Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25636 State: PUBLISHED Published: 2024-02-19T19:42:20.688Z Last Updated: 2024-08-15T18:36:56.288Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: misskey-dev Products: misskey Problem Types: CWE-434 Description: Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Misskey instance fetch it, if the remot
ctor to upload a crafted Activity Streams document to a remote server and make a Misskey instance fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate and take over an account on a remote server that satisfies all of the following properties: allows the threat actor to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as legitimate Activity Streams actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Version 2024.2.0 contains a patch for the issue. Additional Analyst Notes: - CVE Program Container: - CI
ams media type. Version 2024.2.0 contains a patch for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-qqrm-9grj-6v32 - https://github.com/misskey-dev/misskey/commit/9a70ce8f5ea9df00001894809f5ce7bc69b14c8a - https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/core/activitypub/ApResolverService.ts#L69-L119 - https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/core/activitypub/models/ApNoteService.ts#L112-L308 - https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/server/api/endpoints/ap/sho
112-L308 - https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/server/api/endpoints/ap/show.ts#L125-L143
CVE ID: CVE-2024-25637 State: PUBLISHED Published: 2024-06-26T15:55:35.578Z Last Updated: 2024-08-01T23:44:09.889Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: octobercms Products: october Problem Types: CWE-79 Description: October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. This issue has been patched in version 3.5.15. Additional Analys
s only detectable when using a proxy interception tool. This issue has been patched in version 3.5.15. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563
CVE ID: CVE-2024-25638 State: PUBLISHED Published: 2024-07-22T14:05:29.278Z Last Updated: 2025-07-24T03:55:26.242Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: dnsjava Products: dnsjava Problem Types: CWE-345, CWE-349 Description: dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fw - https://github.com/dnsjava/dnsjava/commit/2073a0
://github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fw - https://github.com/dnsjava/dnsjava/commit/2073a0cdea2c560465f7ac0cc56f202e6fc39705
CVE ID: CVE-2024-25639 State: PUBLISHED Published: 2024-07-08T14:24:33.987Z Last Updated: 2024-08-01T23:44:09.829Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L) Vendors: khoj-ai Products: khoj Problem Types: CWE-80 Description: Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0. Additional Analyst Notes: - CISA ADP Vulnr
the user invokes the /online command. This vulnerability is fixed in 1.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/khoj-ai/khoj/security/advisories/GHSA-h2q2-vch3-72qm - https://github.com/khoj-ai/khoj/commit/1dfd6d7391862d3564db7f4875216880b73cb6cc
CVE ID: CVE-2024-25640 State: PUBLISHED Published: 2024-02-19T19:56:33.044Z Last Updated: 2024-08-01T23:44:09.792Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: dfir-iris Products: iris-web Problem Types: CWE-87 Description: Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.4.0. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to un
ipts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.4.0 of iris-web. No workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dfir-iris/iris-web/security/advisories/GHSA-2xq6-qc74-w5vp
CVE ID: CVE-2024-25641 State: PUBLISHED Published: 2024-05-13T13:28:58.808Z Last Updated: 2025-11-04T16:11:23.592Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-20 Description: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts t
located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88 - https://github.com/Cacti/cacti/commit/eff35b0f
https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88 - https://github.com/Cacti/cacti/commit/eff35b0ff26cc27c82d7880469ed6d5e3bef6210 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/ - http://seclists.org/fulldisclosure/2024/May/6
CVE ID: CVE-2024-25642 State: PUBLISHED Published: 2024-02-13T02:44:20.284Z Last Updated: 2025-05-08T15:49:42.852Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP Cloud Connector Problem Types: CWE-295 Description: Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication. Hence, the attacker can intercept the request to view/modify sensitive information. There is no impact on the availability of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/not
system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3424610 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - http://seclists.org/fulldisclosure/2024/May/26
CVE ID: CVE-2024-25643 State: PUBLISHED Published: 2024-02-13T03:37:14.954Z Last Updated: 2024-08-01T23:44:09.819Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Fiori app (My Overtime Requests) Problem Types: CWE-862 Description: The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to manipulate the URLs of data requests to access information that the user should not have access to. There is no impact on integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
ss to. There is no impact on integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3237638 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-25644 State: PUBLISHED Published: 2024-03-12T00:33:44.473Z Last Updated: 2024-09-28T22:24:11.195Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: NetWeaver (WSRM) Problem Types: CWE-732 Description: Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3425682 - https://support.sap.com/en/my-support/knowledge-base/security-notes
nt: References: - https://me.sap.com/notes/3425682 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
CVE ID: CVE-2024-25645 State: PUBLISHED Published: 2024-03-12T00:53:58.649Z Last Updated: 2024-09-28T22:24:54.688Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver (Enterprise Portal) Problem Types: CWE-732 Description: Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3428847 - https://support
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3428847 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
CVE ID: CVE-2024-25646 State: PUBLISHED Published: 2024-04-09T00:47:43.364Z Last Updated: 2024-09-28T22:25:36.576Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Web Intelligence Problem Types: CWE-732 Description: Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3421384 - https://sup
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3421384 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
CVE ID: CVE-2024-25647 State: PUBLISHED Published: 2024-11-13T21:08:08.840Z Last Updated: 2024-11-14T14:49:32.124Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Binary Configuration Tool software for Windows Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01138.html
CVE ID: CVE-2024-25648 State: PUBLISHED Published: 2024-04-30T14:38:39.662Z Last Updated: 2025-11-04T17:14:30.044Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visit
ck the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1959
CVE ID: CVE-2024-25649 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-08-27T18:37:01.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key, database credentials (when SQL Server Authentication is enabled), the encryption key of RabbitMQ queue messages, and session cookies. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25649
CVE ID: CVE-2024-25650 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-11-21T15:24:14.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This makes it possible for a PAM administrator to impersonate the Engine and exfiltrate sensitive information from the messages published in the RabbitMQ exchanges, without being audited in the application. Additional Analyst Notes: - CVE
messages published in the RabbitMQ exchanges, without being audited in the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25650
CVE ID: CVE-2024-25651 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-08-22T19:09:11.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25651
CVE ID: CVE-2024-25652 State: PUBLISHED Published: 2024-03-14T00:00:00.000Z Last Updated: 2025-05-20T14:46:12.371Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Delinea Products: Secret Server Problem Types: CWE-287 Description: In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through information obtained from the Custom Legacy Report functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
rom the Custom Legacy Report functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25652 - https://docs.delinea.com/online-help/secret-server/release-notes/ssc-rn-2024-02-10.htm - https://trust.delinea.com/ - https://docs.delinea.com/online-help/secret-server/admin/unlimited-administration-mode/index.htm?Highlight=unlimited%20admin
CVE ID: CVE-2024-25653 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-08-29T17:37:44.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25653
CVE ID: CVE-2024-25654 State: PUBLISHED Published: 2024-03-18T00:00:00.000Z Last Updated: 2025-03-14T00:32:18.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application server) to access credentials to authenticate to all services, and to decrypt sensitive data stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25654
CVE ID: CVE-2024-25655 State: PUBLISHED Published: 2024-03-18T00:00:00 Last Updated: 2024-08-28T15:44:55.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allows members (with read access to the application database) to decrypt the LDAP passwords of users who successfully authenticate to web management via LDAP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25655
CVE ID: CVE-2024-25656 State: PUBLISHED Published: 2024-03-18T00:00:00 Last Updated: 2024-08-02T15:29:07.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer Premises Equipment) devices storing arbitrarily large amounts of data during registration. This can potentially lead to DDoS attacks on the application database and, ultimately, affect the entire product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25656
CVE ID: CVE-2024-25657 State: PUBLISHED Published: 2024-03-18T00:00:00 Last Updated: 2024-08-22T19:38:20.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could allow attackers to redirect authenticated users to malicious websites. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25657
CVE ID: CVE-2024-25658 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-11-22T19:12:08.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the database or exported configuration files) to obtain SNMP users' usernames and passwords in cleartext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25658
CVE ID: CVE-2024-25659 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-01T17:55:47.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access files and directories outside the SFTP user home directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25659
CVE ID: CVE-2024-25660 State: PUBLISHED Published: 2024-10-01T00:00:00.000Z Last Updated: 2025-03-25T17:07:55.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of execution with unnecessary privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25660
CVE ID: CVE-2024-25661 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-01T15:10:16.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client allows guest OS administrators to obtain various users' passwords by reading memory dumps of the desktop application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25661
CVE ID: CVE-2024-25662 State: PUBLISHED Published: 2024-05-13T19:09:59.290Z Last Updated: 2025-02-13T15:47:10.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious URLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oxygenxml.com/security/advisory/SYNC-2024-020601.html
CVE ID: CVE-2024-25673 State: PUBLISHED Published: 2024-09-19T00:00:00.000Z Last Updated: 2025-03-19T20:09:05.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2024-25674 State: PUBLISHED Published: 2024-02-09T00:00:00 Last Updated: 2024-08-26T19:07:18.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/312d2d5422235235ddd211dcb6bb5bb09c07791f - https://github.com/MISP/MISP/compare/v2.4.183...v2.4.184