Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-46943 State: PUBLISHED Published: 2024-09-15T00:00:00.000Z Last Updated: 2025-03-14T18:23:14.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doi.org/10.48550/arXiv.2408.16940 - https://lf-opendaylight.atlassian.net/browse/AAA-285 - https://docs.opendaylight.org/en/latest/release-notes/projects/aaa.html
CVE ID: CVE-2024-46946 State: PUBLISHED Published: 2024-09-19T00:00:00 Last Updated: 2024-09-19T14:06:52.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/95.html - https://github.com/langchain-ai/langchain/releases/tag/langchain-experimental%3D%3D0.3.0 - https://docs.sympy.org/latest/modules
github.com/langchain-ai/langchain/releases/tag/langchain-experimental%3D%3D0.3.0 - https://docs.sympy.org/latest/modules/codegen.html - https://gist.github.com/12end/68c0c58d2564ef4141bccd4651480820#file-cve-2024-46946-txt
CVE ID: CVE-2024-46947 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-08T18:50:54.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mender.io/blog/cve-2024-46947-cve-2024-47190-ssrf-issues-in-mender-enterprise-server
CVE ID: CVE-2024-46948 State: PUBLISHED Published: 2024-11-08T00:00:00.000Z Last Updated: 2025-02-10T22:21:56.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mender.io/blog/cve-2024-46948
CVE ID: CVE-2024-46951 State: PUBLISHED Published: 2024-11-10T00:00:00.000Z Last Updated: 2025-11-03T22:19:50.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707991 - https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f49812186baa7d1362880673408a6fbe8719b4f8 - https://www.suse.co
.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f49812186baa7d1362880673408a6fbe8719b4f8 - https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/
CVE ID: CVE-2024-46952 State: PUBLISHED Published: 2024-11-10T00:00:00 Last Updated: 2024-11-12T20:29:15.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during handling of a PDF XRef stream (related to W array values). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708001 - https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=b1f0827c30f59a2dcbc8a39e42cace7a1de35f7f
CVE ID: CVE-2024-46953 State: PUBLISHED Published: 2024-11-10T00:00:00.000Z Last Updated: 2025-11-03T22:19:52.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707793 - https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html - https://www.suse.com/support/update/announcement/2024/suse-su-2024
/ArtifexSoftware/ghostpdl/blob/master/doc/News.html - https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/ - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00
CVE ID: CVE-2024-46954 State: PUBLISHED Published: 2024-11-10T00:00:00 Last Updated: 2024-11-12T20:26:23.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../ directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707788 - https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=55f587dd039282316f512e1bea64218fd991f934
CVE ID: CVE-2024-46955 State: PUBLISHED Published: 2024-11-10T00:00:00.000Z Last Updated: 2025-11-03T22:19:53.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707990 - https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html - https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/ - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=85bd9d2f4b7
nnouncement/2024/suse-su-20243942-1/ - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=85bd9d2f4b792fe67aef22f1a4117457461b8ba6
CVE ID: CVE-2024-46956 State: PUBLISHED Published: 2024-11-10T00:00:00.000Z Last Updated: 2025-11-03T22:19:54.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707895 - https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html - https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/ - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f415
pdate/announcement/2024/suse-su-20243942-1/ - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f4151f12db32cd3ed26c24327de714bf2c3ed6ca
CVE ID: CVE-2024-46957 State: PUBLISHED Published: 2024-09-24T00:00:00 Last Updated: 2024-09-26T15:57:09.747345 Vendors: n/a Products: n/a Problem Types: n/a Description: Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codeberg.org/mellium/xmpp/releases - https://mellium.im/cve/cve-2024-46957/
CVE ID: CVE-2024-46958 State: PUBLISHED Published: 2024-09-16T00:00:00.000Z Last Updated: 2025-03-13T17:47:51.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/desktop/issues/6863 - https://github.com/nextcloud/desktop/pull/7092 - https://github.com/nextcloud/desktop/pull/6949 - https://github.com/nextcloud/desktop/compare/v3.13.3...v3.13.4 - https://github.com/nextcloud/security-advisories/security/advisori
hub.com/nextcloud/desktop/compare/v3.13.3...v3.13.4 - https://github.com/nextcloud/security-advisories/security/advisories
CVE ID: CVE-2024-46959 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-20T13:39:20.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1 URI via the rtsp:// protocol to receive the video and audio stream. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://werewolves.world/blog/09072024
CVE ID: CVE-2024-46960 State: PUBLISHED Published: 2024-11-07T00:00:00 Last Updated: 2024-11-08T16:22:46.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execute arbitrary JavaScript code via the com.rocks.video.downloader.MainBrowserActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/com.rocks.video.downloader/blob/main/CVE-2024-46960
CVE ID: CVE-2024-46961 State: PUBLISHED Published: 2024-11-07T00:00:00 Last Updated: 2024-11-08T16:18:37.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.privatebrowser.activity.PrivateMainActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/com.downloader.privatebrowser/blob/main/CVE-2024-46961
CVE ID: CVE-2024-46962 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T16:08:00.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.video.fast.SpeedMainAct component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.downloader.video.fast - https://github.com/actuator/com.downloader.video.fast/blob/main/CVE-2024-46962
CVE ID: CVE-2024-46963 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T16:04:13.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attacker to execute arbitrary JavaScript code via the com.bluesky.browser.ui.BrowserMainActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.superfast.video.downloader - https://github.com/actuator/com.superfast.video.downloader/blob/main/CVE-2024-46963
CVE ID: CVE-2024-46964 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T16:00:21.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaScript code via the com.video.downloader.all.StartActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.video.downloader.all - https://github.com/actuator/com.video.downloader.all/blob/main/CVE-2024-46964
CVE ID: CVE-2024-46965 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T16:14:38.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execute arbitrary JavaScript code via the allvideo.downloader.browser.DefaultBrowserActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=allvideo.downloader.browser - https://github.com/actuator/allvideo.downloader.browser/blob/main/CVE-2024-46965
CVE ID: CVE-2024-46966 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T15:57:43.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbitrary JavaScript code via the mn.ikhgur.khotoch.MainActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=mn.ikhgur.khotoch - https://github.com/actuator/mn.ikhgur.khotoch/blob/main/CVE-2024-46966
CVE ID: CVE-2024-46970 State: PUBLISHED Published: 2024-09-16T10:32:48.632Z Last Updated: 2024-09-16T13:29:49.021Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: IntelliJ IDEA Problem Types: CWE-79 Description: In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-46971 State: PUBLISHED Published: 2024-12-13T17:32:52.879Z Last Updated: 2024-12-16T16:43:33.097Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-416, CWE-362 Description: Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-46972 State: PUBLISHED Published: 2024-12-28T04:53:56.594Z Last Updated: 2025-03-13T13:48:09.321Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-911 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-46973 State: PUBLISHED Published: 2024-12-28T04:56:30.585Z Last Updated: 2024-12-28T16:41:57.766Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-416 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-46974 State: PUBLISHED Published: 2025-01-31T03:07:15.179Z Last Updated: 2025-03-20T14:32:48.723Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-266, CWE-274 Description: Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-46975 State: PUBLISHED Published: 2025-02-22T14:44:25.177Z Last Updated: 2025-02-24T16:22:17.595Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-270 Description: Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data into another Guest's virtualised GPU memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-46976 State: PUBLISHED Published: 2024-09-17T20:12:35.332Z Last Updated: 2024-09-18T13:47:17.911Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: backstage Products: backstage Problem Types: CWE-693 Description: Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. users are advised to upgra
is has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/backstage/backstage/security/advisories/GHSA-5j94-f3mf-8685
CVE ID: CVE-2024-46977 State: PUBLISHED Published: 2024-10-02T19:17:14.049Z Last Updated: 2024-10-31T13:54:04.947Z Vendors: OpenC3 Products: cosmos Problem Types: CWE-22 Description: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions). This vulnerability is fixed in 5.19.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenC3/cosmos/s
is fixed in 5.19.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8 - https://github.com/OpenC3/cosmos/commit/a34e61aea5a465f0ab3e57d833ae7ff4cafd710b - https://securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS
CVE ID: CVE-2024-46978 State: PUBLISHED Published: 2024-09-18T17:25:15.821Z Last Updated: 2024-09-20T13:34:31.694Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-648 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this. This vulnerability is present in XWiki since 13.2-rc-1. This vulnerability has been patched in X
pages because of this. This vulnerability is present in XWiki since 13.2-rc-1. This vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters. Users are advised to upgrade. It's possible to fix manually the vulnerability by editing the document `XWiki.Notifications.Code.NotificationPreferenceService` to apply the changes performed in commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx - https://github.com/xwiki/xwiki-platform/
tps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx - https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4 - https://jira.xwiki.org/browse/XWIKI-20337
CVE ID: CVE-2024-46979 State: PUBLISHED Published: 2024-09-18T17:23:34.839Z Last Updated: 2024-09-18T18:56:06.319Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-200, CWE-359 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of any user by using a URL such as `<hostname>xwiki/bin/get/XWiki/Notifications/Code/NotificationFilterPreferenceLivetableResults?outputSyntax=plain&type=custom&user=<username>`. This vulnerability impacts all versions of XWiki since 13.2-rc-1. The filters do not provid
ype=custom&user=<username>`. This vulnerability impacts all versions of XWiki since 13.2-rc-1. The filters do not provide much information (they mainly contain references which are public data in XWiki), though some info could be used in combination with other vulnerabilities. This vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0RC1. The patch consists in checking the rights of the user when sending the data. Users are advised to upgrade. It's possible to workaround the vulnerability by applying manually the patch: it's possible for an administrator to edit directly the document `XWiki.Notifications.Code.NotificationFilterPreferenceLivetableResults` to apply the same c
o edit directly the document `XWiki.Notifications.Code.NotificationFilterPreferenceLivetableResults` to apply the same changes as in the patch. See commit c8c6545f9bde6f5aade994aa5b5903a67b5c2582. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pg4m-3gp6-hw4w - https://github.com/xwiki/xwiki-platform/commit/c8c6545f9bde6f5aade994aa5b5903a67b5c2582 - https://jira.xwiki.org/browse/XWIKI-20336
CVE ID: CVE-2024-46980 State: PUBLISHED Published: 2024-10-14T17:41:58.663Z Last Updated: 2024-10-15T15:41:02.095Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L) Vendors: Enalean Products: tuleap Problem Types: CWE-79 Description: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, a site administrator could create an artifact link type with a forward label allowing them to execute uncontrolled code (or at least achieve content injection) in a mail client. Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edi
de (or at least achieve content injection) in a mail client. Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-9fc9-47h6-82jj - https://github.com/Enalean/tuleap/commit/dd94a799982cd78ab06142008d745edf9e8fd494 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=dd94a799982cd78ab06142008d745edf9e8fd494 - https://tuleap.net/plugins/tracker/?aid=39689
CVE ID: CVE-2024-46981 State: PUBLISHED Published: 2025-01-06T21:11:51.687Z Last Updated: 2025-03-19T20:14:35.152Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-416 Description: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL an
e redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c - https://github.com/redis/redis/releases/tag/6.2.17 - https://github.com/redis/redis/releases/tag/7.2.7 - https://github.com/redis/redis/releases/tag/7.4.2