Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-34122 State: PUBLISHED Published: 2024-07-02T13:44:42.794Z Last Updated: 2024-08-02T02:42:59.893Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat for Edge Problem Types: CWE-125 Description: Acrobat for Edge versions 126.0.2592.68 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CIS
ion of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-34122
CVE ID: CVE-2024-34123 State: PUBLISHED Published: 2024-07-09T19:06:50.067Z Last Updated: 2024-08-02T02:42:59.955Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Pro Problem Types: CWE-426 Description: Premiere Pro versions 23.6.5, 24.4.1 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious file into the search path, which the application might execute instead of the legitimate file. This could occur when the application uses a search path to locate executables or libraries. Exploitation of this issue requires
ld occur when the application uses a search path to locate executables or libraries. Exploitation of this issue requires user interaction, attack complexity is high. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/premiere_pro/apsb24-46.html
CVE ID: CVE-2024-34124 State: PUBLISHED Published: 2024-08-14T14:55:35.652Z Last Updated: 2024-08-16T04:01:50.869Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Dimension Problem Types: CWE-787 Description: Dimension versions 3.4.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb24-47.html
CVE ID: CVE-2024-34125 State: PUBLISHED Published: 2024-08-14T14:55:38.696Z Last Updated: 2024-08-14T17:27:25.551Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Dimension Problem Types: CWE-125 Description: Dimension versions 3.4.11 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/aps
CVE ID: CVE-2024-34126 State: PUBLISHED Published: 2024-08-14T14:55:37.161Z Last Updated: 2024-08-14T17:28:04.268Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Dimension Problem Types: CWE-125 Description: Dimension versions 3.4.11 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/aps
CVE ID: CVE-2024-34127 State: PUBLISHED Published: 2024-08-14T15:05:50.146Z Last Updated: 2024-08-14T15:57:41.245Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-125 Description: InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/securit
open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb24-56.html
CVE ID: CVE-2024-34128 State: PUBLISHED Published: 2024-07-23T11:34:53.906Z Last Updated: 2024-10-07T13:10:48.403Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
e page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE ID: CVE-2024-34129 State: PUBLISHED Published: 2024-06-13T11:28:32.459Z Last Updated: 2024-08-07T14:58:35.822Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Acrobat Mobile Sign Android Problem Types: CWE-22 Description: Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to access files and directories that are outside the restricted directory and also to overwrite arbitrary files. Exploitation of this issue does not requires u
e outside the restricted directory and also to overwrite arbitrary files. Exploitation of this issue does not requires user interaction and attack complexity is high. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat-android/apsb24-50.html
CVE ID: CVE-2024-34130 State: PUBLISHED Published: 2024-06-13T11:28:33.214Z Last Updated: 2024-08-07T15:03:01.900Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Acrobat Mobile Sign Android Problem Types: CWE-863 Description: Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access confidential information. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com
ction. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat-android/apsb24-50.html
CVE ID: CVE-2024-34133 State: PUBLISHED Published: 2024-08-14T14:56:16.920Z Last Updated: 2024-08-16T04:01:49.629Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-787 Description: Illustrator versions 28.5, 27.9.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb24-45.html
CVE ID: CVE-2024-34134 State: PUBLISHED Published: 2024-08-14T14:56:20.034Z Last Updated: 2024-09-16T11:58:03.845Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Illustrator Problem Types: CWE-125 Description: Illustrator versions 28.5, 27.9.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/ill
ous file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb24-45.html
CVE ID: CVE-2024-34135 State: PUBLISHED Published: 2024-08-14T14:56:14.552Z Last Updated: 2024-08-14T17:23:24.999Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Illustrator Problem Types: CWE-125 Description: Illustrator versions 28.5, 27.9.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/ill
CVE ID: CVE-2024-34136 State: PUBLISHED Published: 2024-08-14T14:56:19.250Z Last Updated: 2024-08-14T17:22:18.975Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-476 Description: Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
nteraction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb24-45.html
CVE ID: CVE-2024-34137 State: PUBLISHED Published: 2024-08-14T14:56:15.294Z Last Updated: 2024-08-14T17:23:15.440Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-476 Description: Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS) condition. An attacker could exploit this vulnerability to crash the application, resulting in a DoS. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx
that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb24-45.html
CVE ID: CVE-2024-34138 State: PUBLISHED Published: 2024-08-14T14:56:16.091Z Last Updated: 2024-08-14T17:23:07.779Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-476 Description: Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
CVE ID: CVE-2024-34139 State: PUBLISHED Published: 2024-07-09T19:26:32.806Z Last Updated: 2024-08-02T02:42:59.988Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Bridge Problem Types: CWE-190 Description: Bridge versions 14.0.4, 13.0.7, 14.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/bridge/apsb24-51.html
CVE ID: CVE-2024-34140 State: PUBLISHED Published: 2024-07-09T19:26:33.554Z Last Updated: 2024-08-02T02:42:59.887Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Bridge Problem Types: CWE-125 Description: Bridge versions 14.0.4, 13.0.7, 14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.co
s file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/bridge/apsb24-51.html
CVE ID: CVE-2024-34141 State: PUBLISHED Published: 2024-06-25T08:50:01.824Z Last Updated: 2024-10-07T12:28:45.739Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
CVE ID: CVE-2024-34142 State: PUBLISHED Published: 2024-06-25T08:50:02.677Z Last Updated: 2024-10-07T13:06:39.123Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
CVE ID: CVE-2024-34144 State: PUBLISHED Published: 2024-05-02T13:28:03.226Z Last Updated: 2025-02-13T17:52:24.865Z Vendors: Jenkins Project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341 - http://www.openw
E Program Container: References: - https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341 - http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE ID: CVE-2024-34145 State: PUBLISHED Published: 2024-05-02T13:28:03.965Z Last Updated: 2025-02-13T17:52:25.384Z Vendors: Jenkins Project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisor
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341 - http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE ID: CVE-2024-34146 State: PUBLISHED Published: 2024-05-02T13:28:04.598Z Last Updated: 2025-02-13T17:52:25.963Z Vendors: Jenkins Project Products: Jenkins Git server Plugin Description: Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers with a previously configured SSH public key but lacking Overall/Read permission to access these repositories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3342 - http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE ID: CVE-2024-34147 State: PUBLISHED Published: 2024-05-02T13:28:05.238Z Last Updated: 2025-02-13T17:52:26.471Z Vendors: Jenkins Project Products: Jenkins Telegram Bot Plugin Description: Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3294 - http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE ID: CVE-2024-34148 State: PUBLISHED Published: 2024-05-02T13:28:05.952Z Last Updated: 2025-02-13T17:52:27.106Z Vendors: Jenkins Project Products: Jenkins Subversion Partial Release Manager Plugin Description: Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system property 'hudson.model.ParametersAction.keepUndefinedParameters'. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331 - http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE ID: CVE-2024-34149 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-11-21T19:09:58.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2023-50428. NOTE: some parties oppose this new limit check (for example, because they agree with the objective but disagree with the technical mechanism, or because they have a different objective). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bitcoin/bitcoin/pull/29769
CVE ID: CVE-2024-34152 State: PUBLISHED Published: 2024-05-26T13:28:16.722Z Last Updated: 2024-09-03T16:03:29.404Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-34153 State: PUBLISHED Published: 2024-09-16T16:38:35.808Z Last Updated: 2024-09-17T16:10:15.455Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) RAID Web Console software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE ID: CVE-2024-34155 State: PUBLISHED Published: 2024-09-06T20:42:42.518Z Last Updated: 2024-11-04T16:59:31.685Z Vendors: Go standard library Products: go/parser Problem Types: CWE-674: Uncontrolled Recursion Description: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/611238 - https://go.dev/issue/69138 - https://groups.google.com/g/golang-dev/c/S9POB9NCTdk - https://pkg.go.dev/vuln/GO-2024-3105
CVE ID: CVE-2024-34156 State: PUBLISHED Published: 2024-09-06T20:42:42.661Z Last Updated: 2024-09-26T15:03:08.203Z Vendors: Go standard library Products: encoding/gob Problem Types: CWE-674: Uncontrolled Recursion Description: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/611239 - https://go.dev/issue/69139 - https://groups.google.com/g/golang-dev/c/S9POB9NCTdk - https://pkg.go.dev/vuln/GO-2024-3106
CVE ID: CVE-2024-34158 State: PUBLISHED Published: 2024-09-06T20:42:42.822Z Last Updated: 2024-10-04T15:02:47.715Z Vendors: Go standard library Products: go/build/constraint Problem Types: CWE-674: Uncontrolled Recursion Description: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/611240 - https://go.dev/issue/69141 - https://groups.google.com/g/golang-dev/c/S9POB9NCTdk - https://pkg.go.dev/vuln/GO-2024-3107
CVE ID: CVE-2024-34161 State: PUBLISHED Published: 2024-05-29T16:02:05.696Z Last Updated: 2025-02-13T17:52:28.046Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: F5 Products: NGINX Open Source, NGINX Plus Problem Types: CWE-416 Description: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000139627 - https
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000139627 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/ - http://www.openwall.com/lists/oss-security/2024/05/30/4 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/