Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6418 State: PUBLISHED Published: 2024-06-30T23:00:05.648Z Last Updated: 2024-08-01T21:41:03.306Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Medicine Tracker System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.php?f=register_user. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270009 was assigned to this vulnerability. Additional Analyst Notes:
d to the public and may be used. The identifier VDB-270009 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270009 - https://vuldb.com/?ctiid.270009 - https://vuldb.com/?submit.365240 - https://github.com/jadu101/CVE/blob/main/SourceCodester_Medicine_Tracker_System_Users_php_sqli.md
CVE ID: CVE-2024-6419 State: PUBLISHED Published: 2024-06-30T23:31:03.745Z Last Updated: 2024-08-01T21:41:03.333Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Medicine Tracker System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Master.php?f=save_medicine. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-270010 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA AD
public and may be used. VDB-270010 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270010 - https://vuldb.com/?ctiid.270010 - https://vuldb.com/?submit.365247 - https://github.com/jadu101/CVE/blob/main/SourceCodester_Medicine_Tracker_System_Master_php_sqli.md
CVE ID: CVE-2024-6420 State: PUBLISHED Published: 2024-07-23T06:00:03.289Z Last Updated: 2025-08-27T12:00:48.445Z Vendors: Unknown Products: Hide My WP Ghost Problem Types: CWE-203 Observable Discrepancy Description: The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/dfda6577-81aa-4397-a2d6-1d736f9ebd44/
CVE ID: CVE-2024-6421 State: PUBLISHED Published: 2024-07-10T07:36:52.119Z Last Updated: 2025-08-22T07:00:50.289Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Pepperl+Fuchs Products: OIT1500-F113-B12-CB, OIT200-F113-B12-CB, OIT500-F113-B12-CB, OIT700-F113-B12-CB Problem Types: CWE-552 Description: An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-038
CVE ID: CVE-2024-6422 State: PUBLISHED Published: 2024-07-10T07:37:03.147Z Last Updated: 2024-08-01T21:41:03.408Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Pepperl+Fuchs Products: OIT1500-F113-B12-CB, OIT200-F113-B12-CB, OIT500-F113-B12-CB, OIT700-F113-B12-CB Problem Types: CWE-306 Description: An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-038
CVE ID: CVE-2024-6424 State: PUBLISHED Published: 2024-07-01T12:54:20.749Z Last Updated: 2024-08-01T21:41:03.308Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: MESbook Products: MESbook Problem Types: CWE-918 Description: External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=<FILE|INTERNAL URL|IP/HOST" or "/api/Proxy/Get?userName=&password=&uri=<ARCHIVO|URL INTERNA|IP/HOST" to read the source code of web files, read internal files or access network resources. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pr
web files, read internal files or access network resources. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook
CVE ID: CVE-2024-6425 State: PUBLISHED Published: 2024-07-01T12:56:20.984Z Last Updated: 2024-08-01T21:41:03.276Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: MESbook Products: MESbook Problem Types: CWE-684 Description: Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=<RANDOMUSER>&Password=<PASSWORD>&ConfirmPassword=<PASSWORD-REPEAT>". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incib
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook
CVE ID: CVE-2024-6426 State: PUBLISHED Published: 2024-07-03T11:51:58.125Z Last Updated: 2024-08-01T21:41:03.432Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: MESbook Products: MESbook Problem Types: CWE-200 Description: Information exposure vulnerability in MESbook 20221021.03 version, the exploitation of which could allow a local attacker, with user privileges, to access different resources by changing the API value of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook
CVE ID: CVE-2024-6427 State: PUBLISHED Published: 2024-07-03T11:53:15.828Z Last Updated: 2024-08-01T21:41:03.230Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MESbook Products: MESbook Problem Types: CWE-400 Description: Uncontrolled Resource Consumption vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can use the "message" parameter to inject a payload with dangerous JavaScript code, causing the application to loop requests on itself, which could lead to resource consumption and disable the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-c
itional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook
CVE ID: CVE-2024-6428 State: PUBLISHED Published: 2024-07-03T08:39:28.121Z Last Updated: 2024-08-01T21:41:03.285Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user ID. This can cause some broken functionality in User Management such administrative actions against the user not working. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
agement such administrative actions against the user not working. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-6429 State: PUBLISHED Published: 2025-09-23T16:37:58.340Z Last Updated: 2025-09-25T16:14:02.884Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WSO2 Products: WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Identity Server Description: A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks thr
g this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/
CVE ID: CVE-2024-6431 State: PUBLISHED Published: 2024-07-27T01:51:03.869Z Last Updated: 2024-08-01T21:41:03.401Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mnetadmanager Products: Media.net Ads Manager Problem Types: CWE-434 Description: The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the 'sendMail' function in all versions up to, and including, 2.10.13. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible
above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is only exploitable if anyone has ever logged in through the API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/54fac673-2d83-4d06-a4c0-8bffc269a90c?source=cve - https://plugins.trac.wordpress.org/browser/media-net-ads-manager/tags/2.10.13/app/admin/MnetAdHandleAjaxCalls.php#L206
CVE ID: CVE-2024-6432 State: PUBLISHED Published: 2025-02-20T09:21:36.563Z Last Updated: 2025-02-20T14:24:52.159Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vanderwijk Products: Content Blocks (Custom Post Widget) Problem Types: CWE-79 Description: The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's shortcode Content Block in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pa
it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f784dfa-5c31-4c44-9230-7beac7f56893?source=cve - https://plugins.trac.wordpress.org/browser/custom-post-widget/trunk/shortcode.php#L73 - https://wordpress.org/plugins/custom-post-widget/#developers - https://plugins.trac.wordpress.org/changeset/3146407/#file6 - https://plugins.trac.wordpress.org/changeset/3147521/
CVE ID: CVE-2024-6433 State: PUBLISHED Published: 2024-07-10T00:00:14.507Z Last Updated: 2024-08-01T21:41:03.297Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: stitionai Products: stitionai/devika Problem Types: CWE-23 Description: The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the application with a malicious snapshot_path parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/7d0463dd-6373-4eb8-86fc-beac0a1391a
ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/7d0463dd-6373-4eb8-86fc-beac0a1391a5
CVE ID: CVE-2024-6434 State: PUBLISHED Published: 2024-07-04T08:32:21.508Z Last Updated: 2024-08-01T21:41:03.413Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion') Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10.35. This is due to processing user-supplied input as a regular expression. This makes it possible for authenticated attackers, with Author-level access and above, to create and query a malicious post title, r
possible for authenticated attackers, with Author-level access and above, to create and query a malicious post title, resulting in slowing server resources. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c59d95a-b7f1-4a04-bbf4-bab2c42d6d75?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/includes/class-premium-template-tags.php#L1676 - https://plugins.trac.wordpress.org/changeset/3110991/
CVE ID: CVE-2024-6435 State: PUBLISHED Published: 2024-07-16T13:00:42.859Z Last Updated: 2025-08-27T20:42:59.974Z Vendors: Rockwell Automation Products: Pavilion8® Problem Types: CWE-732 Description: A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should only be available to users with administrative level privileges. If exploited, an attacker could read sensitive data, and create users. For example, a malicious user with basic privileges could perform critical functions such as creating a user with elevated privileges and reading sensitive information in the “views” section. Additional An
such as creating a user with elevated privileges and reading sensitive information in the “views” section. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1681.html
CVE ID: CVE-2024-6436 State: PUBLISHED Published: 2024-09-27T19:45:04.984Z Last Updated: 2024-10-03T13:56:51.490Z Vendors: Rockwell Automation Products: SequenceManager™ Problem Types: CWE-20 Description: An input validation vulnerability exists in the Rockwell Automation Sequence Manager™ which could allow a malicious user to send malformed packets to the server and cause a denial-of-service condition. If exploited, the device would become unresponsive, and a manual restart will be required for recovery. Additionally, if exploited, there could be a loss of view for the downstream equipment sequences in the controller. Users would not be able to view the status or command the equipment seque
nstream equipment sequences in the controller. Users would not be able to view the status or command the equipment sequences, however the equipment sequence would continue to execute uninterrupted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1679.html
CVE ID: CVE-2024-6437 State: PUBLISHED Published: 2025-01-10T20:06:36.034Z Last Updated: 2025-01-10T21:12:37.972Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Arista Networks Products: EOS-Policy Based Routing (PBR), EOS - BGP Flowspec, EOS - Interface Traffic Policy Problem Types: cwe-1220 Description: On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the
with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/20689-security-advisory-0108
CVE ID: CVE-2024-6438 State: PUBLISHED Published: 2024-07-02T10:31:04.362Z Last Updated: 2024-08-01T21:41:03.327Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Hitout Products: Carsale Problem Types: CWE-89 Description: A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-270166 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
ier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270166 - https://vuldb.com/?ctiid.270166 - https://vuldb.com/?submit.366239 - https://github.com/Hitout/carsale/issues/23
CVE ID: CVE-2024-6439 State: PUBLISHED Published: 2024-07-02T11:00:05.155Z Last Updated: 2024-08-01T21:41:03.197Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Home Owners Collection Management System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-27
The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270167. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270167 - https://vuldb.com/?ctiid.270167 - https://vuldb.com/?submit.366753 - https://github.com/GAO-UNO/cve/blob/main/upload.md
CVE ID: CVE-2024-6440 State: PUBLISHED Published: 2024-07-02T11:00:06.663Z Last Updated: 2024-08-01T21:41:03.401Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Home Owners Collection Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270
remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270168. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270168 - https://vuldb.com/?ctiid.270168 - https://vuldb.com/?submit.366988 - https://github.com/reverseD0G/cve/blob/main/sql.md
CVE ID: CVE-2024-6441 State: PUBLISHED Published: 2024-07-02T11:31:04.637Z Last Updated: 2024-09-03T17:40:21.790Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: ORIPA Problem Types: CWE-502 Description: A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/oripa/persistence/doc/loader/LoaderXML.java. The manipulation leads to deserialization. The attack can be launched remotely. Upgrading to version 1.80 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-270169 was assigned to this vulnerability. Additi
t is recommended to upgrade the affected component. The identifier VDB-270169 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.270169 - https://vuldb.com/?ctiid.270169 - https://vuldb.com/?submit.367350 - https://github.com/oripa/oripa/issues/355 - https://github.com/oripa/oripa/pull/356/commits/1abf8eb9b6b173d86d277426db1a551d6490c94a - https://github.com/oripa/oripa/milestone/15
CVE ID: CVE-2024-6442 State: PUBLISHED Published: 2024-10-04T05:36:10.488Z Last Updated: 2024-10-04T13:52:10.920Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-787 Description: In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m22j-ccg7-4v4h
CVE ID: CVE-2024-6443 State: PUBLISHED Published: 2024-10-04T05:56:30.135Z Last Updated: 2024-10-04T13:50:42.760Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-125, CWE-787 Description: In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gg46-3rh2-v765
CVE ID: CVE-2024-6444 State: PUBLISHED Published: 2024-10-04T06:14:26.348Z Last Updated: 2024-10-04T13:49:14.058Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-122 Description: No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qj4r-chj6-h7qp
CVE ID: CVE-2024-6445 State: PUBLISHED Published: 2024-09-06T13:33:28.655Z Last Updated: 2024-09-09T20:47:10.132Z Vendors: DataFlowX Technology Products: DataDiodeX Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal.This issue affects DataDiodeX: from v3.0.0 before v3.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1409
CVE ID: CVE-2024-6446 State: PUBLISHED Published: 2024-09-12T16:56:53.258Z Last Updated: 2024-09-13T14:17:36.471Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-840 Description: An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/470144 - https://hackerone.com/reports/2573481