Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
lities_and_Exposures - https://github.com/bitcoin/bitcoin/releases/tag/v25.0 - https://bitcoincore.org/en/2024/10/08/disclose-blocktxn-crash/ - https://github.com/bitcoin/bitcoin/pull/26898 - https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-25.0.md
CVE ID: CVE-2024-35203 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T14:00:55.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part of its name, that is uploaded via the Mahara filebrowser system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.mahara.org/catalyst-security/mahara-security/-/merge_requests/6 - https://mahara.org/interaction/forum/topic.php?id=9519
CVE ID: CVE-2024-35204 State: PUBLISHED Published: 2024-05-13T00:00:00 Last Updated: 2024-10-01T19:07:38.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Veritas System Recovery before 23.3_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.veritas.com/support/en_US/security/VTS24-005
CVE ID: CVE-2024-35205 State: PUBLISHED Published: 2024-05-13T00:34:38.845Z Last Updated: 2025-02-13T15:54:04.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal. This potentially enables any application to dispatch a crafted library file, aiming to overwrite an existing native library utilized by WPS Office. Successful exploitation could result in the execution of arbitrary commands under the guise of WPS Office's application ID. Additional Analyst Notes: - CVE Pro
the execution of arbitrary commands under the guise of WPS Office's application ID. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.microsoft.com/en-us/security/blog/2024/05/01/dirty-stream-attack-discovering-and-mitigating-a-common-vulnerability-pattern-in-android-apps/
CVE ID: CVE-2024-35206 State: PUBLISHED Published: 2024-06-11T11:15:46.277Z Last Updated: 2025-02-11T10:28:37.047Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-613 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application does not expire the session. This could allow an attacker to get unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE ID: CVE-2024-35207 State: PUBLISHED Published: 2024-06-11T11:15:47.708Z Last Updated: 2024-08-02T03:07:46.833Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-352 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The web interface of the affected devices are vulnerable to Cross-Site Request Forgery(CSRF) attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform arbitrary actions on the device on behalf of the victim user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
ary actions on the device on behalf of the victim user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE ID: CVE-2024-35208 State: PUBLISHED Published: 2024-06-11T11:15:49.108Z Last Updated: 2024-08-02T03:07:46.442Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-522 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server stored the password in cleartext. This could allow attacker in a privileged position to obtain access passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE ID: CVE-2024-35209 State: PUBLISHED Published: 2024-06-11T11:15:50.551Z Last Updated: 2025-02-11T21:44:25.793Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-749 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowing HTTP methods like PUT and Delete. This could allow an attacker to modify unauthorized files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE ID: CVE-2024-35210 State: PUBLISHED Published: 2024-06-11T11:15:52.053Z Last Updated: 2025-02-11T10:28:40.891Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-319 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE ID: CVE-2024-35211 State: PUBLISHED Published: 2024-06-11T11:15:53.465Z Last Updated: 2025-02-11T10:28:42.164Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-614 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ss
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE ID: CVE-2024-35212 State: PUBLISHED Published: 2024-06-11T11:15:54.878Z Last Updated: 2025-02-11T10:28:43.385Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: SINEC Traffic Analyzer Problem Types: CWE-20 Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application lacks input validation due to which an attacker can gain access to the Database entries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE ID: CVE-2024-35213 State: PUBLISHED Published: 2024-06-11T18:37:04.161Z Last Updated: 2025-09-09T15:04:56.924Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: BlackBerry Products: QNX Software Development Platform (SDP) Problem Types: CWE-1287 Description: An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause a denial-of-service condition or execute code in the context of the image processing process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.blackberry.com/pkb/s/article/139914
CVE ID: CVE-2024-35214 State: PUBLISHED Published: 2024-08-20T17:24:53.815Z Last Updated: 2024-09-29T05:02:37.739Z Vendors: BlackBerry Products: CylanceOPTICS for Windows Problem Types: CWE-288 Description: A tampering vulnerability in the CylanceOPTICS Windows Installer Package of CylanceOPTICS for Windows version 3.2 and 3.3 could allow an attacker to potentially uninstall CylanceOPTICS from a system thereby leaving it with only the protection of CylancePROTECT. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.blackberry.com/pkb/s/article/140080
CVE ID: CVE-2024-35215 State: PUBLISHED Published: 2024-10-08T17:35:57.156Z Last Updated: 2025-08-22T15:47:01.556Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: BlackBerry Products: QNX Software Development Platform (SDP) Problem Types: CWE-476 Description: NULL pointer dereference in IP socket options processing of the Networking Stack in QNX Software Development Platform (SDP) version(s) 7.1 and 7.0 could allow an attacker with local access to cause a denial-of-service condition in the context of the Networking Stack process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.blackberry.com/pkb/s/article/140162
CVE ID: CVE-2024-35218 State: PUBLISHED Published: 2024-05-21T13:42:27.260Z Last Updated: 2024-08-02T03:07:46.766Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-79 Description: Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/umbraco/U
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-gvpc-3pj6-4m9w - https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec52aa4e71b3acf63e393c8e6ab85385 - https://github.com/umbraco/Umbraco-CMS/commit/a2684069b1e9976444f60b4b37a80be05b87f6b6 - https://github.com/umbraco/Umbraco-CMS/commit/cbf9f9bcd199d7ca0412be3071d275556f10b7ba - https://github.com/umbraco/Umbraco-CMS/commit/d090176272d07500dac0daee7c598aa8bb321050
CVE ID: CVE-2024-35219 State: PUBLISHED Published: 2024-05-27T16:11:22.875Z Last Updated: 2024-08-02T03:07:46.738Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: OpenAPITools Products: openapi-generator Problem Types: CWE-22 Description: OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed i
ory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h - https://github.com/OpenAPITools/openapi-generator/pull/18652 - https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
CVE ID: CVE-2024-35220 State: PUBLISHED Published: 2024-05-21T20:26:53.312Z Last Updated: 2024-08-02T03:07:46.810Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: fastify Products: session Problem Types: CWE-613 Description: @fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. This vulnerability has been patched 10.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http
has been patched 10.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/fastify/session/security/advisories/GHSA-pj27-2xvp-4qxg - https://github.com/fastify/session/issues/251 - https://github.com/fastify/session/commit/0495ce5b534c4550f25228821db8098293439f2f
CVE ID: CVE-2024-35221 State: PUBLISHED Published: 2024-05-29T20:18:06.763Z Last Updated: 2024-08-02T03:07:46.784Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: rubygems Products: rubygems.org Problem Types: CWE-400 Description: Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks
gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4vc5-whwr-7hh2 - https://en.wikipedia.org/wiki/Billion_laughs_attack - https://github.com/ruby/ruby/blob/7cf74a2ff28b1b4c26e367d0d67521f7e1fed239/lib/rubygems/safe_yaml.rb#L28
CVE ID: CVE-2024-35222 State: PUBLISHED Published: 2024-05-23T13:20:26.220Z Last Updated: 2024-08-02T03:07:46.872Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: tauri-apps Products: tauri Problem Types: CWE-284 Description: Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities` in v2. Valid commands with potentially unwanted consequences ("delete project", "transfer credits", etc.) could be invoked by an attacker that controls the content of an iframe run
("delete project", "transfer credits", etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tauri-apps/tauri/security/advisories/GHSA-57fm-592m-34r7 - https://github.com/tauri-apps/tauri/issues/8316
CVE ID: CVE-2024-35223 State: PUBLISHED Published: 2024-05-23T08:47:40.289Z Last Updated: 2024-08-02T03:07:46.803Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dapr Products: dapr Problem Types: CWE-200 Description: Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This vulnerability impacts Dapr users who use Dapr as a gRPC proxy for remote service invocation as well as
invocation. This vulnerability impacts Dapr users who use Dapr as a gRPC proxy for remote service invocation as well as the Dapr App API token functionality. An attacker could exploit this vulnerability to gain access to the app token of the invoker app, potentially compromising security and authentication mechanisms. This vulnerability was patched in version 1.13.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dapr/dapr/security/advisories/GHSA-284c-x8m7-9w5h - https://github.com/dapr/dapr/issues/7344 - https://github.com/dapr/dapr/pull/7404 - https://github.com/dapr/dapr/commit/e0591e43d0cdfd30a2f2960dce5d9892dc98bc2c - https
://github.com/dapr/dapr/pull/7404 - https://github.com/dapr/dapr/commit/e0591e43d0cdfd30a2f2960dce5d9892dc98bc2c - https://github.com/dapr/dapr/releases/tag/v1.13.3
CVE ID: CVE-2024-35224 State: PUBLISHED Published: 2024-05-23T12:53:04.336Z Last Updated: 2024-08-02T03:07:46.774Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: opf Products: openproject Problem Types: CWE-80 Description: OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise,
tachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/opf/openproject/security/advisories/GHSA-h26c-j8wg-frjc - https://community.openproject.org/projects/openproject/work_packages/55198/relations
CVE ID: CVE-2024-35225 State: PUBLISHED Published: 2024-06-11T21:45:57.596Z Last Updated: 2024-08-02T03:07:46.821Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: jupyterhub Products: jupyter-server-proxy Problem Types: CWE-79, CWE-116 Description: Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupyter-server-prox
h segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/<host>`, which runs the custom JavaScript contained in `host` set by the actor. As any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. Patches are included in
shing link, this issue permits extensive access to the user's JupyterLab instance for an actor. Patches are included in versions 4.2.0 and 3.2.4. As a workaround, server operators who are unable to upgrade can disable the `jupyter-server-proxy` extension. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-fvcq-4x64-hqxr - https://github.com/jupyterhub/jupyter-server-proxy/commit/7abc9dc5bbb0b4b440548a5375261b8b8192fc22 - https://github.com/jupyterhub/jupyter-server-proxy/commit/ff78128087e73fb9d0909e1366f8bf051e8ea878 - https://github.com/jupyterhub/jupyter-server-proxy/blob/62a
rver-proxy/commit/ff78128087e73fb9d0909e1366f8bf051e8ea878 - https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328
CVE ID: CVE-2024-35226 State: PUBLISHED Published: 2024-05-28T20:55:00.884Z Last Updated: 2025-11-03T21:54:58.981Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: smarty-php Products: smarty Problem Types: CWE-94 Description: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability. Additional
update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w - https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a
CVE ID: CVE-2024-35227 State: PUBLISHED Published: 2024-07-03T17:39:38.293Z Last Updated: 2024-08-02T03:07:46.876Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-20 Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known workarounds available for this vulnerability
ch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known workarounds available for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-664f-xwjw-752c - https://github.com/discourse/discourse/commit/10afe5fcf1ebf2e49cb80716d5e62e184c53519b - https://github.com/discourse/discourse/commit/6ce5673d2c1a511b602e1b2ade6cdc898d14ab36
CVE ID: CVE-2024-35228 State: PUBLISHED Published: 2024-05-30T18:44:31.900Z Last Updated: 2024-08-02T03:07:46.735Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N) Vendors: wagtail Products: wagtail Problem Types: CWE-280 Description: Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access t
een granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 6.0.5 and 6.1.2. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability in `ModelViewSet` by registering the model as a snippet instead. No workaround is available for `wagtail.contrib.settings`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wagtail/wagtail/security/advisories/GHSA-xxfm-vmcf-g33f - https://github.com/wagtail/wagtail/commit
- https://github.com/wagtail/wagtail/security/advisories/GHSA-xxfm-vmcf-g33f - https://github.com/wagtail/wagtail/commit/284f75a6f91f7ab18cc304d7d34f33b559ae37b1