Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the `formula` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-4pp3-4mw7-qfwr - https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patch - https://xibosignage.com/blog/security-advisory-2024-07
CVE ID: CVE-2024-41805 State: PUBLISHED Published: 2024-07-26T14:51:02.015Z Last Updated: 2024-08-02T04:46:52.945Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: TracksApp Products: tracks Problem Types: CWE-79 Description: Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cross-site scripting enables execution of malicious JavaScript in the context of a user’s browser if that user clicks on a malicious link, allowing phishing attacks that could lead to credential theft. Tracks version 2.7.1 is patched. No known complete workarounds are available. Additional Analyst Not
o credential theft. Tracks version 2.7.1 is patched. No known complete workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TracksApp/tracks/security/advisories/GHSA-fp4p-59hr-3695 - https://github.com/TracksApp/tracks/commit/b0d288d2efd0f8020d04ca95b8e0738a9eab6c51 - https://github.com/TracksApp/tracks/commit/c23ca0574ec1149993476632ffd66643aec6aac2 - https://github.com/TracksApp/tracks/releases/tag/v2.7.1
CVE ID: CVE-2024-41806 State: PUBLISHED Published: 2024-07-25T14:34:12.579Z Last Updated: 2024-08-02T04:46:52.944Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: openedx Products: edx-platform Problem Types: CWE-284 Description: The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae76852
es versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c - https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b
CVE ID: CVE-2024-41807 State: REJECTED Published: N/A Last Updated: 2024-07-26T15:30:00.595Z Description: No description available.
CVE ID: CVE-2024-41808 State: PUBLISHED Published: 2024-07-25T20:10:04.248Z Last Updated: 2024-08-02T04:46:52.985Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: openobserve Products: openobserve Problem Types: CWE-79 Description: The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. It has been noted that the front-end uses `DOMPurify` or Vue templating to escape cross-site scripting (XSS) extensively, however certain a
hat the front-end uses `DOMPurify` or Vue templating to escape cross-site scripting (XSS) extensively, however certain areas of the front end lack this XSS protection. When combining the missing protection with the insecure authentication handling that the front-end uses, a malicious user may be able to take over any victim's account provided they meet the exploitation steps. As of time of publication, no patched version is available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/openobserve/openobserve/security/advisories/GHSA-hx23-g7m8-h76j
CVE ID: CVE-2024-41809 State: PUBLISHED Published: 2024-07-25T20:22:14.726Z Last Updated: 2024-08-12T20:57:41.387Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: openobserve Products: openobserve Problem Types: CWE-79 Description: OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-
chment: - CVE Program Container: References: - https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp - https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02 - https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d - https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32
CVE ID: CVE-2024-41810 State: PUBLISHED Published: 2024-07-29T15:41:40.289Z Last Updated: 2025-11-03T22:01:01.094Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: twisted Products: twisted Problem Types: CWE-79, CWE-80 Description: Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1. Additional Analyst Notes: - CISA ADP Vulnrichme
e redirect response HTML body. This vulnerability is fixed in 24.7.0rc1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/twisted/twisted/security/advisories/GHSA-cf56-g6w6-pqq2 - https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33
CVE ID: CVE-2024-41811 State: PUBLISHED Published: 2024-08-05T20:17:30.849Z Last Updated: 2024-08-06T13:53:56.318Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Icinga Products: ipl-web Problem Types: CWE-352 Description: ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release. Additional Analyst Notes: - CISA ADP Vuln
his. It will be published as part of the `icinga-php-library` v0.14.1 release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j - https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e
CVE ID: CVE-2024-41812 State: PUBLISHED Published: 2024-07-26T16:49:52.343Z Last Updated: 2024-08-02T04:46:52.687Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TxtDot Products: txtdot Problem Types: CWE-918 Description: txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Forgery (SSRF) vulnerability in the `/get` route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network. Version 1.7.0 prevents displaying the response of forged requests, but the requ
eve information in the internal network. Version 1.7.0 prevents displaying the response of forged requests, but the requests can still be sent. For complete mitigation, a firewall between txtdot and other internal network resources should be set. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TxtDot/txtdot/security/advisories/GHSA-4gj5-xj97-j8fp - https://github.com/TxtDot/txtdot/commit/7c72d985f7a26ec1fd3cf628444717ca54986d2d - https://github.com/TxtDot/txtdot/blob/a7fdaf80fdf45abefe83b2eb5135ba112142dc74/src/handlers/distributor.ts#L43-L47
CVE ID: CVE-2024-41813 State: PUBLISHED Published: 2024-07-26T16:51:33.606Z Last Updated: 2024-08-12T20:55:12.355Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TxtDot Products: txtdot Problem Types: CWE-918 Description: txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1.6.1, a Server-Side Request Forgery (SSRF) vulnerability in the `/proxy` route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network. Version 1.6.1 patches the issue. Additional Ana
s to arbitrary targets and retrieve information in the internal network. Version 1.6.1 patches the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TxtDot/txtdot/security/advisories/GHSA-4c78-229v-hf6m - https://github.com/TxtDot/txtdot/commit/f241a46e05b148a39b84bf956051b5aaa489949e - https://github.com/TxtDot/txtdot/blob/a7fdaf80fdf45abefe83b2eb5135ba112142dc74/src/handlers/distributor.ts#L43-L47
CVE ID: CVE-2024-41815 State: PUBLISHED Published: 2024-07-26T21:01:48.605Z Last Updated: 2024-08-02T04:46:52.696Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: starship Products: starship Problem Types: CWE-77 Description: Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone. Version 1.20.
pe is limited, and without knowledge of others' commands, it could be hard to successfully target someone. Version 1.20.0 fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/starship/starship/security/advisories/GHSA-vx24-x4mv-vwr5 - https://github.com/starship/starship/commit/cfc58161e0ec595db90af686ad77a73df6d44d74 - https://github.com/starship/starship/releases/tag/v1.20.0
CVE ID: CVE-2024-41816 State: PUBLISHED Published: 2024-08-05T20:12:41.428Z Last Updated: 2024-08-08T13:28:33.622Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: XjSv Products: Cooked Problem Types: CWE-79 Description: Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromi
er-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.1. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/XjSv/Cooked/security/advisories/GHSA-3gw3-2qjq-xqjj - https://github.com/XjSv/Cooked/commit/ac7455bdccc99fb2f5b3c7611312947c1623c3ec
CVE ID: CVE-2024-41817 State: PUBLISHED Published: 2024-07-29T15:53:17.236Z Last Updated: 2024-08-02T04:46:53.171Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-427 Description: ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The
g malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The vulnerability is fixed in 7.11-36. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8rxc-922v-phg8 - https://github.com/ImageMagick/ImageMagick/commit/6526a2b28510ead6a3e14de711bb991ad9abff38 - https://github.com/ImageMagick/ImageMagick/blob/3b22378a23d59d7517c43b65b1822f023df357a0/app-image/AppRun#L11-L14
CVE ID: CVE-2024-41818 State: PUBLISHED Published: 2024-07-29T15:56:38.999Z Last Updated: 2024-10-11T14:13:27.572Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NaturalIntelligence Products: fast-xml-parser Problem Types: CWE-400 Description: fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-mpg4-rc92-vx8v - https://github.com/NaturalIntelligence/fast-xml-parser/commit/ba5f35e7680468acd7906eaabb2f69e28ed8b2aa -
pg4-rc92-vx8v - https://github.com/NaturalIntelligence/fast-xml-parser/commit/ba5f35e7680468acd7906eaabb2f69e28ed8b2aa - https://github.com/NaturalIntelligence/fast-xml-parser/commit/d0bfe8a3a2813a185f39591bbef222212d856164 - https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/src/v5/valueParsers/currency.js#L10
CVE ID: CVE-2024-41819 State: PUBLISHED Published: 2024-07-29T16:03:34.339Z Last Updated: 2024-08-05T10:22:35.371Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: enchant97 Products: note-mark Problem Types: CWE-79 Description: Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content. This vulnerability is fixed in 0.13.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48
m Container: - CISA ADP Vulnrichment: References: - https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3 - https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182
CVE ID: CVE-2024-41820 State: PUBLISHED Published: 2024-08-05T20:07:49.048Z Last Updated: 2024-08-06T13:25:13.623Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: kubean-io Products: kubean Problem Types: CWE-732 Description: Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are adv
esulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubean-io/kubean/security/advisories/GHSA-3wfj-3x8q-hrpg - https://github.com/kubean-io/kubean/issues/1326 - https://github.com/kubean-io/kubean/commit/167e97329e4a27ba2f456d2846d39af20e1af7ef
CVE ID: CVE-2024-41824 State: PUBLISHED Published: 2024-07-22T14:50:21.300Z Last Updated: 2024-08-02T04:46:52.949Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-532 Description: In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-41825 State: PUBLISHED Published: 2024-07-22T14:50:22.219Z Last Updated: 2024-08-02T04:46:52.915Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-41826 State: PUBLISHED Published: 2024-07-22T14:50:22.717Z Last Updated: 2024-08-02T04:46:52.691Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-41827 State: PUBLISHED Published: 2024-07-22T14:50:23.371Z Last Updated: 2024-08-02T04:46:52.680Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-613 Description: In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-41828 State: PUBLISHED Published: 2024-07-22T14:50:23.908Z Last Updated: 2024-08-02T04:46:52.671Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-208 Description: In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-41829 State: PUBLISHED Published: 2024-07-22T14:50:24.527Z Last Updated: 2024-08-02T04:46:52.691Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-303 Description: In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-41830 State: PUBLISHED Published: 2024-08-14T15:07:25.451Z Last Updated: 2024-08-15T03:55:59.354Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-416 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/securi
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
CVE ID: CVE-2024-41831 State: PUBLISHED Published: 2024-08-14T15:07:30.307Z Last Updated: 2024-08-15T03:56:00.949Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-416 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb2
CVE ID: CVE-2024-41832 State: PUBLISHED Published: 2024-08-14T15:07:32.908Z Last Updated: 2024-08-14T16:03:28.145Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-125 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progr
interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
CVE ID: CVE-2024-41833 State: PUBLISHED Published: 2024-08-14T15:07:22.880Z Last Updated: 2024-08-14T15:57:17.085Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-125 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
CVE ID: CVE-2024-41834 State: PUBLISHED Published: 2024-08-14T15:07:27.957Z Last Updated: 2024-08-14T15:56:20.215Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-125 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: