Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-31419 State: PUBLISHED Published: 2024-04-03T14:00:04.329Z Last Updated: 2025-11-21T06:55:10.103Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenShift Virtualization 4 Problem Types: CWE-497 Description: An information disclosure flaw was found in OpenShift Virtualization. The DownwardMetrics feature was introduced to expose host metrics to virtual machine guests and is enabled by default. This issue could expose limited host metrics of a node to any guest in any namespace without being explicitly enabled by an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References
itly enabled by an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-31419 - https://bugzilla.redhat.com/show_bug.cgi?id=2272948
CVE ID: CVE-2024-31420 State: PUBLISHED Published: 2024-04-03T14:01:07.124Z Last Updated: 2025-11-20T19:12:24.292Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat OpenShift Virtualization 4 Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/sec
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-31420 - https://bugzilla.redhat.com/show_bug.cgi?id=2272951
CVE ID: CVE-2024-31421 State: PUBLISHED Published: 2024-04-15T10:09:53.469Z Last Updated: 2024-08-02T01:52:56.888Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Supsystic Products: Popup by Supsystic Problem Types: CWE-862 Description: Missing Authorization vulnerability in Supsystic Popup by Supsystic.This issue affects Popup by Supsystic: from n/a through 1.10.27. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/popup-by-supsystic/wordpress-popup-by-supsystic-plugin-1-10-27-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-31422 State: PUBLISHED Published: 2024-04-15T10:08:01.343Z Last Updated: 2024-08-02T01:52:56.876Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Philippe Bernard Products: Favicon Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Philippe Bernard Favicon.This issue affects Favicon: from n/a through 1.3.29. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/favicon-by-realfavicongenerator/wordpress-favicon-by-realfavicongenerator-plugin-1-3-29-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31423 State: PUBLISHED Published: 2024-06-09T17:15:40.861Z Last Updated: 2024-08-02T01:52:56.974Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Alex Volkov Products: WP Accessibility Helper (WAH) Problem Types: CWE-862 Description: Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH).This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-accessibility-helper/wordpress-wp-accessibility-helper-wah-plugin-0-6-2-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-31424 State: PUBLISHED Published: 2024-04-15T10:07:10.451Z Last Updated: 2024-08-02T01:52:56.905Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Hamid Alinia - idehweb Products: Login with phone number Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Hamid Alinia - idehweb Login with phone number.This issue affects Login with phone number: from n/a through 1.6.93. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/login-with-phone-number/wordpress-login-with-phone-number-plugin-1-6-93-cross-site-request-forgery-csrf-vulne
nerability/login-with-phone-number/wordpress-login-with-phone-number-plugin-1-6-93-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31425 State: PUBLISHED Published: 2024-04-15T10:05:45.381Z Last Updated: 2024-08-02T01:52:56.871Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: TMS Products: Amelia Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in TMS Amelia.This issue affects Amelia: from n/a through 1.0.95. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ameliabooking/wordpress-amelia-plugin-1-0-95-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31426 State: PUBLISHED Published: 2024-04-15T10:00:38.354Z Last Updated: 2024-08-08T18:42:54.936Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Data443 Products: Inline Related Posts Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Data443 Inline Related Posts.This issue affects Inline Related Posts: from n/a through 3.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/intelly-related-posts/wordpress-inline-related-posts-plugin-3-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31427 State: PUBLISHED Published: 2024-04-15T09:59:42.867Z Last Updated: 2024-08-02T01:52:56.904Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Marker.io Products: Marker.io Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Marker.Io Marker.Io.This issue affects Marker.Io : from n/a through 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/marker-io/wordpress-marker-io-plugin-1-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31428 State: PUBLISHED Published: 2024-04-15T09:33:40.515Z Last Updated: 2024-08-02T01:52:56.801Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Rara Theme Products: The Conference Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme The Conference.This issue affects The Conference: from n/a through 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/the-conference/wordpress-the-conference-theme-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31429 State: PUBLISHED Published: 2024-04-15T09:32:49.523Z Last Updated: 2024-08-02T01:52:56.944Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Blossom Themes Products: Sarada Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Blossom Themes Sarada Lite.This issue affects Sarada Lite: from n/a through 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/sarada-lite/wordpress-sarada-lite-theme-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31430 State: PUBLISHED Published: 2024-04-10T19:10:01.565Z Last Updated: 2024-08-02T01:52:56.903Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: WOLF – WordPress Posts Bulk Editor and Manager Professional, BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional, realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: f
sional for WooCommerce by Pluginus.Net.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: from n/a through 1.0.8.1; BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/bulk-editor/wordpress-wolf-wordpress-posts-bulk-editor-and-manager-professional-plugin-1-0-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/woo-bulk-editor/wordpress-bear-bulk-editor-and-products-manager-professional-for-woocommerce-plugin-1-1-4-1-
lnerability/woo-bulk-editor/wordpress-bear-bulk-editor-and-products-manager-professional-for-woocommerce-plugin-1-1-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31431 State: PUBLISHED Published: 2024-04-15T09:31:56.473Z Last Updated: 2024-08-08T18:42:59.141Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Tyche Softwares Products: Product Input Fields for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Product Input Fields for WooCommerce.This issue affects Product Input Fields for WooCommerce: from n/a through 1.7.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/product-input-fields-for-woocommerce/wordpress-product-input-fields-for-woocommerce
atchstack.com/database/vulnerability/product-input-fields-for-woocommerce/wordpress-product-input-fields-for-woocommerce-plugin-1-7-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31432 State: PUBLISHED Published: 2024-04-15T09:31:08.683Z Last Updated: 2024-08-02T01:52:56.950Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: StellarWP Products: Restrict Content Problem Types: CWE-862 Description: Missing Authorization vulnerability in StellarWP Restrict Content.This issue affects Restrict Content: from n/a through 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/restrict-content/wordpress-restrict-content-plugin-3-2-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-31433 State: PUBLISHED Published: 2024-04-15T09:29:42.078Z Last Updated: 2024-08-02T01:52:56.879Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: The Events Calendar Products: The Events Calendar Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in The Events Calendar.This issue affects The Events Calendar: from n/a through 6.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/the-events-calendar/wordpress-the-events-calendar-plugin-6-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31434 State: PUBLISHED Published: 2024-04-15T09:28:49.460Z Last Updated: 2024-08-02T01:52:56.986Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Stefano Lissa & The Newsletter Team Products: Newsletter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Stefano Lissa & The Newsletter Team Newsletter.This issue affects Newsletter: from n/a through 8.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/newsletter/wordpress-newsletter-plugin-8-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31441 State: PUBLISHED Published: 2024-05-10T14:43:23.863Z Last Updated: 2024-08-02T01:52:56.914Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: dataease Products: dataease Problem Types: CWE-863 Description: DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dataease/dataease/security/advisories/GHSA
A ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh
CVE ID: CVE-2024-31442 State: PUBLISHED Published: 2024-04-08T15:33:19.831Z Last Updated: 2024-08-02T01:52:56.942Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Redon-Tech Products: Redon-Hub Problem Types: CWE-276 Description: Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch.
clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26 - https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd
CVE ID: CVE-2024-31443 State: PUBLISHED Published: 2024-05-13T15:01:44.324Z Last Updated: 2025-11-04T16:11:57.030Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-79 Description: Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
cripting. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-rqc8-78cm-85j3 - https://github.com/Cacti/cacti/commit/f946fa537d19678f938ddbd784a10e3290d275cf - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2024-31444 State: PUBLISHED Published: 2024-05-13T15:03:58.385Z Last Updated: 2025-11-04T16:11:57.976Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Cacti Products: cacti Problem Types: CWE-79 Description: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes: - CISA
nally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-p4ch-7hjw-6m87 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2024-31445 State: PUBLISHED Published: 2024-05-13T15:05:56.662Z Last Updated: 2025-11-04T16:11:58.944Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-89 Description: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without
In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-vjph-r677-6pcc - https://github.com/Cacti/cacti/commit/fd93c6e47651958b77c3bbe6a01fff695f81e886 - https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/lib/api_automation.php#L717 - https://github.com/Cacti/cacti/blob/501712998
lob/501712998589763d411a68d35e3cda98fd9cfd18/lib/api_automation.php#L717 - https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/lib/api_automation.php#L856 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2024-31446 State: PUBLISHED Published: 2024-04-16T19:20:14.496Z Last Updated: 2024-08-02T01:52:56.991Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: MightyPirates Products: OpenComputers Problem Types: CWE-770 Description: OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. A user can use OpenComputers to get a Computer thread stuck in the Lua VM, which eventually blocks the Server thread, requiring the server to be forcibly shut down. This can be accomplished using any device in the mod and can be performed by anyone who can execute Lua code on them. This occurs while using the native Lua library. LuaJ appea
can be performed by anyone who can execute Lua code on them. This occurs while using the native Lua library. LuaJ appears to not have this issue. This vulnerability is fixed in 1.8.4. The GregTech: New Horizons modpack uses its own modified version of OpenComputers. They have applied the relevant patch in version 1.10.10-GTNH. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-54j4-xpgj-cq4g - https://github.com/MightyPirates/OpenComputers/commit/9d4f7ea297953c2fd8ccfd24fe549d5e9576400f
CVE ID: CVE-2024-31447 State: PUBLISHED Published: 2024-04-08T15:39:29.678Z Last Updated: 2024-09-03T18:25:39.752Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: shopware Products: shopware Problem Types: CWE-613 Description: Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. Th
usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7 - https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77 - https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3
CVE ID: CVE-2024-31448 State: PUBLISHED Published: 2024-11-04T23:34:19.435Z Last Updated: 2024-11-05T16:28:45.817Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to upgrade should validate CSV content before importing it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iT
tent before importing it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-776w-x6v7-vfwf
CVE ID: CVE-2024-31449 State: PUBLISHED Published: 2024-10-07T19:51:08.775Z Last Updated: 2024-11-19T04:55:42.670Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-20, CWE-121 Description: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this
fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5 - https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9
CVE ID: CVE-2024-31450 State: PUBLISHED Published: 2024-04-19T18:59:19.526Z Last Updated: 2024-08-02T01:52:56.997Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: owncast Products: owncast Problem Types: CWE-22 Description: Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequen
he JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-277_Owncast/ - https://github.com/owncast/owncast/commit/1b14800c7d7f54be14ed4d130bfe7f480645076e - https://github.com/owncast/owncast/blob/v0.1.2/controllers/admin/emoji.go#L63 - https://github.com/owncast/owncast/releases/tag/v0.1.3