Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1657 State: PUBLISHED Published: 2024-04-25T16:28:38.094Z Last Updated: 2025-11-20T07:11:50.375Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 Problem Types: CWE-1385 Description: A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system. Additional An
ad all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1057 - https://access.redhat.com/security/cve/CVE-2024-1657 - https://bugzilla.redhat.com/show_bug.cgi?id=2265085
CVE ID: CVE-2024-1658 State: PUBLISHED Published: 2024-03-18T15:15:26.211Z Last Updated: 2025-03-27T21:13:53.350Z Vendors: Unknown Products: Grid Shortcodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/9489925e-5a47-4608-90a2-0139c5e1c43c/
CVE ID: CVE-2024-1659 State: PUBLISHED Published: 2024-06-12T13:48:01.324Z Last Updated: 2024-08-01T18:48:21.437Z Vendors: Jan Syski Products: MegaBIP Problem Types: CWE-434 Description: Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) without an authentication. This issue affects MegaBIP software versions through 5.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/06/CVE-2024-1576/ - https://cert.pl/posts/2024/06/CVE-2024-1576/ - https://megabip.pl/ - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczens
2024-1576/ - https://megabip.pl/ - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
CVE ID: CVE-2024-1660 State: PUBLISHED Published: 2024-04-15T05:00:04.066Z Last Updated: 2024-08-01T18:48:21.539Z Vendors: Unknown Products: Top Bar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5bd16f84-22bf-4170-b65c-08caf67d0005/
CVE ID: CVE-2024-1661 State: PUBLISHED Published: 2024-02-20T12:30:37.576Z Last Updated: 2024-08-28T17:55:33.827Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Totolink Products: X6000R Problem Types: CWE-798 Description: A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated
. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254179. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.254179 - https://vuldb.com/?ctiid.254179 - https://github.com/WoodManGitHub/MyCVEs/blob/main/2024-Totolink/X6000R-Hardcoded-Password.md
CVE ID: CVE-2024-1662 State: PUBLISHED Published: 2024-06-05T11:51:51.074Z Last Updated: 2025-10-14T12:38:34.557Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PORTY Smart Tech Technology Joint Stock Company Products: PowerBank Application Problem Types: CWE-306, CWE-862 Description: Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allows Retrieve Embedded Sensitive Data.This issue affects PowerBank Application: before 2.02. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-06
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0602
CVE ID: CVE-2024-1663 State: PUBLISHED Published: 2025-05-15T20:09:43.919Z Last Updated: 2025-05-20T14:28:53.994Z Vendors: Unknown Products: Ultimate Noindex Nofollow Tool II Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6d101f2b-e903-4e64-92cc-e550abb52d6f/
CVE ID: CVE-2024-1664 State: PUBLISHED Published: 2024-04-09T05:00:01.700Z Last Updated: 2024-10-27T22:30:52.444Z Vendors: Unknown Products: Responsive Gallery Grid Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/fc3beca7-af38-4ab2-b05f-13b47d042b85/
CVE ID: CVE-2024-1665 State: REJECTED Published: 2024-04-16T00:00:14.606Z Last Updated: 2024-06-07T16:55:45.980Z Description: No description available.
CVE ID: CVE-2024-1666 State: PUBLISHED Published: 2024-04-16T00:00:13.999Z Last Updated: 2024-08-01T18:48:21.497Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-770 Description: In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result, attackers can bypass the intended account upgrade requirement by directly sending crafted requests to the server, enabling the creation of an
the intended account upgrade requirement by directly sending crafted requests to the server, enabling the creation of an unlimited number of radars without payment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/0f310501-b5b0-4be0-ae38-d6b836f71ff0 - https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54
CVE ID: CVE-2024-1668 State: PUBLISHED Published: 2024-03-13T15:32:40.387Z Last Updated: 2024-08-01T18:48:21.727Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ThemeFusion Products: Avada | Website Builder For WordPress & WooCommerce Problem Types: CWE-284 Improper Access Control Description: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page. This makes it possible for authenticated attackers, with contributor access and above, to view the contents of all form submissions, including fields that are obfuscated (such as t
tributor access and above, to view the contents of all form submissions, including fields that are obfuscated (such as the contact form's "password" field). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=cve - https://gist.github.com/Xib3rR4dAr/91bd37338022b15379f393356d1056a1
CVE ID: CVE-2024-1669 State: PUBLISHED Published: 2024-02-21T03:14:41.172Z Last Updated: 2025-02-13T17:32:20.435Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html - https://issues.chromium.org/issues/41495060 - https://lists.fedoraproject.org/archives/list/package-announce@lists.
ml - https://issues.chromium.org/issues/41495060 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE ID: CVE-2024-1670 State: PUBLISHED Published: 2024-02-21T03:14:42.368Z Last Updated: 2025-02-13T17:32:21.090Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html - https://issues.chromium.org/issues/41481374 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q
m.org/issues/41481374 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE ID: CVE-2024-1671 State: PUBLISHED Published: 2024-02-21T03:14:42.722Z Last Updated: 2025-03-27T19:39:28.551Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html - https://issues.chromium.org/issues/41487933 - https://lists.fedoraproject.org/archives/list/package-announc
op_20.html - https://issues.chromium.org/issues/41487933 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE ID: CVE-2024-1672 State: PUBLISHED Published: 2024-02-21T03:14:43.219Z Last Updated: 2025-02-13T17:32:22.436Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html - https://issues.chromium.org/issues/41485789 - https://lists.fedoraproject.org/archives/list/packag
for-desktop_20.html - https://issues.chromium.org/issues/41485789 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE ID: CVE-2024-1673 State: PUBLISHED Published: 2024-02-21T03:14:43.770Z Last Updated: 2025-02-13T17:32:23.320Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html - https://issues.chromium.org/issues/41490491 - https://lists.fedoraproject.org/archives/li
l-update-for-desktop_20.html - https://issues.chromium.org/issues/41490491 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE ID: CVE-2024-1674 State: PUBLISHED Published: 2024-02-21T03:14:44.178Z Last Updated: 2025-02-13T17:32:24.004Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html - https://issues.chromium.org/issues/40095183 - https://lists.fedoraproject.org/archives/list/package-announce@li
0.html - https://issues.chromium.org/issues/40095183 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE ID: CVE-2024-1675 State: PUBLISHED Published: 2024-02-21T03:14:44.687Z Last Updated: 2025-03-14T16:15:08.494Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html - https://issues.chromium.org/issues/41486208 - https://lists.fedoraproject.org/archives/list/package-announc
op_20.html - https://issues.chromium.org/issues/41486208 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE ID: CVE-2024-1676 State: PUBLISHED Published: 2024-02-21T03:14:45.164Z Last Updated: 2025-02-13T17:32:25.204Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html - https://issues.chromium.org/issues/40944847 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraprojec
/issues.chromium.org/issues/40944847 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE ID: CVE-2024-1677 State: PUBLISHED Published: 2024-05-02T16:52:13.585Z Last Updated: 2024-08-01T18:48:21.518Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: ukrsolution Products: Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to an improper capability check on 42 separate AJAX functions in all versions up to, and including, 3.4.6. This makes it possi
improper capability check on 42 separate AJAX functions in all versions up to, and including, 3.4.6. This makes it possible for authenticated attackers, with subscriber access and above, to fully control the plugin which includes the ability to modify plugin settings and profiles, and create, edit, retrieve, and delete templates and barcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e15d285-aa1d-461d-bdc2-642e7ccd789b?source=cve - https://plugins.trac.wordpress.org/browser/a4-barcode-generator/trunk/class/Request.php?rev=2870656
CVE ID: CVE-2024-1678 State: PUBLISHED Published: 2024-05-02T16:52:08.906Z Last Updated: 2024-08-15T18:43:13.686Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dunhakdis Products: Subway – Private Site Option Problem Types: CWE-284 Improper Access Control Description: The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's private site feature and view restricted page and post content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
icted page and post content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b80638b-4dd1-47f5-9a70-6bd626ac6986?source=cve - https://wordpress.org/plugins/subway/
CVE ID: CVE-2024-1679 State: PUBLISHED Published: 2024-05-02T16:52:35.334Z Last Updated: 2024-08-01T18:48:21.537Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ukrsolution Products: Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template and javascript label fields in all versions up to, and including, 3.4.6 due to insufficient input
ting via the template and javascript label fields in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2d03b83-c406-4d3f-b6be-015edcc15515?source=cve - https://plugins.trac.wordpress.org/browser/a4-barcode-generator/trunk/class/BarcodeTemplates/BarcodeTemplatesController.php?rev=2870656
CVE ID: CVE-2024-1680 State: PUBLISHED Published: 2024-03-13T15:26:55.863Z Last Updated: 2024-08-01T18:48:21.648Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Settings URL of the Banner, Team Members, and Image Scroll widgets in all versions up to, and including, 4.10.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,
4.10.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2d0b38-8241-456f-a79b-5d31132b3233?source=cve - https://plugins.trac.wordpress.org/changeset/3041548/premium-addons-for-elementor
CVE ID: CVE-2024-1681 State: PUBLISHED Published: 2024-04-19T19:37:27.998Z Last Updated: 2025-11-03T19:29:18.706Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: corydolphin Products: corydolphin/flask-cors Problem Types: CWE-117 Description: corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due t
ially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
CVE ID: CVE-2024-1682 State: PUBLISHED Published: 2024-11-14T17:32:13.313Z Last Updated: 2024-11-18T20:28:22.779Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: psf Products: psf/requests Problem Types: CWE-840 Description: An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and potential further attacks if the bucket is used to host malicious content or as a pivot point for further attacks. Additional Analyst No
r attacks if the bucket is used to host malicious content or as a pivot point for further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4da5ded5-b59b-4ece-8812-46a4329e446c - https://github.com/psf/requests/commit/6106a63eb6c0fa490efa73d44388ac25b1b08af4