is also available via the web interface of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-653855.html
CVE ID: CVE-2024-22047 State: PUBLISHED Published: 2024-01-04T20:32:02.771Z Last Updated: 2025-06-03T14:41:59.058Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Problem Types: CWE-362 Description: A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww - https://github.com/collectiveidea/audited/issues/601 - https://github.com/collectiveidea/audited/pull/669 - https://github.com/collectiveidea/audited/pul
/audited/issues/601 - https://github.com/collectiveidea/audited/pull/669 - https://github.com/collectiveidea/audited/pull/671 - https://github.com/advisories/GHSA-hjp3-5g2q-7jww - https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww
CVE ID: CVE-2024-22048 State: PUBLISHED Published: 2024-01-04T20:39:59.670Z Last Updated: 2025-06-04T21:13:59.263Z Problem Types: CWE-79 Description: govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773 - https://github.com/alphagov/tech-docs-gem/pull/323 - https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1 - https://github.com/advisories/
/tech-docs-gem/pull/323 - https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1 - https://github.com/advisories/GHSA-x2xw-hw8g-6773 - https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773
CVE ID: CVE-2024-22049 State: PUBLISHED Published: 2024-01-04T20:19:02.547Z Last Updated: 2025-06-03T14:42:07.312Z Problem Types: CWE-472 Description: httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42 - https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e - https://github.com
-52mg-hr42 - https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e - https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43 - https://github.com/advisories/GHSA-5pq7-52mg-hr42 - https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html
CVE ID: CVE-2024-22050 State: PUBLISHED Published: 2024-01-04T20:24:58.500Z Last Updated: 2025-06-16T18:37:02.336Z Problem Types: CWE-22 Description: Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3 - https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889 - https://github.com/advisories/GHSA-85rf-xh54-whp3 - https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3
CVE ID: CVE-2024-22051 State: PUBLISHED Published: 2024-01-04T20:27:22.197Z Last Updated: 2025-04-17T18:18:53.409Z Problem Types: CWE-190 Description: CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x - https://github.com/gjtorikian/commonm
s: - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x - https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf - https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3 - https://github.com/advisories/GHSA-fmx4-26r3-wxpf - https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf