Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-56328 State: PUBLISHED Published: 2025-02-04T20:55:17.223Z Last Updated: 2025-02-12T14:03:59.537Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted onebox url. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP, disable inline Oneboxes globally, or allow specific domains for Oneboxing. Add
sers unable to upgrade should enable CSP, disable inline Oneboxes globally, or allow specific domains for Oneboxing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-j855-mhxj-x6vg
CVE ID: CVE-2024-56329 State: PUBLISHED Published: 2024-12-20T19:59:37.270Z Last Updated: 2024-12-24T16:37:21.474Z Vendors: joelbutcher Products: socialstream Problem Types: CWE-287 Description: Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, with scaffolding that has support for Laravel Socialite. When linking a social account to an already authenticated user, the lack of a confirmation step introduces a security risk. This is exacerbated if ->stateless() is used in the Socialite configuration, bypassing state verification and making the exploit easier. Developers should ensure that
the Socialite configuration, bypassing state verification and making the exploit easier. Developers should ensure that users explicitly confirm account linking and avoid configurations that skip critical security checks. Socialstream v6.2 introduces a new custom route that requires a user to "Confirm" or "Deny" a request to link a social account. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/joelbutcher/socialstream/security/advisories/GHSA-3q97-vjpp-c8rp - https://github.com/joelbutcher/socialstream/commit/ae4dc3906f54fa792b296036d7b3dcea9a4d259b
CVE ID: CVE-2024-56330 State: PUBLISHED Published: 2024-12-20T20:01:48.624Z Last Updated: 2024-12-24T16:34:13.485Z Vendors: spaceness Products: stardust Problem Types: CWE-284 Description: Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. This would allow users within a container to access another containers agent, therefore compromising access.The problem has been patched in any Stardust build past 12/20/24. Users are advised to upgrade. Users may also manually disable ICC if they are unable to upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/spaceness/stardust
nable to upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/spaceness/stardust/security/advisories/GHSA-h2c9-7j2r-m98p
CVE ID: CVE-2024-56331 State: PUBLISHED Published: 2024-12-20T19:48:45.641Z Last Updated: 2024-12-27T14:52:22.519Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: louislam Products: uptime-kuma Problem Types: CWE-22 Description: Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitive local files on the server by exploiting the `file:///` protocol. This vulnerability is triggered via the **"real-browser"** request type, which takes a screenshot of the URL provided by the attacker. By supplying local file paths, such as `file:///etc/passwd`, an attacker can read sensitive dat
rovided by the attacker. By supplying local file paths, such as `file:///etc/passwd`, an attacker can read sensitive data from the server. This vulnerability arises because the system does not properly validate or sanitize the user input for the URL field. Specifically: 1. The URL input (`<input data-v-5f5c86d7="" id="url" type="url" class="form-control" pattern="https?://.+" required="">`) allows users to input arbitrary file paths, including those using the `file:///` protocol, without server-side validation. 2. The server then uses the user-provided URL to make a request, passing it to a browser instance that performs the "real-browser" request, which takes a screenshot of the content at
, passing it to a browser instance that performs the "real-browser" request, which takes a screenshot of the content at the given URL. If a local file path is entered (e.g., `file:///etc/passwd`), the browser fetches and captures the file’s content. Since the user input is not validated, an attacker can manipulate the URL to request local files (e.g., `file:///etc/passwd`), and the system will capture a screenshot of the file's content, potentially exposing sensitive data. Any **authenticated user** who can submit a URL in "real-browser" mode is at risk of exposing sensitive data through screenshots of these files. This issue has been addressed in version 1.23.16 and all users are advised to
e data through screenshots of these files. This issue has been addressed in version 1.23.16 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-2qgm-m29m-cj2h - https://github.com/louislam/uptime-kuma/commit/6cfae01a0d3727c517afe512fc8fec1d99acf875
CVE ID: CVE-2024-56332 State: PUBLISHED Published: 2025-01-03T20:19:11.525Z Last Updated: 2025-01-03T20:51:02.392Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: vercel Products: next.js Problem Types: CWE-770 Description: Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed
er cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.). Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those the
g HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. The issue was resolved in Next.js 13.5.8, 14.2.21, and 15.1.2. We recommend that users upgrade to a safe version. There are no official workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9
CVE ID: CVE-2024-56333 State: PUBLISHED Published: 2024-12-20T19:52:25.818Z Last Updated: 2024-12-24T16:38:50.448Z Vendors: InseeFrLab Products: onyxia Problem Types: CWE-94 Description: Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential consequences such as unauthorized access to other user environments and denial of service attacks. This issue has been patched in api versions 4.2.0, 3.1.1, and 2.8.2. Users are advised to upgrade. There are no known workaro
issue has been patched in api versions 4.2.0, 3.1.1, and 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-qmcw-h4f9-j3h3 - https://docs.onyxia.sh/vulnerability-disclosure/known-vulnerabilities/vulnerability-20241219
CVE ID: CVE-2024-56334 State: PUBLISHED Published: 2024-12-20T20:10:12.578Z Last Updated: 2024-12-24T16:32:35.731Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: sebhildebrandt Products: systeminformation Problem Types: CWE-94 Description: systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the `getWindowsIEEE8021x` function. This means that malicious content in the SSID can be executed as OS commands. This vulnerability may enable an attacker, depending on how the package is used, to perform remote code execution or local privilege escalati
y enable an attacker, depending on how the package is used, to perform remote code execution or local privilege escalation. This issue has been addressed in version 5.23.7 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-cvv5-9h9w-qp2m - https://github.com/sebhildebrandt/systeminformation/commit/f7af0a67b78e7894335a6cad510566a25e06ae41
CVE ID: CVE-2024-56335 State: PUBLISHED Published: 2024-12-20T20:15:35.854Z Last Updated: 2024-12-24T15:57:45.407Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: dani-garcia Products: vaultwarden Problem Types: CWE-269, CWE-284, CWE-285, CWE-287 Description: vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attacker's account has admin or owner permissions in an unrelated organization. 3. The attacker knows the target organization
ker's account has admin or owner permissions in an unrelated organization. 3. The attacker knows the target organization's UUID and the target group's UUID. Note that this vulnerability is related to group functionality and as such is only applicable for servers who have enabled the `ORG_GROUPS_ENABLED` setting, which is disabled by default. This attack can lead to different situations: 1. Denial of service, the attacker can limit users from accessing the organization's data by removing their membership from the group. 2. Privilege escalation, if the attacker is part of the victim organization, they can escalate their own privileges by joining a group they wouldn't normally have access to. F
victim organization, they can escalate their own privileges by joining a group they wouldn't normally have access to. For attackers that aren't part of the organization, this shouldn't lead to any possible plain-text data exfiltration as all the data is encrypted client side. This vulnerability is patched in Vaultwarden `1.32.7`, and users are recommended to update as soon as possible. If it's not possible to update to `1.32.7`, some possible workarounds are: 1. Disabling `ORG_GROUPS_ENABLED`, which would disable groups functionality on the server. 2. Disabling `SIGNUPS_ALLOWED`, which would not allow an attacker to create new accounts on the server. Additional Analyst Notes: - CISA ADP Vul
LOWED`, which would not allow an attacker to create new accounts on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-g65h-982x-4m5m
CVE ID: CVE-2024-56336 State: PUBLISHED Published: 2025-03-11T09:48:06.756Z Last Updated: 2025-03-11T14:03:17.592Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: SINAMICS S200 Problem Types: CWE-287 Description: A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02). The affected device contains an unlocked bootloader. This security oversight enables attackers to inject malicious code, or install untrusted firmware. The intrinsic security features designed to protect against data manipulation and unauthorized access are compromised when th
ntrinsic security features designed to protect against data manipulation and unauthorized access are compromised when the bootloader is not secured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-787280.html
CVE ID: CVE-2024-56337 State: PUBLISHED Published: 2024-12-20T15:28:54.738Z Last Updated: 2025-11-04T15:59:21.843Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-367 Description: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the d
ted. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the proble
efaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cve.org/CVERecord?id=CVE-2024-50379 - https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp
CVE ID: CVE-2024-56338 State: PUBLISHED Published: 2025-03-11T16:27:38.456Z Last Updated: 2025-09-01T01:06:48.820Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Standard Edition Problem Types: CWE-79 Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185265
CVE ID: CVE-2024-56339 State: PUBLISHED Published: 2025-08-07T16:03:05.256Z Last Updated: 2025-08-07T16:29:34.336Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: WebSphere Application Server, WebSphere Application Server Liberty Problem Types: CWE-650 Description: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239955
CVE ID: CVE-2024-56340 State: PUBLISHED Published: 2025-02-28T02:32:30.345Z Last Updated: 2025-10-17T15:23:28.753Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-23 Description: IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting path traversal payloads inside the deficon parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7183676
CVE ID: CVE-2024-56341 State: PUBLISHED Published: 2025-04-02T15:08:21.783Z Last Updated: 2025-08-15T14:41:03.478Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Content Navigator Problem Types: CWE-79 Description: IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7229839
CVE ID: CVE-2024-56342 State: PUBLISHED Published: 2025-06-06T01:27:08.207Z Last Updated: 2025-08-24T11:58:08.961Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Verify Identity Access Digital Credentials Problem Types: CWE-209 Description: IBM Verify Identity Access Digital Credentials 24.06 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235710
CVE ID: CVE-2024-56343 State: PUBLISHED Published: 2025-06-06T01:28:38.990Z Last Updated: 2025-08-24T11:58:26.286Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: IBM Products: Verify Identity Access Digital Credentials Problem Types: CWE-771 Description: IBM Verify Identity Access Digital Credentials 24.06 could allow an authenticated user to crash the service with a specially crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235710
CVE ID: CVE-2024-56346 State: PUBLISHED Published: 2025-03-18T16:15:23.565Z Last Updated: 2025-09-01T01:03:46.826Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: AIX Problem Types: CWE-114 Description: IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7186621
CVE ID: CVE-2024-56347 State: PUBLISHED Published: 2025-03-18T16:16:09.506Z Last Updated: 2025-09-01T01:04:22.224Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: IBM Products: AIX Problem Types: CWE-114 Description: IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due to improper process controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7186621
CVE ID: CVE-2024-56348 State: PUBLISHED Published: 2024-12-20T14:11:13.812Z Last Updated: 2024-12-20T17:36:30.345Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-863 Description: In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-56349 State: PUBLISHED Published: 2024-12-20T14:11:14.228Z Last Updated: 2024-12-20T16:36:05.123Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-862 Description: In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-56350 State: PUBLISHED Published: 2024-12-20T14:11:14.816Z Last Updated: 2024-12-20T17:36:21.734Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-863 Description: In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-56351 State: PUBLISHED Published: 2024-12-20T14:11:15.422Z Last Updated: 2024-12-20T17:36:12.805Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: JetBrains Products: TeamCity Problem Types: CWE-613 Description: In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-56352 State: PUBLISHED Published: 2024-12-20T14:11:15.886Z Last Updated: 2024-12-20T17:36:04.249Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-56353 State: PUBLISHED Published: 2024-12-20T14:11:16.333Z Last Updated: 2024-12-20T17:35:55.458Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-212 Description: In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-56354 State: PUBLISHED Published: 2024-12-20T14:11:16.668Z Last Updated: 2024-12-20T17:35:48.291Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-522 Description: In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-56355 State: PUBLISHED Published: 2024-12-20T14:11:17.093Z Last Updated: 2024-12-20T17:35:39.670Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/