Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6849 State: PUBLISHED Published: 2024-09-07T08:37:02.802Z Last Updated: 2024-09-09T13:51:35.883Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: maxsdesign Products: Preloader Plus – WordPress Loading Screen Plugin Problem Types: CWE-79 Description: The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever
cated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/85e0e1c5-211f-434c-8cc8-1ca676a8c7c2?source=cve - https://plugins.trac.wordpress.org/browser/preloader-plus/tags/2.2.1/inc/preloader-plus.php#L351 - https://wordpress.org/plugins/preloader-plus/#developers
CVE ID: CVE-2024-6850 State: PUBLISHED Published: 2024-09-13T06:00:03.481Z Last Updated: 2024-09-13T15:24:16.091Z Vendors: Unknown Products: Carousel Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c06995cb-1685-4751-811f-aead52a597a7/
CVE ID: CVE-2024-6851 State: PUBLISHED Published: 2025-03-20T10:09:55.149Z Last Updated: 2025-03-20T18:32:59.392Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-22 Description: In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/83
arbitrary file deletion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3
CVE ID: CVE-2024-6852 State: PUBLISHED Published: 2024-09-08T06:00:02.122Z Last Updated: 2024-09-09T19:41:30.082Z Vendors: Unknown Products: WP MultiTasking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e6c7c153-8080-40b3-85e2-604ce7c66e32/
CVE ID: CVE-2024-6853 State: PUBLISHED Published: 2024-09-08T06:00:02.382Z Last Updated: 2024-09-09T19:47:08.895Z Vendors: Unknown Products: WP MultiTasking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d1ce78c3-5d6c-465e-9ce8-6d92f7480333/
CVE ID: CVE-2024-6854 State: PUBLISHED Published: 2025-03-20T10:09:57.301Z Last Updated: 2025-03-20T18:32:31.810Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-36 Description: In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker. Additional Analyst Notes: - CISA ADP Vulnrichment:
gh the content of the overwrite is not controllable by the attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/97d013f9-ac51-4c80-8dd7-8dfde11f33b2
CVE ID: CVE-2024-6855 State: PUBLISHED Published: 2024-09-08T06:00:02.581Z Last Updated: 2024-09-09T19:49:28.870Z Vendors: Unknown Products: WP MultiTasking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1124b07a-6274-49df-be77-615fda8f3a38/
CVE ID: CVE-2024-6856 State: PUBLISHED Published: 2024-09-08T06:00:02.783Z Last Updated: 2024-09-09T19:50:34.925Z Vendors: Unknown Products: WP MultiTasking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9700845e-89ca-4f9b-95f0-4b46a975b662/
CVE ID: CVE-2024-6857 State: PUBLISHED Published: 2025-04-09T06:00:04.059Z Last Updated: 2025-04-09T19:17:05.474Z Vendors: Unknown Products: WP MultiTasking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/97636602-2dd0-465b-b6dc-acb42147edb3/
CVE ID: CVE-2024-6859 State: PUBLISHED Published: 2024-09-08T06:00:02.961Z Last Updated: 2024-09-09T19:52:01.460Z Vendors: Unknown Products: WP MultiTasking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/34ae6121-304f-495b-bcc1-4fbd3d70a9fb/
CVE ID: CVE-2024-6860 State: PUBLISHED Published: 2025-04-09T06:00:05.104Z Last Updated: 2025-04-09T19:11:40.133Z Vendors: Unknown Products: WP MultiTasking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1d09d3dd-aa49-4ff1-80e7-6d176e378916/
CVE ID: CVE-2024-6861 State: PUBLISHED Published: 2024-11-06T14:54:51.099Z Last Updated: 2025-11-20T07:31:26.304Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Satellite 6.12 for RHEL 8, Red Hat Satellite 6 Problem Types: CWE-200 Description: A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2022:8506 - https://access.
Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2022:8506 - https://access.redhat.com/security/cve/CVE-2024-6861 - https://bugzilla.redhat.com/show_bug.cgi?id=2317450 - https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2 - https://projects.theforeman.org/issues/34328
CVE ID: CVE-2024-6862 State: PUBLISHED Published: 2024-09-13T16:13:51.639Z Last Updated: 2024-09-13T16:35:41.728Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for instances hosted locally on personal machines, which are not publicly accessible. The CORS settings in the backend permit all origins, e
locally on personal machines, which are not publicly accessible. The CORS settings in the backend permit all origins, exposing unauthenticated endpoints to CSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0b1d851e-3455-480c-ad5a-23565894976f - https://github.com/lunary-ai/lunary/commit/3451fcd7b9d95e9091d62c515752f39f2faa6e54
CVE ID: CVE-2024-6863 State: PUBLISHED Published: 2025-03-20T10:10:30.190Z Last Updated: 2025-10-15T12:50:34.689Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-749 Description: In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryptio
files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/10f55937-0cba-4530-897f-2abf30ed5270
CVE ID: CVE-2024-6864 State: PUBLISHED Published: 2024-08-20T04:28:33.896Z Last Updated: 2024-09-13T11:30:31.393Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: infosatech Products: WP Last Modified Info Problem Types: CWE-79 Description: The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-modified-info shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/87368d85-04d4-42e6-9ba6-2a1fc3b945a8?source=cve - https://plugins.trac.wordpress.org/browser/wp-last-modified-info/trunk/inc/Core/Frontend/PostView.php#L205 - https://wordpress.org/plugins/wp-last-modified-info/#developers - https://plugins.trac.wordpress.org/changeset/3137253/#file23 - https://plugins.trac.wordpress.org/changeset/3137253/
CVE ID: CVE-2024-6865 State: REJECTED Published: N/A Last Updated: 2024-08-05T13:51:13.646Z Description: No description available.
CVE ID: CVE-2024-6866 State: PUBLISHED Published: 2025-03-20T10:10:59.521Z Last Updated: 2025-11-03T19:34:42.290Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: corydolphin Products: corydolphin/flask-cors Problem Types: CWE-178 Description: corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorize
s them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/808c11af-faee-43a8-824b-b5ab4f62b9e6
CVE ID: CVE-2024-6867 State: PUBLISHED Published: 2024-09-13T16:13:02.869Z Last Updated: 2024-09-13T16:38:51.331Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-1220 Description: An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability all
have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/460df515-164c-4435-954b-0233a181545f - https://github.com/lunary-ai/lunary/commit/35afd4439464571eb016318cd7b6f85a162225ca
CVE ID: CVE-2024-6868 State: PUBLISHED Published: 2024-10-29T12:46:54.732Z Last Updated: 2025-10-15T12:49:47.751Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: mudler Products: mudler/localai Problem Types: CWE-59 Description: mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted after downloading. This behavior can be exploited to perform a 'tarslip' attack, allowing files to be written to arbitrary locations on the server, bypassing checks that normally restrict files to th
, allowing files to be written to arbitrary locations on the server, bypassing checks that normally restrict files to the models directory. This vulnerability can lead to remote code execution (RCE) by overwriting backend assets used by the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/752d2376-2d9a-4e17-b462-3c267f9dd229 - https://github.com/mudler/localai/commit/a181dd0ebc5d3092fc50f61674d552604fe8ef9c
CVE ID: CVE-2024-6869 State: PUBLISHED Published: 2024-08-08T04:11:38.071Z Last Updated: 2024-08-08T14:09:25.603Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: sbouey Products: Falang multilanguage for WordPress Problem Types: CWE-862 Description: The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.3.52. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete translations and expose the administrator email address. Additional Analyst Notes: - CISA A
above, to update and delete translations and expose the administrator email address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4d67cd-5fb0-425d-8b22-c69ebb0ffa72?source=cve - https://plugins.trac.wordpress.org/browser/falang/trunk/admin/class-falang-admin.php - https://plugins.trac.wordpress.org/changeset/3131499/
CVE ID: CVE-2024-6870 State: PUBLISHED Published: 2024-08-22T09:29:30.755Z Last Updated: 2024-08-22T14:28:31.798Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dfactory Products: Responsive Lightbox & Gallery Problem Types: CWE-79 Description: The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping affecting the rl_upload_image AJAX endpoint. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever
cated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d55309-d178-4b3d-9de6-2cf2769b76fe?source=cve - https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.4.7/includes/class-remote-library.php#L261 - https://wordpress.org/plugins/responsive-lightbox/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3137531%40responsive-lightbox&new=3137531%40responsive-lightbox&sfp_email=&sfph_mail=
CVE ID: CVE-2024-6871 State: PUBLISHED Published: 2024-11-22T21:30:23.472Z Last Updated: 2024-11-26T15:43:45.782Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: G DATA Products: Total Security Problem Types: CWE-732 Description: G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of autostart tasks. The issue results from incor
xploit this vulnerability. The specific flaw exists within the handling of autostart tasks. The issue results from incorrect permissions set on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22629. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1486/
CVE ID: CVE-2024-6872 State: PUBLISHED Published: 2024-08-03T11:37:38.535Z Last Updated: 2024-08-05T15:11:50.878Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: templatespare Products: TemplateSpare: Quick & Easy WordPress Site Builder – 475+ Ready-Made Demos for News, Blogs, eCommerce, and More. One-Click Import, No Coding Needed Problem Types: CWE-862 Description: The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – TemplateSpare plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'templatespare_ac
WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'templatespare_activate_required_theme' and 'templatespare_get_theme_status' functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate any installed theme and read any theme status. If the attacker attempts to activate a theme that is not installed, a non-existent theme with the slug chosen by the attacker will be considered the active theme, leaving the site with no theme functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/v
functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c74807-b85c-478e-bebf-1f0b46a21c11?source=cve - https://plugins.trac.wordpress.org/browser/templatespare/trunk/includes/templatespare-kit.php#L13 - https://plugins.trac.wordpress.org/browser/templatespare/trunk/includes/templatespare-kit.php#L34 - https://plugins.trac.wordpress.org/changeset/3129809/
CVE ID: CVE-2024-6873 State: PUBLISHED Published: 2024-08-01T15:57:25.304Z Last Updated: 2024-08-02T15:18:28.271Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H) Vendors: ClickHouse Products: ClickHouse Problem Types: CWE-122 Description: It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited. Fixes have been merged to all currently supported
nown remote code execution (RCE) code has been produced or exploited. Fixes have been merged to all currently supported version of ClickHouse. If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit https://github.com/ClickHouse/ClickHouse/pull/64024 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-432f-r822-j66f
CVE ID: CVE-2024-6874 State: PUBLISHED Published: 2024-07-24T07:36:26.887Z Last Updated: 2025-02-13T17:58:00.151Z Vendors: curl Products: curl Problem Types: CWE-126 Buffer Over-read Description: libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string. Additional
he string. This flaw can lead to stack contents accidently getting returned as part of the converted string. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://curl.se/docs/CVE-2024-6874.json - https://curl.se/docs/CVE-2024-6874.html - https://hackerone.com/reports/2604391 - http://www.openwall.com/lists/oss-security/2024/07/24/2
CVE ID: CVE-2024-6875 State: PUBLISHED Published: 2025-03-28T20:34:30.859Z Last Updated: 2025-11-10T18:50:17.877Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Data Grid 8, Red Hat JBoss Data Grid 7 Problem Types: CWE-401 Description: A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-6875 - https://bugzilla.redhat.com/show_bug.cgi?id=2298555