Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-40605 State: PUBLISHED Published: 2024-07-06T00:00:00.000Z Last Updated: 2025-03-14T13:28:30.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T361452
CVE ID: CVE-2024-40614 State: PUBLISHED Published: 2024-07-07T00:00:00 Last Updated: 2024-11-21T16:59:40.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://syss.de - https://github.com/EGroupware/egroupware/releases/tag/23.1.20240624 - https://help.egroupware.org/t/egroupware-maintenance-security-release-23-1-20240624/78438 - https://github.com/EGroup
- https://help.egroupware.org/t/egroupware-maintenance-security-release-23-1-20240624/78438 - https://github.com/EGroupware/egroupware/compare/23.1.20240430...23.1.20240624 - https://github.com/EGroupware/egroupware/commit/553829d30cc2ccdc0e5a8c5a0e16fa03a3399a3f - https://www.syss.de/pentest-blog/sql-injection-schwachstelle-in-egroupware-syss-2024-047 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-047.txt
CVE ID: CVE-2024-40616 State: REJECTED Published: N/A Last Updated: 2024-10-14T14:55:24.606110 Description: No description available.
CVE ID: CVE-2024-40617 State: PUBLISHED Published: 2024-07-17T08:44:44.939Z Last Updated: 2024-10-29T20:04:48.758Z Vendors: Fujitsu Limited Products: FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS) Problem Types: Path traversal Description: Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result, Administrator Class privileges of the product may be hijacked. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
oduct may be hijacked. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fenics.fujitsu.com/networkservice/m2m/download/update-m.html - https://jvn.jp/en/jp/JVN25583987/
CVE ID: CVE-2024-40618 State: PUBLISHED Published: 2024-07-11T01:24:41.321Z Last Updated: 2024-08-02T04:33:11.796Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-79 Description: Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2024-40618.html
CVE ID: CVE-2024-40619 State: PUBLISHED Published: 2024-08-14T19:52:24.833Z Last Updated: 2024-08-19T18:09:56.543Z Vendors: Rockwell Automation Products: ControlLogix® 5580, GuardLogix 5580 Problem Types: CWE-754 Description: CVE-2024-40619 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201690.html
CVE ID: CVE-2024-40620 State: PUBLISHED Published: 2024-08-14T19:58:29.153Z Last Updated: 2024-08-14T20:30:57.375Z Vendors: Rockwell Automation Products: Pavilion8® Problem Types: CWE-311 Description: CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the data's confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201691.html
CVE ID: CVE-2024-40624 State: PUBLISHED Published: 2024-07-15T19:28:35.905Z Last Updated: 2024-08-02T04:33:11.841Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: torrentpier Products: torrentpier Problem Types: CWE-502 Description: TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In `torrentpier/library/includes/functions.php`, `get_tracks()` uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to an arbitrary file, and execute commands on the system. For instance, the cookie bb_t will be deserialized when browsing to vie
itrary file, and execute commands on the system. For instance, the cookie bb_t will be deserialized when browsing to viewforum.php. This issue has been addressed in commit `ed37e6e52` which is expected to be included in release version 2.4.4. Users are advised to upgrade as soon as the new release is available. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/torrentpier/torrentpier/security/advisories/GHSA-fg86-4c2r-7wxw - https://github.com/torrentpier/torrentpier/commit/ed37e6e522f345f2b46147c6f53c1ab6dec1db9e - https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ff
tpier/commit/ed37e6e522f345f2b46147c6f53c1ab6dec1db9e - https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.php#L41-L60
CVE ID: CVE-2024-40625 State: PUBLISHED Published: 2025-06-10T14:49:05.368Z Last Updated: 2025-06-10T14:55:09.694Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) Vendors: geoserver Products: geoserver Problem Types: CWE-918 Description: GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/a
26.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2 - https://osgeo-org.atlassian.net/browse/GEOS-11468 - https://osgeo-org.atlassian.net/browse/GEOS-11717
CVE ID: CVE-2024-40626 State: PUBLISHED Published: 2024-07-16T17:03:39.883Z Last Updated: 2024-08-02T04:33:11.960Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: outline Products: outline Problem Types: CWE-79 Description: Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads to a Stored Cross-Site Scripting (XSS) vulnerability in Outline. An authenticated user can create a document containing a malicious JavaScript payload. When other users view this document, the malicious Javascript can execute in the origin of Outline. Outline includes CSP rules to prevent third-party code
, the malicious Javascript can execute in the origin of Outline. Outline includes CSP rules to prevent third-party code execution, however in the case of self-hosting and having your file storage on the same domain as Outline a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions. This issue has been addressed in release version 0.77.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/outline/outline/security/advisories/GHSA-888c-mvg8-v6wh
CVE ID: CVE-2024-40627 State: PUBLISHED Published: 2024-07-15T19:21:40.298Z Last Updated: 2024-08-02T04:33:11.894Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: busykoala Products: fastapi-opa Problem Types: CWE-204 Description: Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware` allows all HTTP `OPTIONS` requests without evaluating it against any policy. If an application provides different responses to HTTP `OPTIONS` requests based on an entity existing (such as to ind
y. If an application provides different responses to HTTP `OPTIONS` requests based on an entity existing (such as to indicate whether an entity is writable on a system level), an unauthenticated attacker could discover which entities exist within an application. This issue has been addressed in release version 2.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/busykoala/fastapi-opa/security/advisories/GHSA-5f5c-8rvc-j8wf - https://github.com/busykoala/fastapi-opa/commit/9588109ff651f7ffc92687129c4956126443fb8c - https://github.com/busykoala
https://github.com/busykoala/fastapi-opa/commit/9588109ff651f7ffc92687129c4956126443fb8c - https://github.com/busykoala/fastapi-opa/blob/6dd6f8c87e908fe080784a74707f016f1422b58a/fastapi_opa/opa/opa_middleware.py#L79-L80
CVE ID: CVE-2024-40628 State: PUBLISHED Published: 2024-07-18T17:05:21.662Z Last Updated: 2025-03-25T19:58:34.928Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: jumpserver Products: jumpserver Problem Types: CWE-22 Description: JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the ansible playbook to read arbitrary files in the celery container, leading to sensitive information disclosure. The Celery container runs as root and has database access, allowing the attacke
ing to sensitive information disclosure. The Celery container runs as root and has database access, allowing the attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. This issue has been addressed in release versions 3.10.12 and 4.0.0. It is recommended to upgrade the safe versions. There is no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-rpf7-g4xh-84v9 - https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2
CVE ID: CVE-2024-40629 State: PUBLISHED Published: 2024-07-18T17:04:10.251Z Last Updated: 2025-03-25T19:59:14.014Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: jumpserver Products: jumpserver Problem Types: CWE-22 Description: JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to
ution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. This issue has been patched in release versions 3.10.12 and 4.0.0. It is recommended to upgrade the safe versions. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-3wgp-q8m7-v33v - https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2
CVE ID: CVE-2024-40630 State: PUBLISHED Published: 2024-07-15T19:15:06.310Z Last Updated: 2024-08-02T04:33:11.929Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: AcademySoftwareFoundation Products: OpenImageIO Problem Types: CWE-125 Description: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in `HeifInput::seek_subimage()`. In the worst case, this can lead to an informatio
onality of OpenImageIO. Specifically, in `HeifInput::seek_subimage()`. In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the `ImageInput` APIs. This bug has been addressed in commit `0a2dcb4c` which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-jjm9-9m4m-c8p2 - https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/0a2dcb4cf2c3fd4825a146cd3ad929d9d8305ce3 - https://github.com/A
/github.com/AcademySoftwareFoundation/OpenImageIO/commit/0a2dcb4cf2c3fd4825a146cd3ad929d9d8305ce3 - https://github.com/AcademySoftwareFoundation/OpenImageIO/blob/7c486a1121a4bf71d50ff555fab2770294b748d7/src/heif.imageio/heifinput.cpp#L250
CVE ID: CVE-2024-40631 State: PUBLISHED Published: 2024-07-15T18:21:16.323Z Last Updated: 2024-08-02T04:33:11.891Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: udecode Products: plate Problem Types: CWE-79 Description: Plate media is an open source, rich-text editor for React. Editors that use `MediaEmbedElement` and pass custom `urlParsers` to the `useMediaState` hook may be vulnerable to XSS if a custom parser allows `javascript:`, `data:` or `vbscript:` URLs to be embedded. Editors that do not use `urlParsers` and consume the `url` property directly may also be vulnerable if the URL is not sanitised. The default parsers `parseTwitterUrl` and `parseVideoU
erty directly may also be vulnerable if the URL is not sanitised. The default parsers `parseTwitterUrl` and `parseVideoUrl` are not affected. `@udecode/plate-media` 36.0.10 resolves this issue by only allowing HTTP and HTTPS URLs during parsing. This affects only the `embed` property returned from `useMediaState`. In addition, the `url` property returned from `useMediaState` has been renamed to `unsafeUrl` to indicate that it has not been sanitised. The `url` property on `element` is also unsafe, but has not been renamed. If you're using either of these properties directly, you will still need to validate the URL yourself. Users are advised to upgrade. Users unable to upgrade should ensure t
you will still need to validate the URL yourself. Users are advised to upgrade. Users unable to upgrade should ensure that any custom `urlParsers` do not allow `javascript:`, `data:` or `vbscript:` URLs to be returned in the `url` property of their return values. If `url` is consumed directly, validate the URL protocol before passing it to the `iframe` element. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/udecode/plate/security/advisories/GHSA-h3pq-667x-r789 - https://github.com/udecode/plate/commit/1bc0971774fbfb770780c9bdb94746a6f0f196a0 - https://stackoverflow.com/a/43467144
CVE ID: CVE-2024-40632 State: PUBLISHED Published: 2024-07-15T21:22:57.957Z Last Updated: 2024-08-02T04:33:11.882Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: linkerd Products: linkerd2 Problem Types: CWE-918 Description: Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/shutdown. Linkerd could introduce an optional environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that d
environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that do not include this header. This issue has been addressed in release version edge-24.6.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/linkerd/linkerd2/security/advisories/GHSA-6v94-gj6x-jqj7 - https://github.com/linkerd/linkerd2/commit/35fb2d6d11ef6520ae516dd717790529f85224fa - https://github.com/linkerd/linkerd2-proxy/blob/46957de49f25fd4661af7b7c52659148f4d6dd27/linkerd/app/admin/src/server.rs
CVE ID: CVE-2024-40633 State: PUBLISHED Published: 2024-07-17T17:51:45.986Z Last Updated: 2024-08-02T04:33:11.961Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Sylius Products: Sylius Problem Types: CWE-200 Description: Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information. The issue is fixed
tokens, an attacker can access guest customer order details - sensitive guest customer information. The issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status. Users are advised to upgrade. Users unable to upgrade may alter their config to mitigate this issue. Please see the linked GHSA for details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43
CVE ID: CVE-2024-40634 State: PUBLISHED Published: 2024-07-22T17:22:55.732Z Last Updated: 2024-08-02T04:33:11.910Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-400 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerabil
ing an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-jmvp-698c-4x3w - https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdc - https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36 - https://github.com/argoproj/argo-cd/commit/d881ee78949e23160a0b280bb159e4d3d625a4df
CVE ID: CVE-2024-40635 State: PUBLISHED Published: 2025-03-17T21:32:37.894Z Last Updated: 2025-05-04T22:02:39.748Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: containerd Products: containerd Problem Types: CWE-190 Description: containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fi
could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg - https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da - https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20 - https://github.com/containerd/containerd/commit/cf158e884cfe
ontainerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20 - https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a
CVE ID: CVE-2024-40636 State: PUBLISHED Published: 2024-07-17T17:48:26.029Z Last Updated: 2024-08-02T04:33:11.743Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SteeltoeOSS Products: security-advisories Problem Types: CWE-532 Description: Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server servi
basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is `_logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());` in the `DiscoveryClient.cs` file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-vmcp-66r5-3pcp
CVE ID: CVE-2024-40637 State: PUBLISHED Published: 2024-07-16T22:56:35.541Z Last Updated: 2024-08-02T04:33:11.690Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: dbt-labs Products: dbt-core Problem Types: CWE-74 Description: dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these c