Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-43381 State: PUBLISHED Published: 2024-08-16T14:38:23.799Z Last Updated: 2024-08-16T15:01:31.139Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: yogeshojha Products: rengine Problem Types: CWE-79, CWE-87 Description: reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS record contains an XSS payload, it leads to the execution of malicious scripts in the reNgine's dashboard view when any user views the scan results. The XSS payload is directly fetched from the
ipts in the reNgine's dashboard view when any user views the scan results. The XSS payload is directly fetched from the DNS record of the remote target domain. Consequently, an attacker can execute the attack without requiring any additional input from the target or the reNgine user. A patch is available and expected to be part of version 2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yogeshojha/rengine/security/advisories/GHSA-96q4-fj2m-jqf7 - https://github.com/yogeshojha/rengine/commit/064bac1c7c4d2b90745bf225c92e74d83edb7a4d
CVE ID: CVE-2024-43382 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T14:15:16.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client side encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-f686-hw9c-xw9c
CVE ID: CVE-2024-43383 State: PUBLISHED Published: 2024-10-31T09:57:29.062Z Last Updated: 2024-10-31T13:52:47.181Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Apache Software Foundation Products: Apache Lucene.Net.Replicator Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exce
et replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/wlz1p76dxpt4rl9o29voxjd5zl7717nh
CVE ID: CVE-2024-43385 State: PUBLISHED Published: 2024-09-10T08:43:25.556Z Last Updated: 2024-09-10T14:25:30.320Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M
RD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-78 Description: A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mG
f arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mGuard devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-43386 State: PUBLISHED Published: 2024-09-10T08:43:41.392Z Last Updated: 2024-09-10T14:25:13.169Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M
RD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-78 Description: A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO
f arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-43387 State: PUBLISHED Published: 2024-09-10T08:43:54.155Z Last Updated: 2024-09-10T14:22:52.652Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M
RD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-78 Description: A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices. Additio
root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-43388 State: PUBLISHED Published: 2024-09-10T08:44:06.550Z Last Updated: 2025-08-22T06:22:30.968Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M
RD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-94 Description: A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
reconfigure the SNMP service due to improper input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-43389 State: PUBLISHED Published: 2024-09-10T08:44:19.337Z Last Updated: 2025-08-22T06:23:04.328Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M
RD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-94 Description: A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can
hanges of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can lead to a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-43390 State: PUBLISHED Published: 2024-09-10T08:44:30.792Z Last Updated: 2025-08-22T06:23:31.974Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M
RD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-94 Description: A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which
hanges of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which can lead to a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-43391 State: PUBLISHED Published: 2024-09-10T08:44:42.576Z Last Updated: 2025-08-22T06:31:58.682Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M
RD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-94 Description: A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the F
hanges of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_PORTFORWARDING.SRC_IP environment variable which can lead to a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-43392 State: PUBLISHED Published: 2024-09-10T08:44:56.166Z Last Updated: 2025-08-22T06:32:27.638Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M
hanges of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP environment variable which can lead to a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-43393 State: PUBLISHED Published: 2024-09-10T08:45:10.306Z Last Updated: 2025-08-22T06:32:56.194Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M
hanges of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP FW_RULESETS.FROM_IP FW_RULESETS.IN_IP environment variable which can lead to a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-43394 State: PUBLISHED Published: 2025-07-10T16:56:07.720Z Last Updated: 2025-11-04T21:08:53.876Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_rewrite or apache expressions that pass unvalidated request input. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63. Note: The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths. The server offers limited protection against administrators directing the server t
reports regarding SSRF via UNC paths. The server offers limited protection against administrators directing the server to open UNC paths. Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html
CVE ID: CVE-2024-43395 State: PUBLISHED Published: 2024-08-16T20:15:32.325Z Last Updated: 2024-08-19T15:26:20.287Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: MCJack123 Products: craftos2 Problem Types: CWE-22 Description: CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDL for drawing. Prior to version 2.8.3, users of CraftOS-PC 2 on Windows can escape the computer folder and access files anywhere without permission or notice by obfuscating `..`s to bypass the internal check preventing parent directory traversal. Version 2.8.3 contains a patch for
obfuscating `..`s to bypass the internal check preventing parent directory traversal. Version 2.8.3 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MCJack123/craftos2/security/advisories/GHSA-hr3w-wc83-6923 - https://github.com/MCJack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3
CVE ID: CVE-2024-43396 State: PUBLISHED Published: 2024-08-20T20:23:05.660Z Last Updated: 2024-08-21T19:52:35.357Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: khoj-ai Products: khoj Problem Types: CWE-79 Description: Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
ct arbitrary HTML/JS. This vulnerability is fixed in 1.15.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/khoj-ai/khoj/security/advisories/GHSA-cf72-vg59-4j4h - https://github.com/khoj-ai/khoj/commit/1c7a562880eeb7354325545d2cf6c5d1d1134812 - https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626
CVE ID: CVE-2024-43397 State: PUBLISHED Published: 2024-08-20T14:50:01.163Z Last Updated: 2024-08-20T17:18:53.095Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: apolloconfig Products: apollo Problem Types: CWE-284 Description: Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git
check which was released in version 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962 - https://github.com/apolloconfig/apollo/pull/5192 - https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed - https://github.com/apolloconfig/apollo/releases/tag/v2.3.0
CVE ID: CVE-2024-43398 State: PUBLISHED Published: 2024-08-22T14:14:03.588Z Last Updated: 2025-11-03T20:38:50.990Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ruby Products: rexml Problem Types: CWE-776 Description: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later includ
s such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3 - https://github.com/ruby/rexml/releases/tag/v3.3.6
CVE ID: CVE-2024-43399 State: PUBLISHED Published: 2024-08-19T14:44:47.180Z Last Updated: 2024-08-19T15:27:04.688Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: MobSF Products: Mobile-Security-Framework-MobSF Problem Types: CWE-23 Description: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerabilit
d to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerability allows an attacker to extract files to any desired location within the server running MobSF. This vulnerability is fixed in 4.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-4hh3-vj32-gr6j - https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/cc625fe8430f3437a473e82aa2966d100a4dc883
CVE ID: CVE-2024-43400 State: PUBLISHED Published: 2024-08-19T16:24:40.900Z Last Updated: 2024-08-22T14:00:37.297Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-96 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v - https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a733076821268509c - https://jira.xwiki.org/browse/XWIKI-21810