Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-29156 State: PUBLISHED Published: 2024-03-18T00:00:00.000Z Last Updated: 2025-03-25T20:07:53.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wiki.openstack.org/wiki/OSSN/OSSN-0093 - https://launchpad.net/bugs/2048114 - https://opendev.org/openstack/murano/tags - https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd
ugs/2048114 - https://opendev.org/openstack/murano/tags - https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3
CVE ID: CVE-2024-29157 State: PUBLISHED Published: 2024-05-09T16:21:49.611Z Last Updated: 2025-02-13T15:47:38.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.14.3 contains a heap buffer overflow in H5HG_read, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29158 State: PUBLISHED Published: 2024-05-09T16:22:33.480Z Last Updated: 2025-02-13T15:47:39.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.14.3 contains a stack buffer overflow in H5FL_arr_malloc, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29159 State: PUBLISHED Published: 2024-05-09T16:23:02.072Z Last Updated: 2025-02-13T15:47:39.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.14.3 contains a buffer overflow in H5Z__filter_scaleoffset, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29160 State: PUBLISHED Published: 2024-05-09T16:23:31.497Z Last Updated: 2025-02-13T15:47:40.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.14.3 contains a heap buffer overflow in H5HG__cache_heap_deserialize, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29161 State: PUBLISHED Published: 2024-05-09T16:24:13.491Z Last Updated: 2025-02-13T15:47:40.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.14.3 contains a heap buffer overflow in H5A__attr_release_table, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29162 State: PUBLISHED Published: 2024-05-09T16:24:39.368Z Last Updated: 2025-02-13T15:47:41.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.13.3 and/or 1.14.2 contains a stack buffer overflow in H5HG_read, resulting in denial of service or potential code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29163 State: PUBLISHED Published: 2024-05-09T16:25:03.219Z Last Updated: 2025-02-13T15:47:42.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.14.3 contains a heap buffer overflow in H5T__bit_find, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29164 State: PUBLISHED Published: 2024-05-09T16:25:24.722Z Last Updated: 2025-02-13T15:47:43.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.14.3 contains a stack buffer overflow in H5R__decode_heap, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29165 State: PUBLISHED Published: 2024-05-09T16:25:51.758Z Last Updated: 2025-02-13T15:47:44.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.14.3 contains a buffer overflow in H5Z__filter_fletcher32, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29166 State: PUBLISHED Published: 2024-05-09T16:26:19.105Z Last Updated: 2025-02-13T15:47:44.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-29167 State: PUBLISHED Published: 2024-04-04T00:00:34.122Z Last Updated: 2024-08-12T20:29:09.740Z Vendors: SEEnergy Corp. Products: SVR-116 Problem Types: OS command injection Description: SVR-116 firmware version 1.6.0.30028871 allows a remote authenticated attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU93932313/
CVE ID: CVE-2024-29168 State: PUBLISHED Published: 2024-06-13T15:09:31.764Z Last Updated: 2024-08-02T01:10:54.079Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Dell Products: Secure Connect Gateway-Application, Secure Connect Gateway-Appliance Problem Types: CWE-89 Description: Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal assets REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing potential unauthorized access and modification of application data. Additional Analyst
cation's backend database causing potential unauthorized access and modification of application data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities
CVE ID: CVE-2024-29169 State: PUBLISHED Published: 2024-06-13T15:13:44.030Z Last Updated: 2025-08-27T15:52:36.412Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Dell Products: Secure Connect Gateway-Application, Secure Connect Gateway-Appliance Problem Types: CWE-89 Description: Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal audit REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing potential unauthorized access and modification of application data. Additional Analyst
ation's backend database causing potential unauthorized access and modification of application data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities
CVE ID: CVE-2024-29170 State: PUBLISHED Published: 2024-06-04T12:11:30.595Z Last Updated: 2024-08-02T01:10:54.023Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-798 Description: Dell PowerScale OneFS versions 8.2.x through 9.8.0.x contain a use of hard coded credentials vulnerability. An adjacent network unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure of network traffic and denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000225667/dsa-2024-210-security
ichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000225667/dsa-2024-210-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-29171 State: PUBLISHED Published: 2025-02-12T01:20:38.597Z Last Updated: 2025-02-13T03:51:59.353Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: Dell BSAFE SSL-J Problem Types: CWE-295 Description: Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains an Improper certificate verification vulnerability. A remote attacker could potentially exploit this vulnerability, leading to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000226620/dsa-2024-221-security-update-for-dell-bsafe-ssl-j-multiple-vulnerabilities
CVE ID: CVE-2024-29172 State: PUBLISHED Published: 2025-02-12T01:32:19.555Z Last Updated: 2025-02-13T03:54:13.588Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: Dell BSAFE SSL-J Problem Types: CWE-833 Description: Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains a deadlock vulnerability. A remote attacker could potentially exploit this vulnerability, leading to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000226620/dsa-2024-221-security-update-for-dell-bsafe-ssl-j-multiple-vulnerabilities
CVE ID: CVE-2024-29173 State: PUBLISHED Published: 2024-06-26T02:51:56.989Z Last Updated: 2024-08-02T01:10:54.471Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: PowerProtect DD Problem Types: CWE-918 Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Server-Side Request Forgery (SSRF) vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to disclosure of information on the application or remote client. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/0002
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-29174 State: PUBLISHED Published: 2024-06-26T02:57:41.758Z Last Updated: 2024-08-02T01:10:54.083Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Dell Products: PowerProtect DD Problem Types: CWE-89 Description: Dell Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.30, LTS 7.10.1.20 contain an SQL Injection vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing unauthorized access to application data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.co
tion data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-29175 State: PUBLISHED Published: 2024-06-26T03:03:06.155Z Last Updated: 2024-08-02T01:10:54.627Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: PowerProtect DD Problem Types: CWE-327 Description: Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to man-in-the-middle attack that exposes sensitive session information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000
lyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-29176 State: PUBLISHED Published: 2024-06-26T02:37:54.785Z Last Updated: 2024-10-30T13:29:57.031Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerProtect DD Problem Types: CWE-787 Description: Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-updat
nces: - https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-29177 State: PUBLISHED Published: 2024-06-26T02:46:55.073Z Last Updated: 2024-08-02T01:10:54.086Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: PowerProtect DD Problem Types: CWE-532 Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a disclosure of temporary sensitive information vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the reuse of disclosed information to gain unauthorized access to the application report. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ww
application report. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-29178 State: PUBLISHED Published: 2024-07-18T11:15:56.706Z Last Updated: 2025-02-13T17:47:39.338Z Vendors: Apache Software Foundation Products: Apache StreamPark Problem Types: CWE-94 Description: On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/n6dhnl68knpxy80t35qxkkw2691l8sfn - http://www.openwall.com/lists/o
tainer: References: - https://lists.apache.org/thread/n6dhnl68knpxy80t35qxkkw2691l8sfn - http://www.openwall.com/lists/oss-security/2024/07/18/1
CVE ID: CVE-2024-29179 State: PUBLISHED Published: 2024-03-25T20:27:55.083Z Last Updated: 2025-04-10T18:29:53.455Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: thorsten Products: phpMyFAQ Problem Types: CWE-79 Description: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9
CVE ID: CVE-2024-29180 State: PUBLISHED Published: 2024-03-21T16:47:53.848Z Last Updated: 2024-08-02T14:58:57.526Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: webpack Products: webpack-dev-middleware Problem Types: CWE-22 Description: Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory `memfs` filesystem. If `writeToDisk` configuration o
system when reading the files or it can use a virtualized in-memory `memfs` filesystem. If `writeToDisk` configuration option is set to `true`, the physical filesystem is used. The `getFilenameFromUrl` method is used to parse URL and build the local file path. The public path prefix is stripped from the URL, and the `unsecaped` path suffix is appended to the `outputPath`. As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use `%2e` and `%2f` sequences to perform path traversal attack. Developers using `webpack-dev-server` or `webpack-dev-middleware` are affected by the issue. When the project is started, an attacker might access any file
r` or `webpack-dev-middleware` are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content. If the development server is listening on a public IP address (or `0.0.0.0`), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port). If the server allows access from third-party domains, an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files. Starting with fixed versions 7.1.0, 6.1.2, and 5.3.4, the URL is unescaped and normalized before any furt
e local files. Starting with fixed versions 7.1.0, 6.1.2, and 5.3.4, the URL is unescaped and normalized before any further processing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6 - https://github.com/webpack/webpack-dev-middleware/commit/189c4ac7d2344ec132a4689e74dc837ec5be0132 - https://github.com/webpack/webpack-dev-middleware/commit/9670b3495da518fe667ff3428c5e4cb9f2f3d353 - https://github.com/webpack/webpack-dev-middleware/commit/e10008c762e4d5821ed6990348dabf0d4d93a10e - https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517
8c762e4d5821ed6990348dabf0d4d93a10e - https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/getFilenameFromUrl.js#L82 - https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/setupOutputFileSystem.js#L21 - https://github.com/webpack/webpack-dev-middleware/releases/tag/v5.3.4 - https://github.com/webpack/webpack-dev-middleware/releases/tag/v6.1.2 - https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.1.0
CVE ID: CVE-2024-29181 State: PUBLISHED Published: 2024-06-12T14:46:04.902Z Last Updated: 2024-08-02T01:10:54.079Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: strapi Products: strapi Problem Types: CWE-639 Description: Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.
eir own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/strapi/strapi/security/advisories/GHSA-6j89-frxc-q26m - https://github.com/strapi/strapi/commit/e1dfd4d9f1cab25cf6da3614c1975e4e508e01c6
CVE ID: CVE-2024-29182 State: PUBLISHED Published: 2024-04-04T14:48:16.705Z Last Updated: 2024-08-02T01:10:54.093Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: CollaboraOnline Products: online Problem Types: CWE-79 Description: Collabora Online is a collaborative online office suite based on LibreOffice. A stored cross-site scripting vulnerability was found in Collabora Online. An attacker could create a document with an XSS payload in document text referenced by field which, if hovered over to produce a tooltip, could be executed by the user's browser. Users should upgrade to Collabora Online 23.05.10.1 or higher. Earlier series of Collabora Online, 22.0
user's browser. Users should upgrade to Collabora Online 23.05.10.1 or higher. Earlier series of Collabora Online, 22.04, 21.11, etc. are unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CollaboraOnline/online/security/advisories/GHSA-9gmw-5q2c-4398
CVE ID: CVE-2024-29183 State: PUBLISHED Published: 2024-04-19T15:52:31.666Z Last Updated: 2024-08-02T01:10:54.101Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: baidu Products: openrasp Problem Types: CWE-79 Description: OpenRASP is a RASP solution that directly integrates its protection engine into the application server by instrumentation. There exists a reflected XSS in the /login page due to a reflection of the redirect parameter. This allows an attacker to execute arbitrary javascript with the permissions of a user after the user logins with their account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:
ins with their account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/baidu/openrasp/commit/240fde3901c7a36aaade3683ffd5c89140a535fb - https://securitylab.github.com/advisories/GHSL-2023-253_openrasp
CVE ID: CVE-2024-29184 State: PUBLISHED Published: 2024-03-22T17:01:01.799Z Last Updated: 2024-08-02T01:10:54.089Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: freescout-helpdesk Products: freescout Problem Types: CWE-79 Description: FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. In this case, t