Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37141 State: PUBLISHED Published: 2024-06-26T04:00:34.863Z Last Updated: 2024-08-02T03:50:54.576Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Dell Products: PowerProtect DD Problem Types: CWE-601 Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-u
ferences: - https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-37142 State: PUBLISHED Published: 2024-07-31T08:19:17.173Z Last Updated: 2024-07-31T16:42:38.695Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Peripheral Manager Problem Types: CWE-427 Description: Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242
CVE ID: CVE-2024-37143 State: PUBLISHED Published: 2024-12-10T02:25:33.225Z Last Updated: 2024-12-11T17:16:29.723Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: Dell PowerFlex appliance, Dell PowerFlex rack, Dell PowerFlex custom node, Dell InsightIQ, Dell Data Lakehouse Problem Types: CWE-59 Description: Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versi
using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Improper Link Resolution Before File Access vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to execute arbitrary code on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities
CVE ID: CVE-2024-37144 State: PUBLISHED Published: 2024-12-10T02:11:13.298Z Last Updated: 2024-12-10T21:27:23.301Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: Dell PowerFlex appliance, Dell PowerFlex rack, Dell PowerFlex custom node, Dell InsightIQ, Dell Data Lakehouse Problem Types: CWE-922 Description: Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse version
ing PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Insecure Storage of Sensitive Information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure. The attacker may be able to use information disclosed to gain unauthorized access to pods within the cluster. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities
CVE ID: CVE-2024-37145 State: PUBLISHED Published: 2024-07-01T18:19:02.779Z Last Updated: 2024-08-02T03:50:54.745Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-79 Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/chatflows-streaming/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false
ly crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups, or even redirect the user to other websites without interaction. If the chatflow ID is not found, its value is reflected in the 404 page, which has type text/html. This allows an attacker to attach arbitrary scripts to the page, allowing an attacker to steal sensitive information. This XSS may be chained with the path injection to allow an attacker without direct access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
cation, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/ - https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L375-L375
CVE ID: CVE-2024-37146 State: PUBLISHED Published: 2024-07-01T18:25:02.670Z Last Updated: 2024-08-02T03:50:54.583Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-79 Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/credentials/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups,
ed URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups, or even redirect the user to other websites without interaction. If the chatflow ID is not found, its value is reflected in the 404 page, which has type text/html. This allows an attacker to attach arbitrary scripts to the page, allowing an attacker to steal sensitive information. This XSS may be chained with the path injection to allow an attacker without direct access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/ - https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L545-L545
CVE ID: CVE-2024-37147 State: PUBLISHED Published: 2024-07-10T18:38:37.588Z Last Updated: 2024-08-02T03:50:54.626Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-284 Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-f2cg-fc85-ffmh
CVE ID: CVE-2024-37148 State: PUBLISHED Published: 2024-07-10T19:18:09.444Z Last Updated: 2024-11-19T14:15:49.487Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrade to 10.0.16. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/secu
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-p626-hph9-p6fj
CVE ID: CVE-2024-37149 State: PUBLISHED Published: 2024-07-10T19:20:36.161Z Last Updated: 2024-11-19T14:15:12.413Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: glpi-project Products: glpi Problem Types: CWE-73 Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisorie
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-cwvp-j887-m4xh
CVE ID: CVE-2024-37150 State: PUBLISHED Published: 2024-06-06T15:28:14.216Z Last Updated: 2024-08-02T03:50:54.672Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: denoland Products: deno Problem Types: CWE-200 Description: An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usag
RLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usage. It is recommended to upgrade to Deno 1.44.1 and if your private registry ever serves tarballs at a different domain to rotate your registry credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/denoland/deno/security/advisories/GHSA-rfc6-h225-3vxv - https://github.com/denoland/deno/commit/566adb7c0a0c0845e90a6e867a2c0ef5d2ada575 - https://github.com/npm/cli/wiki/%22No-auth-for-URI,-but-auth-present-for-scoped-registry%22
CVE ID: CVE-2024-37151 State: PUBLISHED Published: 2024-07-11T14:39:32.766Z Last Updated: 2025-11-03T19:30:13.398Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: OISF Products: suricata Problem Types: CWE-754 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refer
g` to reduce the scope of the problem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24 - https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0 - https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b - https://redmine.openinfosecfoundation.org/issues/7041 - https://redmine.openinfosecfoundation.org/issues/7042
CVE ID: CVE-2024-37152 State: PUBLISHED Published: 2024-06-06T15:33:29.843Z Last Updated: 2024-08-02T03:50:55.946Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: argoproj Products: argo-cd Problem Types: CWE-287, CWE-306 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.co
and 2.9.17. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2 - https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771b
CVE ID: CVE-2024-37153 State: PUBLISHED Published: 2024-06-06T18:51:30.638Z Last Updated: 2024-08-02T03:50:54.784Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: evmos Products: evmos Problem Types: CWE-670 Description: Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that is using the contract address as the sender parameter in an ICS20 transfer using the ICS20 precompile. This is in essence the "infinite money glitc
ss as the sender parameter in an ICS20 transfer using the ICS20 precompile. This is in essence the "infinite money glitch" allowing contracts to double the supply of Evmos after each transaction.The issue has been patched in versions >=V18.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/evmos/evmos/security/advisories/GHSA-xgr7-jgq3-mhmc - https://github.com/evmos/evmos/commit/478b7a62e7af57a70cf3a01126c7f5a89bee69d7
CVE ID: CVE-2024-37154 State: PUBLISHED Published: 2024-06-06T19:04:08.386Z Last Updated: 2024-08-02T03:50:55.197Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: evmos Products: evmos Problem Types: CWE-285 Description: Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via `ClawbackVestingAccount`. This affects 18.1.0 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/evmos/evmos/security/advisories/GHSA-7hrh-v6wp-53vw
CVE ID: CVE-2024-37155 State: PUBLISHED Published: 2024-11-18T15:06:32.886Z Last Updated: 2024-11-18T21:38:54.470Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: OpenCTI-Platform Products: opencti Problem Types: CWE-284 Description: OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query. GraphQL Queries in OpenCTI can be validated using the `secureIntrospectionPlugin`. The regex check in the plkugin
uery. GraphQL Queries in OpenCTI can be validated using the `secureIntrospectionPlugin`. The regex check in the plkugin can be bypassed by removing the carriage return and line feed characters (`\r\n`). Running a curl command against a local instance of OpenCTI will result in a limited error message. By running the same Introspection query without the `\r\n` characters, the unauthenticated user is able to successfully run a full Introspection query. Bypassing this restriction allows the attacker to gather a wealth of information about the GraphQL endpoint functionality that can be used to perform actions and/or read data without authorization. These queries can also be weaponized to conduct
can be used to perform actions and/or read data without authorization. These queries can also be weaponized to conduct a Denial of Service (DoS) attack if sent repeatedly. Users should upgrade to version 6.1.9 to receive a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-4mvw-j8r9-xcgc - https://github.com/OpenCTI-Platform/opencti/commit/f87d96918c63b0c3d3ebfbea6c789d48e2f56ad5 - https://github.com/OpenCTI-Platform/opencti/blob/6343b82b0b0a5d3ded3b30d08ce282328a556268/opencti-platform/opencti-graphql/src/graphql/graphql.js#L83-L94
CVE ID: CVE-2024-37156 State: PUBLISHED Published: 2024-06-06T16:03:46.771Z Last Updated: 2024-08-02T03:50:54.830Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sulu Products: SuluFormBundle Problem Types: CWE-80, CWE-79 Description: The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sulu/SuluFormBundle/security/advisories/GHSA-rrvc-c7xg-7cf3 - https://github.com/sulu/SuluFormBundle/
https://github.com/sulu/SuluFormBundle/security/advisories/GHSA-rrvc-c7xg-7cf3 - https://github.com/sulu/SuluFormBundle/commit/3f341b71a7309cbc8fd2c5bff894c654d1679b17
CVE ID: CVE-2024-37157 State: PUBLISHED Published: 2024-07-03T19:13:42.868Z Last Updated: 2024-08-02T03:50:55.878Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: discourse Products: discourse Problem Types: CWE-918 Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, a malicious actor could get the FastImage library to redirect requests to an internal Discourse IP. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. No known workarounds are available. Additional
branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-46pq-7958-fc68 - https://github.com/discourse/discourse/commit/5b8cf11b69e05d5c058c1148ec69ec309491fa6e - https://github.com/discourse/discourse/commit/67e78086035cec494b15ce79342a0cb9052c2d95
CVE ID: CVE-2024-37158 State: PUBLISHED Published: 2024-06-17T14:03:22.635Z Last Updated: 2024-08-02T03:50:54.802Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: evmos Products: evmos Problem Types: CWE-691 Description: Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different. The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by s
ntation are different. The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module. This vulnerability is fixed in 18.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v - https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb
CVE ID: CVE-2024-37159 State: PUBLISHED Published: 2024-06-17T14:03:29.684Z Last Updated: 2024-08-02T03:50:55.078Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: evmos Products: evmos Problem Types: CWE-285 Description: Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vulnerability is fixed in 18.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v - https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e777
vmos/security/advisories/GHSA-pxv8-qhrh-jc7v - https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb
CVE ID: CVE-2024-37160 State: PUBLISHED Published: 2024-06-07T14:09:55.132Z Last Updated: 2024-08-02T03:50:55.370Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: getformwork Products: formwork Problem Types: CWE-79 Description: Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http
ility is fixed in 1.13.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/getformwork/formwork/security/advisories/GHSA-5pxr-7m4j-jjc6 - https://github.com/getformwork/formwork/commit/9d471204f7ebb51c3c27131581c2b834315b5e0b - https://github.com/getformwork/formwork/commit/f5312015a5a5e89b95ef2bd07e496f8474d579c5
CVE ID: CVE-2024-37161 State: PUBLISHED Published: 2024-06-11T14:07:12.917Z Last Updated: 2024-08-02T03:50:54.743Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: metersphere Products: metersphere Problem Types: CWE-79 Description: MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/metersphere/metersphere/security/advisories/GHSA-6h7v-q5rp-h6q9
CVE ID: CVE-2024-37162 State: PUBLISHED Published: 2024-06-07T14:19:16.754Z Last Updated: 2024-08-02T03:50:55.218Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IdoPesok Products: zsa Problem Types: CWE-209 Description: zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This informa
. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This information could be used to plan further attacks or gain a deeper understanding of the server infrastructure. This has been patched on `0.3.3`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/IdoPesok/zsa/security/advisories/GHSA-wjmj-h3xc-hxp8 - https://github.com/IdoPesok/zsa/commit/86b86b282bde6780963f62406cc8bc65f2c86f3a