Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
I without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3 - https://github.com/Pylons/webob/commit/f689bcf4f0a1f64f1735b1d5069aef5be6974b5b
CVE ID: CVE-2024-42354 State: PUBLISHED Published: 2024-08-08T14:44:24.678Z Last Updated: 2024-08-08T15:24:38.347Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: shopware Products: shopware Problem Types: CWE-284 Description: Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the prot
cessing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g - https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f - https://github.com/shopware/core/commit/d35ee2eda5c995
m/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f - https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2 - https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac - https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01
CVE ID: CVE-2024-42355 State: PUBLISHED Published: 2024-08-08T14:49:38.492Z Last Updated: 2024-08-08T15:32:50.503Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: shopware Products: shopware Problem Types: CWE-1336 Description: Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding
code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-27wp-jvhw-v4xp - https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f - https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2 - https://github.com/shopware/shopware/commit/445c6763cc093fbd651e0efaa4150deae4ae60da - https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
CVE ID: CVE-2024-42356 State: PUBLISHED Published: 2024-08-08T14:52:53.604Z Last Updated: 2024-08-09T15:55:33.933Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: shopware Products: shopware Problem Types: CWE-1336 Description: Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to cal
unction. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj - https://github.com/shopware/core/commit/04183e
://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj - https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038 - https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f - https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac - https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
CVE ID: CVE-2024-42357 State: PUBLISHED Published: 2024-08-08T14:55:50.674Z Last Updated: 2024-08-08T18:33:33.536Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: shopware Products: shopware Problem Types: CWE-89 Description: Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the `aggregations` object. The `name` field in this `aggregations` object is vulnerable SQL-injection and can be exploited using SQ
ations` object. The `name` field in this `aggregations` object is vulnerable SQL-injection and can be exploited using SQL parameters. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-p6w9-r443-r752 - https://github.com/shopware/core/commit/63c05615694790f5790a04ef889f42b764fa53c9 - https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f - https://github.com/shopware/shopware/commit/57ea2f3c59483cf7c0f853e7a0d68c23ded1fe5b -
c0624e36e0ee4d41aeebaed40e0442f - https://github.com/shopware/shopware/commit/57ea2f3c59483cf7c0f853e7a0d68c23ded1fe5b - https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
CVE ID: CVE-2024-42358 State: PUBLISHED Published: 2024-08-06T17:02:52.693Z Last Updated: 2024-08-06T18:34:37.214Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: michaelrsweet Products: pdfio Problem Types: CWE-835 Description: PDFio is a simple C library for reading and writing PDF files. There is a denial of service (DOS) vulnerability in the TTF parser. Maliciously crafted TTF files can cause the program to utilize 100% of the Memory and enter an infinite loop. This can also lead to a heap-buffer-overflow vulnerability. An infinite loop occurs in the read_camp function by nGroups value. The ttf.h library is vulnerable. A value called nGroups is extracted
occurs in the read_camp function by nGroups value. The ttf.h library is vulnerable. A value called nGroups is extracted from the file, and by changing that value, you can cause the program to utilize 100% of the Memory and enter an infinite loop. If the value of nGroups in the file is small, an infinite loop will not occur. This library, whether used as a standalone binary or as part of another application, is vulnerable to DOS attacks when parsing certain types of files. Automated systems, including web servers that use this code to convert PDF submissions into plaintext, can be DOSed if an attacker uploads a malicious TTF file. This issue has been addressed in release version 1.3.1. All u
can be DOSed if an attacker uploads a malicious TTF file. This issue has been addressed in release version 1.3.1. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-4hh9-j68x-8353 - https://github.com/michaelrsweet/pdfio/commit/e4e1c39578279386b0ab9f9ac14b20a8bad4f935
CVE ID: CVE-2024-42360 State: PUBLISHED Published: 2024-08-14T19:50:09.469Z Last Updated: 2024-08-15T15:05:31.961Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wurmlab Products: sequenceserver Problem Types: CWE-77 Description: SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wurmlab/sequenceserver/security/adviso
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h - https://github.com/wurmlab/sequenceserver/commit/457e52709f7f9ed2fceed59b3db564cb50785dba
CVE ID: CVE-2024-42361 State: PUBLISHED Published: 2024-08-20T20:56:20.155Z Last Updated: 2024-09-03T14:54:10.790Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Apache Products: HertzBeat Problem Types: CWE-89 Description: Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-254_GHSL-2023-256_HertzBeat/ - https://github.com/droma
eferences: - https://securitylab.github.com/advisories/GHSL-2023-254_GHSL-2023-256_HertzBeat/ - https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/manager/src/main/java/org/dromara/hertzbeat/manager/controller/MonitorsController.java#L202 - https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java#L242 - https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java#L295
CVE ID: CVE-2024-42362 State: PUBLISHED Published: 2024-08-20T20:56:23.725Z Last Updated: 2024-08-21T13:36:54.306Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Apache Products: HertzBeat Problem Types: CWE-502 Description: Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-254_GHSL-2023-256_HertzBeat/ - https://github.com/apache/hertzbeat/pull/1611 - https://github.com/apache/hertzbeat/pull/1620 - htt
023-256_HertzBeat/ - https://github.com/apache/hertzbeat/pull/1611 - https://github.com/apache/hertzbeat/pull/1620 - https://github.com/apache/hertzbeat/pull/1620/files#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8 - https://github.com/apache/hertzbeat/commit/79f5408e345e8e89da97be05f43e3204a950ddfb - https://github.com/apache/hertzbeat/commit/9dbbfb7812fc4440ba72bdee66799edd519d06bb
CVE ID: CVE-2024-42363 State: PUBLISHED Published: 2024-08-20T20:20:03.000Z Last Updated: 2024-08-20T20:53:00.400Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zendesk Products: Samson Problem Types: CWE-502 Description: Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parse_file method where it is unsafely deserialized using the YAML.load_stream method. This issue may lead to Remote Code Execution (RCE). This vulnerability is fixed in 3385. Additional Analyst Notes: - CISA ADP Vulnrichment:
to Remote Code Execution (RCE). This vulnerability is fixed in 3385. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-136_Samson/ - https://github.com/zendesk/samson/pull/4071 - https://github.com/zendesk/samson/blob/107efb4a252425966aac5e77d0c3670f9b5d7229/plugins/kubernetes/app/controllers/kubernetes/role_verifications_controller.rb#L10 - https://github.com/zendesk/samson/blob/107efb4a252425966aac5e77d0c3670f9b5d7229/plugins/kubernetes/app/controllers/kubernetes/role_verifications_controller.rb#L7 - https://github.com/zendesk/samson/blob/107efb4a252425966aac5e77d0c3670f9b5d7229/plugins/kubernetes/app/models/kubernetes/role
://github.com/zendesk/samson/blob/107efb4a252425966aac5e77d0c3670f9b5d7229/plugins/kubernetes/app/models/kubernetes/role_config_file.rb#L80 - https://github.com/zendesk/samson/blob/107efb4a252425966aac5e77d0c3670f9b5d7229/plugins/kubernetes/app/models/kubernetes/util.rb#L9
CVE ID: CVE-2024-42364 State: PUBLISHED Published: 2024-08-23T15:44:27.568Z Last Updated: 2024-08-23T17:08:10.896Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: gethomepage Products: homepage Problem Types: CWE-350 Description: Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepage is setup without certificate and authentication by default, leaving it to vulnerable to DNS rebinding. In this attack, an attacker will ask a user to visit his/her website. The attacker website will then change the DNS records of their domain from their IP address to the in
t his/her website. The attacker website will then change the DNS records of their domain from their IP address to the internal IP address of the homepage instance. To tell which IP addresses are valid, we can rebind a subdomain to each IP address we want to check, and see if there is a response. Once potential candidates have been found, the attacker can launch the attack by reading the response of the webserver after the IP address has changed. When the attacker domain is fetched, the response will be from the homepage instance, not the attacker website, because the IP address has been changed. Due to a lack of authentication, a user’s private information such as API keys (fixed after first
ress has been changed. Due to a lack of authentication, a user’s private information such as API keys (fixed after first report) and other private information can then be extracted by the attacker website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-096_homepage/
CVE ID: CVE-2024-42365 State: PUBLISHED Published: 2024-08-08T16:29:07.436Z Last Updated: 2025-11-03T22:04:48.935Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: asterisk Products: asterisk Problem Types: CWE-267, CWE-1220 Description: Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory. This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using
because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/asterisk/asterisk/security/advisories/GHSA-c4cg-9275-6w44 - https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4 - http
sories/GHSA-c4cg-9275-6w44 - https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4 - https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8 - https://github.com/asterisk/asterisk/commit/b4063bf756272254b160b6d1bd6e9a3f8e16cc71 - https://github.com/asterisk/asterisk/commit/bbe68db10ab8a80c29db383e4dfe14f6eafaf993 - https://github.com/asterisk/asterisk/commit/faddd99f2b9408b524e5eb8a01589fe1fa282df2 - https://github.com/asterisk/asterisk/blob/14367caaf7241df1eceea7c45c5b261989c2c6db/main/manager.c#L6426 - https://github.com/asterisk/asterisk/blob/7d28165cb1b2d02d66e8693bd3fe23ee72fc55d8/main/manager.c#L6426
CVE ID: CVE-2024-42366 State: PUBLISHED Published: 2024-08-08T16:51:07.016Z Last Updated: 2024-08-09T18:46:59.693Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: vrcx-team Products: VRCX Problem Types: CWE-79, CWE-269 Description: VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In addition to the patch, VRCX maintainers worked with the VRC team and blocked the older version of VRCX on the VRC's API side. Users who use th
VRCX maintainers worked with the VRC team and blocked the older version of VRCX on the VRC's API side. Users who use the older version of VRCX must update their installation to continue using VRCX. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vrcx-team/VRCX/security/advisories/GHSA-j98g-mgjm-wqph - https://github.com/vrcx-team/VRCX/commit/cd2387aa3289f936ce60049121c24b0765bd4180
CVE ID: CVE-2024-42367 State: PUBLISHED Published: 2024-08-09T17:25:22.562Z Last Updated: 2025-06-09T12:17:50.733Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: aio-libs Products: aiohttp Problem Types: CWE-61 Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default).
he server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj - https://github.com/aio-libs/aiohttp/pull/8653 - h
/github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj - https://github.com/aio-libs/aiohttp/pull/8653 - https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f - https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_fileresponse.py#L177 - https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_urldispatcher.py#L674
CVE ID: CVE-2024-42368 State: PUBLISHED Published: 2024-08-13T19:31:16.814Z Last Updated: 2024-08-14T13:38:51.917Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: open-telemetry Products: opentelemetry-collector-contrib Problem Types: CWE-208 Description: OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured bearer tokens. This impacts anyone using the `bearertokenauth` server authe
ring comparison of the received & configured bearer tokens. This impacts anyone using the `bearertokenauth` server authenticator. Malicious clients with network access to the collector may perform a timing attack against a collector with this authenticator to guess the configured token, by iteratively sending tokens and comparing the response time. This would allow an attacker to introduce fabricated or bad data into the collector's telemetry pipeline. The observable timing vulnerability was fixed by using constant-time comparison in 0.107.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/G
ADP Vulnrichment: References: - https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-rfxf-mf63-cpqv - https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/34516 - https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/c9bd3eff0bb357d9c812a0d8defd3b09db95699a
CVE ID: CVE-2024-42369 State: PUBLISHED Published: 2024-08-20T14:37:19.226Z Last Updated: 2024-09-03T17:06:42.231Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L) Vendors: matrix-org Products: matrix-js-sdk Problem Types: CWE-674 Description: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in ma
ic but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm - https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6
CVE ID: CVE-2024-42370 State: PUBLISHED Published: 2024-08-09T18:29:11.205Z Last Updated: 2024-08-19T21:05:05.131Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H) Vendors: litestar-org Products: litestar Problem Types: CWE-78 Description: Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Co