Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
urity/advisories/GHSA-h9fp-j58h-wwrc - https://github.com/bmaltais/kohya_ss/commit/25bb1303fff21cb5bae17236d53504e85c1866df - https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
CVE ID: CVE-2024-32025 State: PUBLISHED Published: 2024-04-16T14:44:21.648Z Last Updated: 2025-08-27T21:12:59.522Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: bmaltais Products: kohya_ss Problem Types: CWE-77 Description: Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `group_images_gui.py`. This vulnerability is fixed in 23.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-qprv-9pg5-h33c - https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1 - https://securi
A-qprv-9pg5-h33c - https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1 - https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
CVE ID: CVE-2024-32026 State: PUBLISHED Published: 2024-04-16T14:45:28.180Z Last Updated: 2024-08-02T01:59:50.685Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: bmaltais Products: kohya_ss Problem Types: CWE-77 Description: Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `git_caption_gui.py`. This vulnerability is fixed in 23.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-v5cm-33w8-xrj6 - https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1 - https://securit
-v5cm-33w8-xrj6 - https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1 - https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
CVE ID: CVE-2024-32027 State: PUBLISHED Published: 2024-04-16T14:46:24.185Z Last Updated: 2024-08-02T01:59:50.840Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: bmaltais Products: kohya_ss Problem Types: CWE-77 Description: Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss v22.6.1 is vulnerable to command injection in `finetune_gui.py` This vulnerability is fixed in 23.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-8h78-3vqm-xw83 - https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1 - https://secur
SA-8h78-3vqm-xw83 - https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1 - https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
CVE ID: CVE-2024-32028 State: PUBLISHED Published: 2024-04-12T22:58:30.526Z Last Updated: 2024-08-02T01:59:50.898Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: open-telemetry Products: opentelemetry-dotnet Problem Types: CWE-212, CWE-201 Description: OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incomin
strumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTele
pplication(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/G
ent: - CVE Program Container: References: - https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f - https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42 - https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md
CVE ID: CVE-2024-32029 State: REJECTED Published: N/A Last Updated: 2024-05-30T16:04:56.874Z Description: No description available.
CVE ID: CVE-2024-32030 State: PUBLISHED Published: 2024-06-19T16:35:34.497Z Last Updated: 2024-08-02T01:59:50.846Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: provectus Products: kafka-ui Problem Types: CWE-94, CWE-502 Description: Kafka UI is an Open-Source Web UI for Apache Kafka Management. Kafka UI API allows users to connect to different Kafka brokers by specifying their network address and port. As a separate feature, it also provides the ability to monitor the performance of Kafka brokers by connecting to their JMX ports. JMX is based on the RMI protocol, so it is inherently susceptible to deserialization attacks. A potential attacker can exploit th
sed on the RMI protocol, so it is inherently susceptible to deserialization attacks. A potential attacker can exploit this feature by connecting Kafka UI backend to its own malicious broker. This vulnerability affects the deployments where one of the following occurs: 1. dynamic.config.enabled property is set in settings. It's not enabled by default, but it's suggested to be enabled in many tutorials for Kafka UI, including its own README.md. OR 2. an attacker has access to the Kafka cluster that is being connected to Kafka UI. In this scenario the attacker can exploit this vulnerability to expand their access and execute code on Kafka UI as well. Instead of setting up a legitimate JMX port,
vulnerability to expand their access and execute code on Kafka UI as well. Instead of setting up a legitimate JMX port, an attacker can create an RMI listener that returns a malicious serialized object for any RMI call. In the worst case it could lead to remote code execution as Kafka UI has the required gadget chains in its classpath. This issue may lead to post-auth remote code execution. This is particularly dangerous as Kafka-UI does not have authentication enabled by default. This issue has been addressed in version 0.7.2. All users are advised to upgrade. There are no known workarounds for this vulnerability. These issues were discovered and reported by the GitHub Security lab and is
o known workarounds for this vulnerability. These issues were discovered and reported by the GitHub Security lab and is also tracked as GHSL-2023-230. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-229_GHSL-2023-230_kafka-ui/ - https://github.com/provectus/kafka-ui/pull/4427 - https://github.com/provectus/kafka-ui/commit/83b5a60cc08501b570a0c4d0b4cdfceb1b88d6b7#diff-37e769f4709c1e78c076a5949bbcead74e969725bfd89c7c4ba6d6f229a411e6R36
CVE ID: CVE-2024-32034 State: PUBLISHED Published: 2024-09-16T18:38:09.562Z Last Updated: 2024-09-16T20:00:04.199Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: decidim Products: decidim Problem Types: CWE-79 Description: decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users
e of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users are advised to upgrade. Users unable to upgrade may redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6 - https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645 - https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072 - https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0 - https://g
b28725670d6cc1f55c22072 - https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0 - https://github.com/decidim/decidim/commit/ff755e23814aeb56e9089fc08006a5d3faee47b6
CVE ID: CVE-2024-32035 State: PUBLISHED Published: 2024-04-15T19:59:59.530Z Last Updated: 2024-08-02T02:06:42.839Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SixLabors Products: ImageSharp Problem Types: CWE-789 Description: ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and se
w can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation. The problem has been patched in v3.1.4 and v2.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-g85r-6x2q-45w7 - https://github.com/SixLabors/ImageSharp/commit/b6b08ac3e7cea8da5ac1e90f7c0b67dd254535c3 - https://github.com/SixLabors/ImageSharp/commit/f21d64
abors/ImageSharp/commit/b6b08ac3e7cea8da5ac1e90f7c0b67dd254535c3 - https://github.com/SixLabors/ImageSharp/commit/f21d64188e59ae9464ff462056a5e29d8e618b27 - https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands - https://docs.sixlabors.com/articles/imagesharp/security.html
CVE ID: CVE-2024-32036 State: PUBLISHED Published: 2024-04-15T20:08:44.284Z Last Updated: 2024-08-02T02:06:42.826Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: SixLabors Products: ImageSharp Problem Types: CWE-226 Description: ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8. Additional Analyst Notes: - CISA ADP Vulnri
e resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-5x7m-6737-26cr - https://github.com/SixLabors/ImageSharp/commit/8f0b4d3e680e78d479a88e7b1472bccd8f096d68 - https://github.com/SixLabors/ImageSharp/commit/da5f09a42513489fe359578d81cec2f15ba588ba
CVE ID: CVE-2024-32037 State: PUBLISHED Published: 2025-02-11T21:50:29.138Z Last Updated: 2025-02-12T15:37:46.364Z Severity: NONE (CVSS N/A CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) Vendors: geonetwork Products: core-geonetwork Problem Types: CWE-200 Description: GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available. Additional
rver to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-52rf-25hq-5m33 - https://docs.geonetwork-opensource.org/4.4/api/search - https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.10 - https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.5
CVE ID: CVE-2024-32038 State: PUBLISHED Published: 2024-04-19T14:31:00.581Z Last Updated: 2024-08-02T02:06:42.823Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wazuh Products: wazuh Problem Types: CWE-122 Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd when handling Unicode characters from Windows Eventchannel messages. It impacts Wazuh Manager 3.8.0 and above. This vulnerability is fixed in Wazuh Manager 4.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wazuh/wazuh/security/adv
alyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327
CVE ID: CVE-2024-32039 State: PUBLISHED Published: 2024-04-22T20:23:58.360Z Last Updated: 2025-11-03T20:37:16.699Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-190, CWE-787 Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Re
pp:32` or `/rfx` as it is on by default). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9 - https://github.com/FreeRDP/FreeRDP/pull/10077 - https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6 - https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists
ect.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE ID: CVE-2024-32040 State: PUBLISHED Published: 2024-04-22T20:36:45.439Z Last Updated: 2025-11-03T20:37:18.123Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-191 Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.c
use `-nsc`). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5 - https://github.com/FreeRDP/FreeRDP/pull/10077 - https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6 - https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P
V4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE ID: CVE-2024-32041 State: PUBLISHED Published: 2024-04-22T20:39:47.048Z Last Updated: 2025-02-13T17:52:07.631Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/se
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44r - https://github.com/FreeRDP/FreeRDP/pull/10077 - https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6 - https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLW
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE ID: CVE-2024-32042 State: PUBLISHED Published: 2024-05-15T19:39:08.086Z Last Updated: 2024-08-02T02:06:43.266Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: CyberPower Products: PowerPanel business Problem Types: CWE-257 Description: The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01 - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
CVE ID: CVE-2024-32044 State: PUBLISHED Published: 2024-11-13T21:09:01.970Z Last Updated: 2024-11-14T19:44:09.282Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Arc(TM) Pro Graphics for Windows drivers Problem Types: escalation of privilege, CWE-284 Description: Improper access control for some Intel(R) Arc(TM) Pro Graphics for Windows drivers before version 31.0.101.5319 may allow an authenticated user to potentially enable escalation of privilege via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01163.html
CVE ID: CVE-2024-32045 State: PUBLISHED Published: 2024-05-26T13:29:07.516Z Last Updated: 2024-08-02T02:06:42.837Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-32046 State: PUBLISHED Published: 2024-04-26T08:24:50.696Z Last Updated: 2024-08-02T02:06:42.822Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-32047 State: PUBLISHED Published: 2024-05-15T19:36:41.936Z Last Updated: 2024-08-02T02:06:43.550Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CyberPower Products: PowerPanel business Problem Types: CWE-489 Description: Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining access to the testing or production server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01 - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#d
vents/ics-advisories/icsa-24-123-01 - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
CVE ID: CVE-2024-32048 State: PUBLISHED Published: 2024-11-13T21:08:58.750Z Last Updated: 2024-11-14T19:44:26.488Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Distribution of OpenVINO(TM) Model Server software Problem Types: denial of service, CWE-20 Description: Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Model Server software before version 2024.0 may allow an unauthenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01158.html
CVE ID: CVE-2024-32049 State: PUBLISHED Published: 2024-05-08T15:01:26.346Z Last Updated: 2024-08-02T02:06:43.256Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Next Central Manager Problem Types: CWE-300 Description: BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000138634