Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-48877 State: PUBLISHED Published: 2025-06-02T15:00:18.000Z Last Updated: 2025-11-03T19:31:30.350Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: xls2csv Products: xls2csv Problem Types: CWE-680 Description: A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2128
CVE ID: CVE-2024-48878 State: PUBLISHED Published: 2024-11-04T10:56:26.641Z Last Updated: 2024-11-04T15:22:39.321Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADManager Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2024-48878.html
CVE ID: CVE-2024-48881 State: PUBLISHED Published: 2025-01-11T12:25:18.614Z Last Updated: 2025-11-03T20:40:59.667Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") leads a NULL pointer deference in cache_set_flush(). 1721 if (!IS_ERR_OR_NULL(c->root)) 1722 list_add(&c->root->list, &c->btree_cache); >From the above code in cache_set_flush(), if previous registration code fails before allocating c->root, it is possible c->root is NULL as what it is initialized. __bch_btree_node_alloc() ne
e fails before allocating c->root, it is possible c->root is NULL as what it is initialized. __bch_btree_node_alloc() never returns NULL but c->root is possible to be NULL at above line 1721. This patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4379c5828492a4c2a651c8f826a01453bd2b80b0 - https://git.kernel.org/stable/c/336e30f32ae7c043fde0f6fa21586ff30bea9fe2 - https://git.kernel.org/stable/c/fb5fee35bdd18316a84b5f30881a24e1415e1464 - https://git.kernel.org/stable/c/5202391970ffbf81975251b3526b890ba027b715 - https://git.kernel.org/stable/c/cc05aa2c0117e20fa25a3c0d
.kernel.org/stable/c/5202391970ffbf81975251b3526b890ba027b715 - https://git.kernel.org/stable/c/cc05aa2c0117e20fa25a3c0d915f98b8f2e78667 - https://git.kernel.org/stable/c/5e0e913624bcd24f3de414475018d3023f060ee1 - https://git.kernel.org/stable/c/b2e382ae12a63560fca35050498e19e760adf8c0
CVE ID: CVE-2024-48883 State: PUBLISHED Published: 2025-01-13T00:00:00 Last Updated: 2025-01-13T19:34:44.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, and Modem 5300. The UE incorrectly handles a malformed uplink scheduling message, resulting in an information leak of the UE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-su
tor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-48883/
CVE ID: CVE-2024-48884 State: PUBLISHED Published: 2025-01-14T14:09:26.476Z Last Updated: 2025-08-07T14:17:44.186Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiOS, FortiManager, FortiProxy Problem Types: CWE-22 Description: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.
through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3 may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary files or a remote unauthenticated attacker to delete an arbitrary folder Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-259
CVE ID: CVE-2024-48885 State: PUBLISHED Published: 2025-01-16T09:01:52.958Z Last Updated: 2025-01-16T14:16:29.431Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiRecorder, FortiWeb, FortiVoice Problem Types: CWE-22 Description: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiRecorder versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4, FortiWeb versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10, 6.4.0 through 6.4.3, FortiVoice versions 7.0.0 through 7.0.4, 6.4.0 through 6.4.9, 6.0.0 through 6.0.12 allows attacker to escalate privilege via speci
versions 7.0.0 through 7.0.4, 6.4.0 through 6.4.9, 6.0.0 through 6.0.12 allows attacker to escalate privilege via specially crafted packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-259
CVE ID: CVE-2024-48886 State: PUBLISHED Published: 2025-01-14T14:09:34.647Z Last Updated: 2025-01-14T20:54:42.523Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:R) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-1390 Description: A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows atta
ugh 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-221
CVE ID: CVE-2024-48887 State: PUBLISHED Published: 2025-04-08T16:52:02.152Z Last Updated: 2025-04-09T04:00:33.735Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSwitch Problem Types: CWE-620 Description: A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-435
CVE ID: CVE-2024-48889 State: PUBLISHED Published: 2024-12-18T12:44:38.675Z Last Updated: 2025-08-27T21:26:21.403Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:X) Vendors: Fortinet Products: FortiManager Problem Types: CWE-78 Description: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiManager version 7.6.0, version 7.4.4 and below, version 7.2.7 and below, version 7.0.12 and below, version 6.4.14 and below and FortiManager Cloud version 7.4.4 and below, version 7.2.7 to 7.2.1, version 7.0.12 to 7.0.1 may allow an authenticated remote attacker to execute unauthorized code via FGF
7.2.7 to 7.2.1, version 7.0.12 to 7.0.1 may allow an authenticated remote attacker to execute unauthorized code via FGFM crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-425
CVE ID: CVE-2024-48890 State: PUBLISHED Published: 2025-01-14T14:09:50.944Z Last Updated: 2025-01-15T14:55:00.652Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSOAR Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7 and below may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted playbook Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-415
CVE ID: CVE-2024-48891 State: PUBLISHED Published: 2025-10-14T15:22:30.906Z Last Updated: 2025-10-21T03:55:26.648Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSOAR on-premise Problem Types: CWE-78 Description: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR 7.6.0 through 7.6.1, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an attacker who has already obtained a non-login low privileged shell access (via another hypothetical vulnerability) to perform a local privilege escalation via crafted commands. Additional Analys
(via another hypothetical vulnerability) to perform a local privilege escalation via crafted commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-412
CVE ID: CVE-2024-48892 State: PUBLISHED Published: 2025-08-12T19:00:07.291Z Last Updated: 2025-08-13T20:13:21.451Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSOAR Problem Types: CWE-23 Description: A relative path traversal vulnerability [CWE-23] in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an authenticated attacker to read arbitrary files via uploading a malicious solution pack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-421
CVE ID: CVE-2024-48893 State: PUBLISHED Published: 2025-01-14T14:08:29.839Z Last Updated: 2025-01-14T20:57:27.993Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSOAR Problem Types: CWE-79 Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack via the creation of malicious playbook. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-405
CVE ID: CVE-2024-48895 State: PUBLISHED Published: 2024-11-20T07:30:10.357Z Last Updated: 2024-11-20T15:16:26.650Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Rakuten Mobile, Inc. Products: Rakuten Turbo 5G Problem Types: CWE-78 Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote authenticated attacker may execute an arbitrary OS command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://network.mobile.rakuten.co.jp/internet/turbo/information/news/3184/ - https://jvn.j
P Vulnrichment: References: - https://network.mobile.rakuten.co.jp/internet/turbo/information/news/3184/ - https://jvn.jp/en/vu/JVNVU90667116/
CVE ID: CVE-2024-48896 State: PUBLISHED Published: 2024-11-18T11:13:10.346Z Last Updated: 2024-11-18T11:13:10.346Z Problem Types: CWE-209 Description: A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2318822
CVE ID: CVE-2024-48897 State: PUBLISHED Published: 2024-11-18T11:14:03.856Z Last Updated: 2024-11-19T14:52:32.175Z Problem Types: CWE-285 Description: A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2318821
CVE ID: CVE-2024-48898 State: PUBLISHED Published: 2024-11-18T11:14:26.903Z Last Updated: 2024-11-18T11:14:26.903Z Problem Types: CWE-862 Description: A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2318820
CVE ID: CVE-2024-48899 State: PUBLISHED Published: 2024-11-20T10:25:58.315Z Last Updated: 2024-11-20T19:16:12.331Z Problem Types: CWE-284 Description: A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2318819
CVE ID: CVE-2024-48900 State: PUBLISHED Published: 2024-11-13T14:27:07.416Z Last Updated: 2024-11-21T18:06:59.546Z Problem Types: CWE-200 Description: A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2318818
CVE ID: CVE-2024-48901 State: PUBLISHED Published: 2024-11-18T11:15:18.137Z Last Updated: 2024-11-18T11:15:18.137Z Problem Types: CWE-285 Description: A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2318817
CVE ID: CVE-2024-48902 State: PUBLISHED Published: 2024-10-10T10:34:39.436Z Last Updated: 2024-10-10T13:44:30.364Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: JetBrains Products: YouTrack Problem Types: CWE-862 Description: In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-48903 State: PUBLISHED Published: 2024-10-22T18:28:49.537Z Last Updated: 2025-03-13T13:22:14.725Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Deep Security Agent Description: An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0017997 - htt
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0017997 - https://www.zerodayinitiative.com/advisories/ZDI-24-1419/
CVE ID: CVE-2024-48904 State: PUBLISHED Published: 2024-10-22T18:28:59.027Z Last Updated: 2024-10-22T19:00:48.004Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Cloud Edge Description: An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: authentication is not required in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0017998 - https://www.zerodayinitiative.com/advisories/ZDI-24-1418/
CVE ID: CVE-2024-48905 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-06T15:21:05.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-082.txt
CVE ID: CVE-2024-48906 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-06T15:19:04.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-081.txt
CVE ID: CVE-2024-48907 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-02T14:53:51.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-083.txt
CVE ID: CVE-2024-48908 State: PUBLISHED Published: 2025-08-28T14:56:43.967Z Last Updated: 2025-08-28T20:11:46.131Z Vendors: lycheeverse Products: lychee-action Problem Types: CWE-94 Description: lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x - https://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d
e-action/security/advisories/GHSA-65rg-554r-9j5x - https://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d455af97419279d86aafaede
CVE ID: CVE-2024-48909 State: PUBLISHED Published: 2024-10-14T20:22:17.777Z Last Updated: 2024-10-15T14:45:43.494Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: authzed Products: spicedb Problem Types: CWE-172 Description: SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-
as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/authzed/spicedb/security/advisories/GHSA-3c32-4hq9-6wgj - https://github.com/authzed/spicedb/commit/2f3cf77a7fcfcb478ef5a480a245842c96ac8853
CVE ID: CVE-2024-48910 State: PUBLISHED Published: 2024-10-31T14:22:52.867Z Last Updated: 2025-11-03T20:41:01.064Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: cure53 Products: DOMPurify Problem Types: CWE-1321 Description: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr - https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
CVE ID: CVE-2024-48911 State: PUBLISHED Published: 2024-10-14T20:45:57.810Z Last Updated: 2024-10-15T14:44:42.093Z Vendors: thinkst Products: opencanary Problem Types: CWE-863 Description: OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon. Version 0.9.4 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thinkst/opencanary/security/adv
sue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thinkst/opencanary/security/advisories/GHSA-pf5v-pqfv-x8jj - https://github.com/thinkst/opencanary/commit/2c11575b1a3dd8b0df26a879ba856c0aa350c049 - https://github.com/thinkst/opencanary/releases/tag/v0.9.4
CVE ID: CVE-2024-48912 State: PUBLISHED Published: 2024-12-11T17:03:10.014Z Last Updated: 2024-12-11T19:32:49.465Z Vendors: glpi-project Products: glpi Problem Types: CWE-284 Description: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-vjmw-j32j-ph4f - https://github.com/glpi-project/glpi/releases/tag/10.0.17
CVE ID: CVE-2024-48913 State: PUBLISHED Published: 2024-10-15T15:56:14.408Z Last Updated: 2024-11-07T18:33:39.270Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: honojs Products: hono Problem Types: CWE-352 Description: Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. This can allow an attacker to bypass CSRF protection implemented with Hono CSRF middleware. Version 4.6.5 fixes this issue. Additional Analyst Notes
o bypass CSRF protection implemented with Hono CSRF middleware. Version 4.6.5 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/honojs/hono/security/advisories/GHSA-2234-fmw7-43wr - https://github.com/honojs/hono/commit/aa50e0ab77b5af8c53c50fe3b271892f8eeeea82 - https://github.com/honojs/hono/blob/cebf4e87f3984a6a034e60a43f542b4c5225b668/src/middleware/csrf/index.ts#L76-L89
CVE ID: CVE-2024-48914 State: PUBLISHED Published: 2024-10-15T16:08:29.033Z Last Updated: 2024-10-15T18:56:17.334Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: vendure-ecommerce Products: vendure Problem Types: CWE-22, CWE-20 Description: Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server. In the same code path is an