Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-39685 State: PUBLISHED Published: 2024-07-22T15:13:06.926Z Last Updated: 2024-08-02T04:26:15.950Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FishAudio Products: Bert-VITS2 Problem Types: CWE-78 Description: Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.run(cmd, shell=True) in the resample function, which leads to arbitrary command execution. This affects fishaudio/Bert-VITS2 2.3 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-045_GHSL-2024-047_fishaudio_Bert-VITS2/ - https://github.com/fishaudio/Bert-VITS2/blob/3f8c537f4aeb281df3fb3c455eed9a1b64871a81/webui_preprocess.py#L46-L52 - https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L130-L133
CVE ID: CVE-2024-39686 State: PUBLISHED Published: 2024-07-22T15:16:17.258Z Last Updated: 2024-08-02T04:26:15.942Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FishAudio Products: Bert-VITS2 Problem Types: CWE-78 Description: Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.run(cmd, shell=True) in the bert_gen function, which leads to arbitrary command execution. This affects fishaudio/Bert-VITS2 2.3 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-045_GHSL-2024-047_fishaudio_Bert-VITS2/ - https://github.com/fishaudio/Bert-VITS2/blob/3f8c537f4aeb281df3fb3c455eed9a1b64871a81/webui_preprocess.py#L82C9-L82C57 - https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L130-L133
CVE ID: CVE-2024-39687 State: PUBLISHED Published: 2024-07-05T17:39:34.963Z Last Updated: 2024-08-02T04:26:16.081Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: dahlia Products: fedify Problem Types: CWE-918 Description: Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the `@id` or other resources present within the activity it has received from the web. This activity could reference an `@id` that points to an internal IP address, allowing an attacker to send request to resou
s activity could reference an `@id` that points to an internal IP address, allowing an attacker to send request to resources internal to the fedify server's network. This applies to not just resolution of documents containing activities or objects, but also to media URLs as well. Specifically this is a Server Side Request Forgery attack. Users should upgrade to Fedify version 0.9.2, 0.10.1, or 0.11.1 to receive a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dahlia/fedify/security/advisories/GHSA-p9cg-vqcc-grcx - https://github.com/dahlia/fedify/commit/30f9cf4a175704a04c874f3ea88414c5f1e00b28 - https://githu
s/GHSA-p9cg-vqcc-grcx - https://github.com/dahlia/fedify/commit/30f9cf4a175704a04c874f3ea88414c5f1e00b28 - https://github.com/dahlia/fedify/commit/c641e976089dd913f649889c1bfb016df04e86ba
CVE ID: CVE-2024-39688 State: PUBLISHED Published: 2024-07-22T15:21:18.371Z Last Updated: 2024-08-02T04:26:16.013Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: FishAudio Products: Bert-VITS2 Problem Types: CWE-22 Description: Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is concatenated with other folders and used to open a new file in the generate_config function, which leads to a limited file write. The issue allows for writing /config/config.json file in arbitrary directory on the server. If a given directory path doesn’t exist, the application will return an error, so this vulnerability could als
e server. If a given directory path doesn’t exist, the application will return an error, so this vulnerability could also be used to gain information about existing directories on the server. This affects fishaudio/Bert-VITS2 2.3 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-045_GHSL-2024-047_fishaudio_Bert-VITS2/ - https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L130-L133 - https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L34
CVE ID: CVE-2024-39689 State: PUBLISHED Published: 2024-07-05T18:39:33.202Z Last Updated: 2025-02-14T23:19:13.111Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: certifi Products: python-certifi Problem Types: CWE-345 Description: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certifica
rom the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc - https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 - https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI
CVE ID: CVE-2024-39690 State: PUBLISHED Published: 2024-08-20T14:33:24.518Z Last Updated: 2025-08-14T13:32:03.818Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: projectcapsule Products: capsule Problem Types: CWE-863 Description: Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace. Version 0.7.1 contains a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/projectcapsule/capsule/security
tch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwp - https://github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584
CVE ID: CVE-2024-39691 State: PUBLISHED Published: 2024-07-05T18:42:06.864Z Last Updated: 2024-08-02T04:26:15.991Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: matrix-org Products: matrix-appservice-irc Problem Types: CWE-280, CWE-755 Description: matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message. Since this value
en determining whether or not to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance (before version 2.0.1) is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. matrix-appservice-irc 2.0.1 drops the reliance on `origin_server_ts` when determining whether or not an event should be visible to a user, instead tracking the event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a rep
e event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-w9mh-5x8j-9754 - https://github.com/matrix-org/matrix-appservice-irc/pull/1804 - https://github.com/matrix-org/matrix-appservice-irc/commit/1835e047f269001054be4c68867797aa12372a0f - https://github.com/matrix-org/matrix-appservice-irc/blob/d5d67d1d3ea3f0f6962a0af2cc57b56af3ad2129/config.sample.yaml#L601-L604
CVE ID: CVE-2024-39693 State: PUBLISHED Published: 2024-07-10T19:54:10.773Z Last Updated: 2024-11-05T14:40:42.493Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: vercel Products: next.js Problem Types: CWE-400 Description: Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vercel/next.js/security/advisories/GHSA-fq54-2j52-jc42
CVE ID: CVE-2024-39694 State: PUBLISHED Published: 2024-07-31T15:44:55.165Z Last Updated: 2024-07-31T16:51:46.950Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: DuendeSoftware Products: IdentityServer Problem Types: CWE-601 Description: Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does **not** allow an attacker to obtain user credentials, au
party, untrusted site. Note: by itself, this vulnerability does **not** allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This vulnerability is fixed in 7.0.6, 6.3.10, 6.2.5, 6.1.8, and 6.0.5. Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. If upgrading is not possible, use `IUrlHelper.IsLocalUrl` from ASP.NET Core to validate return Urls in user interface code in the IdentityServer host. Additional Analyst Notes: - CISA ADP
ET Core to validate return Urls in user interface code in the IdentityServer host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98 - https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6 - https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e - https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1 - https://github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011 - https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499
rver/commit/f04cf0be859b93f43563f8f812eb92206ad94011 - https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a
CVE ID: CVE-2024-39695 State: PUBLISHED Published: 2024-07-08T15:14:27.639Z Last Updated: 2024-08-02T04:26:15.941Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-125 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3. Additional Analyst Notes: - C
is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh - https://github.com/Exiv2/exiv2/pull/3006 - https://github.com/Exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387
CVE ID: CVE-2024-39696 State: PUBLISHED Published: 2024-07-05T18:49:22.153Z Last Updated: 2024-08-02T04:26:15.993Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: evmos Products: evmos Problem Types: CWE-863 Description: Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a
nds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c - https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf
CVE ID: CVE-2024-39697 State: PUBLISHED Published: 2024-07-09T14:16:38.493Z Last Updated: 2024-08-02T04:26:16.016Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: whisperfish Products: rust-phonenumber Problem Types: CWE-284, CWE-392, CWE-1284, CWE-617 Description: phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-co
d by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-mjw4-jj88-v687 - https://github.com/whisperfish/rust-phonenumber/issues/69 - https://github.com/whisperfish/rust-phonenumber/pull/52 - https://github.com/whisperfish/rust-phonenumber/commit/b792151b17fc90231c232a23935830c2266f3203 - https://github.com/whisperfish/rust-phonenumber/commit/f69abee
enumber/commit/b792151b17fc90231c232a23935830c2266f3203 - https://github.com/whisperfish/rust-phonenumber/commit/f69abee1481fac0d6d531407bae90020e39c6407
CVE ID: CVE-2024-39698 State: PUBLISHED Published: 2024-07-09T17:50:28.169Z Last Updated: 2024-08-02T04:26:15.985Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: electron-userland Products: electron-builder Problem Types: CWE-154 Description: electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into v
vironment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/electron-userland/electron-builder
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/electron-userland/electron-builder/security/advisories/GHSA-9jxc-qjr9-vjxq - https://github.com/electron-userland/electron-builder/pull/8295 - https://github.com/electron-userland/electron-builder/commit/ac2e6a25aa491c1ef5167a552c19fc2085cd427f - https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41
CVE ID: CVE-2024-39699 State: PUBLISHED Published: 2024-07-08T15:32:04.556Z Last Updated: 2024-08-02T04:26:15.949Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-918 Description: Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security measure and execute a SSRF using redirects. Directus allows redirects when importing file from the URL and does not check the result URL. Thus, it i
sing redirects. Directus allows redirects when importing file from the URL and does not check the result URL. Thus, it is possible to execute a request to an internal IP, for example to 127.0.0.1. However, it is blind SSRF, because Directus also uses response interception technique to get the information about the connect from the socket directly and it does not show a response if the IP address is internal. This vulnerability is fixed in 10.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/directus/directus/security/advisories/GHSA-8p72-rcq4-h6pw - https://github.com/directus/directus/commit/d577b44231c0923aca99cac5770fd853801c
curity/advisories/GHSA-8p72-rcq4-h6pw - https://github.com/directus/directus/commit/d577b44231c0923aca99cac5770fd853801caee1
CVE ID: CVE-2024-39700 State: PUBLISHED Published: 2024-07-16T17:37:49.241Z Last Updated: 2024-08-16T04:01:14.791Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: jupyterlab Products: extension-template Problem Types: CWE-94 Description: JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to the latest version. Users who made changes to `update-integration-tests.yml`, accept overwriting of this file and re-apply
latest version. Users who made changes to `update-integration-tests.yml`, accept overwriting of this file and re-apply your changes later. Users may wish to temporarily disable GitHub Actions while working on the upgrade. We recommend rebasing all open pull requests from untrusted users as actions may run using the version from the `main` branch at the time when the pull request was created. Users who are upgrading from template version prior to 4.3.0 may wish to leave out proposed changes to the release workflow for now as it requires additional configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jupyterlab/extension-t
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg - https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6
CVE ID: CVE-2024-39701 State: PUBLISHED Published: 2024-07-08T16:43:01.595Z Last Updated: 2024-08-02T04:26:16.090Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-284 Description: Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do: Pass rule if **field** matches any of the
roken Access Control because the rule fails to do what it was intended to do: Pass rule if **field** matches any of the **values**. This vulnerability is fixed in 10.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/directus/directus/security/advisories/GHSA-hxgm-ghmv-xjjm
CVE ID: CVE-2024-39702 State: PUBLISHED Published: 2024-07-23T00:00:00 Last Updated: 2024-11-26T17:58:14.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks. An attacker could cause excessive resource usage during proxy operations via crafted requests, potentially leading to a denial of service with relatively few incoming requests. This vulnerability only exists in the OpenResty fork in the openresty/luajit2 GitHub repository. The LuaJIT/LuaJIT repository. is unaffected. Additional Analyst Notes: - CISA ADP Vulnrichme
/luajit2 GitHub repository. The LuaJIT/LuaJIT repository. is unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://openresty.org/en/ann-1025003002.html
CVE ID: CVE-2024-39703 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-18T15:14:01.729Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ThreatQuotient Products: ThreatQ Problem Types: CWE-77 Description: In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://threatq.freshdesk.com/helpdesk/tickets/10367 - https://www.threatq.com/vulnerability-management/ - https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-01