Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify). Separately, an attacker could upload a *new* entry to the transparency service, and substitute their new entry's time. However, this would still be rejected at validation time, as the new entry's (valid) signed time would be outside the validity window of the original signing certificate and would nonetheless render the attacker auditable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hhfg-fwrw-87w7 - https://github.com/sigstore/sigstore-python/commit/300b502ae99
sigstore-python/security/advisories/GHSA-hhfg-fwrw-87w7 - https://github.com/sigstore/sigstore-python/commit/300b502ae99ebfaace124f1f4e422a6a669369cf - https://github.com/sigstore/sigstore-python/releases/tag/v3.6.0
CVE ID: CVE-2024-55656 State: PUBLISHED Published: 2025-01-08T15:38:54.859Z Last Updated: 2025-01-08T15:52:23.554Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: RedisBloom Products: RedisBloom Problem Types: CWE-190 Description: RedisBloom adds a set of probabilistic data structures to Redis. There is an integer overflow vulnerability in RedisBloom, which is a module used in Redis. The integer overflow vulnerability allows an attacker (a redis client which knows the password) to allocate memory in the heap lesser than the required memory due to wraparound. Then read and write can be performed beyond this allocated memory, leading to info leak and OOB write.
e to wraparound. Then read and write can be performed beyond this allocated memory, leading to info leak and OOB write. The integer overflow is in CMS.INITBYDIM command, which initialize a Count-Min Sketch to dimensions specified by user. It accepts two values (width and depth) and uses them to allocate memory in NewCMSketch(). This vulnerability is fixed in 2.2.19, 2.4.12, 2.6.14, and 2.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RedisBloom/RedisBloom/security/advisories/GHSA-x5rx-rmq3-ff3h
CVE ID: CVE-2024-55657 State: PUBLISHED Published: 2024-12-11T22:44:17.868Z Last Updated: 2024-12-12T16:30:52.826Z Vendors: siyuan-note Products: siyuan Problem Types: CWE-22 Description: SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xx68-37v4-4596 - https://github.com/siyuan-note/siyuan/
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xx68-37v4-4596 - https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
CVE ID: CVE-2024-55658 State: PUBLISHED Published: 2024-12-11T22:47:21.809Z Last Updated: 2024-12-12T16:30:20.341Z Vendors: siyuan-note Products: siyuan Problem Types: CWE-22 Description: SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25w9-wqfq-gwqx - https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
CVE ID: CVE-2024-55659 State: PUBLISHED Published: 2024-12-11T22:53:45.983Z Last Updated: 2024-12-12T16:29:46.007Z Vendors: siyuan-note Products: siyuan Problem Types: CWE-22, CWE-79 Description: SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqj6-whhx-47p7 - https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
CVE ID: CVE-2024-55660 State: PUBLISHED Published: 2024-12-11T22:54:52.564Z Last Updated: 2024-12-12T16:29:14.433Z Vendors: siyuan-note Products: siyuan Problem Types: CWE-1336 Description: SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables. Version 3.1.16 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjc-pwgq-q9jp - https://github.co
ichment: References: - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjc-pwgq-q9jp - https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
CVE ID: CVE-2024-55661 State: PUBLISHED Published: 2024-12-13T16:04:51.788Z Last Updated: 2024-12-13T17:33:17.205Z Vendors: laravel Products: pulse Problem Types: CWE-94 Description: Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can e
d to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method in which the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable to component is `remember(callable $query, string $key = '')` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries`, and the vulnerability affects all Pulse card components that use this trait. Version 1.3.1 contains a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/laravel/pulse/security/advisories/GHSA-8vwh-pr89-4mw2 - https://git
A ADP Vulnrichment: References: - https://github.com/laravel/pulse/security/advisories/GHSA-8vwh-pr89-4mw2 - https://github.com/laravel/pulse/commit/d1a5bf2eca36c6e3bedb4ceecd45df7d002a1ebc
CVE ID: CVE-2024-55662 State: PUBLISHED Published: 2024-12-12T17:25:26.297Z Last Updated: 2024-12-13T14:59:39.724Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-96, CWE-863 Description: XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since `Extension Repository Application` is not mandatory, it can be safely disabled on instances t
15.10.9 and 16.3.0. Since `Extension Repository Application` is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page `ExtensionCode.ExtensionSheet` and to the page `ExtensionCode.ExtensionAuthorsDisplayer`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j2pq-22jj-4pm5 - https://github.com/xwiki/xwiki-platform/commit/8659f17d500522bf33595e402391592a35a162e8 - https://jira.xwiki.org/browse/XWIKI-21890
CVE ID: CVE-2024-55663 State: PUBLISHED Published: 2024-12-12T18:53:49.491Z Last Updated: 2024-12-16T18:08:43.496Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-116 Description: XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering of the returned documents is defined from an unsanitized request parameter (request.sort) and can allow any user to inject HQL. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This has been patched in
ation such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This has been patched in 13.10.5 and 14.3-rc-1. There is no known workaround, other than upgrading XWiki. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wh34-m772-5398 - https://github.com/xwiki/xwiki-platform/commit/673076e2e8b88a36cdeaf7007843aa9ca1a068a0 - https://jira.xwiki.org/browse/XWIKI-17568
CVE ID: CVE-2024-55864 State: PUBLISHED Published: 2024-12-17T04:43:53.952Z Last Updated: 2024-12-17T14:43:59.237Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: gqevu6bsiz Products: My WP Customize Admin/Frontend Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the administrative page with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/my-wp/#develo
g the page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/my-wp/#developers - https://mywpcustomize.com/update-history-my-wp-customize-admin-frontend-1-24-1/ - https://jvn.jp/en/vu/JVNVU90748215/
CVE ID: CVE-2024-55875 State: PUBLISHED Published: 2024-12-12T18:56:59.499Z Last Updated: 2024-12-13T14:55:49.763Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: http4k Products: http4k Problem Types: CWE-200, CWE-611, CWE-918 Description: http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 5.41.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances. Version 5.41.0.0 contains a patch for the is
Server-side Request Forgery and even execute code under some circumstances. Version 5.41.0.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw - https://github.com/http4k/http4k/commit/35297adc6d6aca4951d50d8cdf17ff87a8b19fbc - https://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46
CVE ID: CVE-2024-55876 State: PUBLISHED Published: 2024-12-12T18:59:49.733Z Last Updated: 2024-12-13T14:55:19.672Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-862 Description: XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance
a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cwq6-mjmx-47p6 - https://github.com/xwiki/xwiki-platform/commit/54bcc5a7a2e440cc591b91eece9c13dc0c487331 - https://jira.xwiki.org/browse/XWIKI-21663
CVE ID: CVE-2024-55877 State: PUBLISHED Published: 2024-12-12T19:13:43.128Z Last Updated: 2024-12-13T14:54:49.185Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-96 Description: XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible
of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible to manually apply the patch to the page `XWiki.XWikiSyntaxMacrosList` as a workaround. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2r87-74cx-2p7c - https://github.com/xwiki/xwiki-platform/commit/40e1afe001d61eafdf13f3621b4b597a0e58a3e3 - https://jira.xwiki.org/browse/XWIKI-22030
CVE ID: CVE-2024-55878 State: PUBLISHED Published: 2024-12-12T19:20:02.061Z Last Updated: 2024-12-13T15:57:54.961Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: shuchkin Products: simplexlsx Problem Types: CWE-79 Description: SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shuchkin/simplexlsx/security/adv
Ex. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-x6mh-rjwm-8ph7 - https://github.com/shuchkin/simplexlsx/commit/cb4e716259e83d18e89292a4f1b721f4d34e28c2
CVE ID: CVE-2024-55879 State: PUBLISHED Published: 2024-12-12T19:17:38.138Z Last Updated: 2024-12-13T14:54:21.161Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-862 Description: XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upg
ole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r279-47wg-chpr - https://github.com/xwiki/xwiki-platform/commit/8493435ff9606905a2d913607d6c79862d0c168d - https://jira.xwiki.org/browse/XWIKI-21207
CVE ID: CVE-2024-55881 State: PUBLISHED Published: 2025-01-11T12:35:44.019Z Last Updated: 2025-11-03T20:48:49.526Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Play nice with protected guests in complete_hypercall_exit() Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For guests with protected state, e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit mode as the vCPU state needed to detect 64-bit mode is unavailable. Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall via VMGEXIT trips the WARN: ---
ilable. Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall via VMGEXIT trips the WARN: ------------[ cut here ]------------ WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm] Modules linked in: kvm_amd kvm ... [last unloaded: kvm] CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat #470 Hardware name: Google Astoria/astoria, BIOS 0.20240617.0-0 06/17/2024 RIP: 0010:complete_hypercall_exit+0x44/0xe0 [kvm] Call Trace: <TASK> kvm_arch_vcpu_ioctl_run+0x2400/0x2720 [kvm] kvm_vcpu_ioctl+0x54f/0x630 [kvm] __se_sys_ioctl+0x6b/0xc0 do_syscall_64+0x83/0x160 entry_SYSCALL_64_after_hwframe+0
kvm] kvm_vcpu_ioctl+0x54f/0x630 [kvm] __se_sys_ioctl+0x6b/0xc0 do_syscall_64+0x83/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> ---[ end trace 0000000000000000 ]--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/0840d360a8909c722fb62459f42836afe32ededb - https://git.kernel.org/stable/c/7ed4db315094963de0678a8adfd43c46471b9349 - https://git.kernel.org/stable/c/3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6 - https://git.kernel.org/stable/c/22b5c2acd65dbe949032f619d4758a35a82fffc3 - https://git.kernel.org/stable/c/9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0
CVE ID: CVE-2024-55884 State: PUBLISHED Published: 2024-12-11T00:00:00 Last Updated: 2024-12-12T16:15:58.368Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes in enable() in exception_logging/unix.rs, aka MLLVD-CR-24-01. NOTE: achieving code execution is considered non-trivial. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://x41-dsec.de/news/2024/12/11/mullvad/ - https://news.ycombinator.com/item?id=423
ADP Vulnrichment: References: - https://x41-dsec.de/news/2024/12/11/mullvad/ - https://news.ycombinator.com/item?id=42390768 - https://github.com/mullvad/mullvadvpn-app/commit/ef6c862071b26023802b00d6e1dc6ca53d1ab3e6
CVE ID: CVE-2024-55885 State: PUBLISHED Published: 2024-12-12T19:23:14.239Z Last Updated: 2024-12-13T15:46:22.821Z Vendors: beego Products: beego Problem Types: CWE-328, CWE-327 Description: beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/beego/beego/security/advisories/GHSA-9j3m-fr7q-jxfw - https://github.com/beego/beego/commit/e7fa4835f71f47ab1d13afd638cebf661800d5a4
CVE ID: CVE-2024-55886 State: PUBLISHED Published: 2024-12-12T19:25:43.988Z Last Updated: 2024-12-13T15:45:10.895Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:H) Vendors: opensearch-project Products: data-prepper Problem Types: CWE-287 Description: OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication plugins will not perform authentication. This allows unauthorized users to ingest OpenTelemetry Logs data under certain conditions.
l not perform authentication. This allows unauthorized users to ingest OpenTelemetry Logs data under certain conditions. This vulnerability does not affect the built-in `http_basic` authentication provider in Data Prepper. Pipelines which use the `http_basic` authentication provider continue to require authentication. The vulnerability exists only for custom implementations of Data Prepper’s `GrpcAuthenticationProvider` authentication plugin which implement the `getHttpAuthenticationService()` method instead of `getAuthenticationInterceptor()`. Data Prepper 2.10.2 contains a fix for this issue. For those unable to upgrade, one may use the built-in `http_basic` authentication provider in Data
a fix for this issue. For those unable to upgrade, one may use the built-in `http_basic` authentication provider in Data Prepper and/or add an authentication proxy in front of one's Data Prepper instances running the OpenTelemetry Logs source. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opensearch-project/data-prepper/security/advisories/GHSA-725p-63vv-v948
CVE ID: CVE-2024-55887 State: PUBLISHED Published: 2024-12-13T16:08:55.658Z Last Updated: 2024-12-13T17:06:54.775Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: FHIR Products: Ucum-java Problem Types: CWE-611 Description: Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As
ing used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FHIR/Ucum-java/security/advisories/GHSA-w9j7-phm3-f97j
CVE ID: CVE-2024-55888 State: PUBLISHED Published: 2024-12-12T19:28:15.795Z Last Updated: 2024-12-13T15:40:32.295Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: scidsg Products: hushline Problem Types: CWE-1021 Description: Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scripting filters. Version 0.3.5 fixed the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/scidsg/hushline/sec
fixed the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/scidsg/hushline/security/advisories/GHSA-m592-g8qv-hrqx
CVE ID: CVE-2024-55889 State: PUBLISHED Published: 2024-12-13T13:44:57.630Z Last Updated: 2024-12-13T20:42:24.897Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: thorsten Products: phpMyFAQ Problem Types: CWE-451 Description: phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thorsten/phpMyFAQ/se