Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-29733 State: PUBLISHED Published: 2024-04-21T17:21:55.722Z Last Updated: 2025-02-13T17:47:41.310Z Vendors: Apache Software Foundation Products: Apache Airflow FTP Provider Problem Types: CWE-295 Description: Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version
ates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/airflow/pull/38266 - https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 - https://docs.python.org/3/library/ssl.html#best-defaults - https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 - http://www.openwall.com/lists/oss-security/2024/04/19/3
CVE ID: CVE-2024-29734 State: PUBLISHED Published: 2024-04-03T07:11:05.544Z Last Updated: 2024-10-31T13:51:55.458Z Vendors: Fujidenolo Solutions Co., Ltd. Products: SonicDICOM Media Viewer Problem Types: Uncontrolled Search Path Element Description: Uncontrolled search path element issue exists in SonicDICOM Media Viewer 2.3.2 and earlier, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN40367518/
CVE ID: CVE-2024-29735 State: PUBLISHED Published: 2024-03-26T16:52:40.770Z Last Updated: 2025-02-13T17:47:41.979Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-281 Description: Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesystem. If your log files are stored
commended) it added group write permission to all folders up to the root of the filesystem. If your log files are stored in the home directory, these permission changes might impact your ability to run SSH operations after your home directory becomes group-writeable. This issue does not affect users who use or extend Airflow using Official Airflow Docker reference images ( https://hub.docker.com/r/apache/airflow/ ) - those images require to have group write permission set anyway. You are affected only if you install Airflow using local installation / virtualenv or other Docker images, but the issue has no impact if docker containers are used as intended, i.e. where Airflow components do not
ker images, but the issue has no impact if docker containers are used as intended, i.e. where Airflow components do not share containers with other applications and users. Also you should not be affected if your umask is 002 (group write enabled) - this is the default on many linux systems. Recommendation for users using Airflow outside of the containers: * if you are using root to run Airflow, change your Airflow user to use non-root * upgrade Apache Airflow to 2.8.4 or above * If you prefer not to upgrade, you can change the https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#file-task-handler-new-folder-permissions to 0o755 (original value 0o775). * if you alread
stable/configurations-ref.html#file-task-handler-new-folder-permissions to 0o755 (original value 0o775). * if you already ran Airflow tasks before and your default umask is 022 (group write disabled) you should stop Airflow components, check permissions of AIRFLOW_HOME/logs in all your components and all parent directories of this directory and remove group write access for all the parent directories Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/37310 - https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536 - http://www.openwall.com/lists/oss-security/2024/03/26/2
CVE ID: CVE-2024-29736 State: PUBLISHED Published: 2024-07-19T08:50:08.265Z Last Updated: 2024-11-15T13:08:15.763Z Vendors: Apache Software Foundation Products: Apache CXF Problem Types: CWE-918 Description: A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2
CVE ID: CVE-2024-29737 State: PUBLISHED Published: 2024-07-17T08:21:12.035Z Last Updated: 2025-02-13T17:47:42.503Z Vendors: Apache Software Foundation Products: Apache StreamPark (incubating) Problem Types: CWE-77 Description: In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore
hat system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low. Mitigation: all users should upgrade to 2.1.4 Background info: Log in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the "Build Argument". Note that there is no verification and interception of the special character "`". As a result, you will find that this injection command will be successfully executed after executing th
l character "`". As a result, you will find that this injection command will be successfully executed after executing the build. In the latest version, the special symbol ` is intercepted. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5 - http://www.openwall.com/lists/oss-security/2024/07/17/2
CVE ID: CVE-2024-29738 State: PUBLISHED Published: 2024-04-05T20:02:14.922Z Last Updated: 2025-03-28T23:21:46.408Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In gov_init, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29739 State: PUBLISHED Published: 2024-04-05T20:02:15.110Z Last Updated: 2024-08-21T13:26:14.668Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In tmu_get_temp_lut of tmu.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29740 State: PUBLISHED Published: 2024-04-05T20:02:15.268Z Last Updated: 2024-08-02T01:10:55.502Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In tmu_set_table of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29741 State: PUBLISHED Published: 2024-04-05T20:02:15.409Z Last Updated: 2025-02-27T19:23:09.401Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In pblS2mpuResume of s2mpu.c, there is a possible mitigation bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29742 State: PUBLISHED Published: 2024-04-05T20:02:15.557Z Last Updated: 2024-11-06T19:42:23.331Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In apply_minlock_constraint of dvfs.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29743 State: PUBLISHED Published: 2024-04-05T20:02:15.703Z Last Updated: 2025-03-24T19:51:45.310Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In tmu_set_temp_lut of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29744 State: PUBLISHED Published: 2024-04-05T20:02:15.850Z Last Updated: 2025-03-25T17:40:08.153Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In tmu_get_gov_time_windows, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29745 State: PUBLISHED Published: 2024-04-05T20:02:15.995Z Last Updated: 2025-10-21T23:05:22.006Z Vendors: Google Products: Android Problem Types: Information disclosure Description: there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29746 State: PUBLISHED Published: 2024-04-05T20:02:16.139Z Last Updated: 2024-08-27T14:53:44.018Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In lpm_req_handler of lpm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29747 State: PUBLISHED Published: 2024-04-05T20:02:16.283Z Last Updated: 2024-11-20T21:34:48.071Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In _dvfs_get_lv of dvfs.c, there is a possible out of bounds read due to a missing null check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29748 State: PUBLISHED Published: 2024-04-05T20:02:16.425Z Last Updated: 2025-10-21T23:05:21.822Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29749 State: PUBLISHED Published: 2024-04-05T20:02:16.572Z Last Updated: 2024-08-20T16:03:23.118Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In tmu_set_tr_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29750 State: PUBLISHED Published: 2024-04-05T20:02:16.720Z Last Updated: 2024-08-21T13:28:56.632Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In km_exp_did_inner of kmv.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29751 State: PUBLISHED Published: 2024-04-05T20:02:16.864Z Last Updated: 2024-11-05T14:44:02.451Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In asn1_ec_pkey_parse_p384 of asn1_common.c, there is a possible OOB Read due to a missing null check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29752 State: PUBLISHED Published: 2024-04-05T20:02:17.005Z Last Updated: 2024-08-26T19:49:20.859Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In tmu_set_tr_num_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29753 State: PUBLISHED Published: 2024-04-05T20:02:17.159Z Last Updated: 2025-03-25T16:05:47.054Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In tmu_set_control_temp_step of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29754 State: PUBLISHED Published: 2024-04-05T20:02:17.301Z Last Updated: 2025-03-27T20:54:35.652Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In TMU_IPC_GET_TABLE, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29755 State: PUBLISHED Published: 2024-04-05T20:02:17.440Z Last Updated: 2024-10-27T22:06:55.583Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In tmu_get_pi of tmu.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29756 State: PUBLISHED Published: 2024-04-05T20:02:17.580Z Last Updated: 2024-08-13T19:37:10.703Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In afe_callback of q6afe.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29757 State: PUBLISHED Published: 2024-04-05T20:02:17.718Z Last Updated: 2025-03-18T20:47:19.006Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: there is a possible permission bypass due to Debug certs being allowlisted. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-04-01
CVE ID: CVE-2024-29758 State: PUBLISHED Published: 2024-03-27T13:19:04.941Z Last Updated: 2024-08-02T01:10:55.596Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Kienso Products: Co-marquage service-public.fr Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kienso Co-marquage service-public.Fr allows Reflected XSS.This issue affects Co-marquage service-public.Fr: from n/a through 0.5.72. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/co-marquage-service-public/wordpress-co-marquage-ser
tainer: References: - https://patchstack.com/database/vulnerability/co-marquage-service-public/wordpress-co-marquage-service-public-fr-plugin-0-5-72-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29759 State: PUBLISHED Published: 2024-03-27T13:17:51.913Z Last Updated: 2025-04-10T20:06:19.235Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: CodePeople Products: Calculated Fields Form Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.This issue affects Calculated Fields Form: from n/a through 1.2.54. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/calculated-fields-form/wordpress-calculated-fields-form-plugin-1-
ences: - https://patchstack.com/database/vulnerability/calculated-fields-form/wordpress-calculated-fields-form-plugin-1-2-54-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29760 State: PUBLISHED Published: 2024-03-27T13:16:16.932Z Last Updated: 2024-08-02T01:10:55.438Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Pluggabl LLC Products: Booster for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster for WooCommerce allows Reflected XSS.This issue affects Booster for WooCommerce: from n/a through 7.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-jetpack/wordpress-booster-for-woocommerce-plugi
References: - https://patchstack.com/database/vulnerability/woocommerce-jetpack/wordpress-booster-for-woocommerce-plugin-7-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29761 State: PUBLISHED Published: 2024-03-27T13:14:39.215Z Last Updated: 2024-08-02T01:17:56.733Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Krunal Prajapati Products: WP Post Disclaimer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Krunal Prajapati WP Post Disclaimer allows Stored XSS.This issue affects WP Post Disclaimer: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-post-disclaimer/wordpress-wp-post-disclaimer-plugin-1-0-3-cross-
ces: - https://patchstack.com/database/vulnerability/wp-post-disclaimer/wordpress-wp-post-disclaimer-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29762 State: PUBLISHED Published: 2024-03-27T13:13:01.996Z Last Updated: 2024-08-02T01:17:56.737Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jory Hogeveen Products: Off-Canvas Sidebars & Menus (Slidebars) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) allows Stored XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through 0.5.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/off-canv
: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/off-canvas-sidebars/wordpress-off-canvas-sidebars-menus-slidebars-plugin-0-5-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29763 State: PUBLISHED Published: 2024-03-27T13:11:31.210Z Last Updated: 2024-08-02T01:17:56.742Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: realmag777 Products: WordPress Meta Data and Taxonomies Filter (MDTF) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Reflected XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vu
tional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-meta-data-filter-and-taxonomy-filter/wordpress-mdtf-meta-data-and-taxonomies-filter-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve