Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-56132 State: PUBLISHED Published: 2025-02-05T18:01:02.522Z Last Updated: 2025-02-05T18:38:55.623Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Products: LoadMaster Problem Types: CWE-20 Description: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) From 7.2.49.0 to 7.2.54.12 (inclusive) 7.2.48.12 and all prior versions ECS All prior versions to 7.2.60.1 (inclusive) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Load
nclusive) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/LoadMaster-Security-Vulnerability-CVE-2024-56131-CVE-2024-56132-CVE-2024-56133-CVE-2024-56134-CVE-2024-56135
CVE ID: CVE-2024-56133 State: PUBLISHED Published: 2025-02-05T18:01:31.031Z Last Updated: 2025-02-05T18:35:44.282Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Products: LoadMaster Problem Types: CWE-20 Description: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) From 7.2.49.0 to 7.2.54.12 (inclusive) 7.2.48.12 and all prior versions ECS All prior versions to 7.2.60.1 (inclusive) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Load
CVE ID: CVE-2024-56134 State: PUBLISHED Published: 2025-02-05T18:02:03.882Z Last Updated: 2025-02-05T18:34:49.816Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Products: LoadMaster Problem Types: CWE-20 Description: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) From 7.2.49.0 to 7.2.54.12 (inclusive) 7.2.48.12 and all prior versions Multi-Tenant Hypervisor 7.1.35.12 and all prior versions ECS All prior versions to 7.2.60.1 (inclusive) Additional Analyst Notes: - CISA ADP Vulnrichment: Re
CVE ID: CVE-2024-56135 State: PUBLISHED Published: 2025-02-05T18:02:29.175Z Last Updated: 2025-02-12T19:41:05.958Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Products: LoadMaster Problem Types: CWE-20 Description: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) From 7.2.49.0 to 7.2.54.12 (inclusive) 7.2.48.12 and all prior versions ECS All prior versions to 7.2.60.1 (inclusive) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Load
CVE ID: CVE-2024-56136 State: PUBLISHED Published: 2025-01-16T19:25:33.261Z Last Updated: 2025-02-06T21:29:12.118Z Vendors: zulip Products: zulip Problem Types: CWE-200 Description: Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an email address is in use by a user. Zulip Server 9.4 resolves the issue, as does the `main` branch of Zulip Server. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CISA
p Server. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-5xg8-xhfj-4hm6 - https://github.com/zulip/zulip/commit/c6334a765b1e6d71760e4a3b32ae5b8367f2ed4d
CVE ID: CVE-2024-56137 State: PUBLISHED Published: 2025-01-02T14:26:19.958Z Last Updated: 2025-01-02T17:56:52.607Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: 1Panel-dev Products: MaxKB Problem Types: CWE-78 Description: MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0. Additional Analyst Notes: - CI
sers to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-76w2-2g72-cg85
CVE ID: CVE-2024-56138 State: PUBLISHED Published: 2025-01-13T21:37:59.729Z Last Updated: 2025-01-14T00:26:00.838Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: notaryproject Products: notation-go Problem Types: CWE-299 Description: notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation statu
estamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This
e timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v - https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102
CVE ID: CVE-2024-56139 State: PUBLISHED Published: 2024-12-17T18:32:18.011Z Last Updated: 2024-12-20T20:58:09.933Z Vendors: leonhad Products: pdftools Problem Types: CWE-121 Description: pdftools is a high level tools to convert PDF files to ePUB formats. In versions up to and including 0.5.0 maliciously crafted epub files can cause a stack overflow leading to a crash. This issue has not yet been addressed and users are advised to avoid untrusted input to their systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/leonhad/pdftools/security/advisories/GHSA-hgvf-4pf3-fwc9
CVE ID: CVE-2024-56140 State: PUBLISHED Published: 2024-12-18T20:41:06.806Z Last Updated: 2024-12-18T21:03:36.201Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: withastro Products: astro Problem Types: CWE-352 Description: Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the `security.checkOrigin` configuration option is set to `true`, Astro middleware will perform a CSRF check. However, a vulnerability exists that can bypass this security. A semicolon-delimited parameter is allowed after the type in `Content-Type`. Web browsers will treat a `C
this security. A semicolon-delimited parameter is allowed after the type in `Content-Type`. Web browsers will treat a `Content-Type` such as `application/x-www-form-urlencoded; abc` as a `simple request` and will not perform preflight validation. In this case, CSRF is not blocked as expected. Additionally, the `Content-Type` header is not required for a request. This issue has been addressed in version 4.16.17 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/withastro/astro/security/advisories/GHSA-c4pw-33h3-35xw - https://github.com/withastro/astro/commit/e7d14c374
github.com/withastro/astro/security/advisories/GHSA-c4pw-33h3-35xw - https://github.com/withastro/astro/commit/e7d14c374b9d45e27089994a4eb72186d05514de - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests - https://github.com/withastro/astro/blob/6031962ab5f56457de986eb82bd24807e926ba1b/packages/astro/src/core/app/middlewares.ts
CVE ID: CVE-2024-56142 State: PUBLISHED Published: 2024-12-17T21:41:13.309Z Last Updated: 2024-12-18T15:40:33.245Z Vendors: Aiven-Open Products: pghoard Problem Types: CWE-22 Description: pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. A vulnerability has been discovered that could allow an attacker to acquire disk access with privileges equivalent to those of pghoard, allowing for unintended path traversal. Depending on the permissions/privileges assigned to pghoard, this could allow disclosure of sensitive information. This issue has been addressed in releases after 2.2.2a. Users are advised to upgrade. There are no known workaround
ion. This issue has been addressed in releases after 2.2.2a. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Aiven-Open/pghoard/security/advisories/GHSA-m9hc-vxjj-4x6q
CVE ID: CVE-2024-56143 State: PUBLISHED Published: 2025-10-16T16:07:30.996Z Last Updated: 2025-10-16T17:54:24.103Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: strapi Products: strapi Problem Types: CWE-639 Description: Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter. This vulnerability is fixed in 5.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
the lookup parameter. This vulnerability is fixed in 5.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/strapi/strapi/security/advisories/GHSA-495j-h493-42q2 - https://github.com/strapi/strapi/commit/0c6e0953ae1e62afae9329de7ae6d6a5e21b95b8
CVE ID: CVE-2024-56144 State: PUBLISHED Published: 2025-01-16T22:28:03.567Z Last Updated: 2025-02-12T20:31:23.492Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display. Librenms versions up to 24.11.0 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to
When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.12.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-2f4w-6mc7-4w78
CVE ID: CVE-2024-56145 State: PUBLISHED Published: 2024-12-18T20:37:34.301Z Last Updated: 2025-10-21T22:55:33.949Z Vendors: craftcms Products: cms Problem Types: CWE-94 Description: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
isable `register_argc_argv` to mitigate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9 - https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3
CVE ID: CVE-2024-56156 State: PUBLISHED Published: 2025-04-25T15:08:00.942Z Last Updated: 2025-04-25T20:15:07.849Z Vendors: halo-dev Products: halo Problem Types: CWE-79 Description: Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/halo-dev/halo/security/a
on 2.20.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/halo-dev/halo/security/advisories/GHSA-99mc-ch53-pqh9 - https://github.com/halo-dev/halo/pull/7149
CVE ID: CVE-2024-56157 State: PUBLISHED Published: 2025-05-14T14:40:46.107Z Last Updated: 2025-05-14T15:13:31.854Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before importing it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-6p48-74j9-977j
CVE ID: CVE-2024-56158 State: PUBLISHED Published: 2025-06-12T14:56:56.939Z Last Updated: 2025-06-12T15:23:33.935Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-89 Description: XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82 - https
ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82 - https://jira.xwiki.org/browse/XWIKI-22734
CVE ID: CVE-2024-56159 State: PUBLISHED Published: 2024-12-19T18:58:31.989Z Last Updated: 2024-12-20T20:44:36.686Z Vendors: withastro Products: astro Problem Types: CWE-219 Description: Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files **for the server code** are moved to a publicly-accessible folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website. While some server files are hashed, making their access obscure, the files correspon
er hosting the rest of the website. While some server files are hashed, making their access obscure, the files corresponding to the file system router (those in `src/pages`) are predictably named. For example. the sourcemap file for `src/pages/index.astro` gets named `dist/client/pages/index.astro.mjs.map`. This vulnerability is the root cause of issue #12703, which links to a simple stackblitz project demonstrating the vulnerability. Upon build, notice the contents of the `dist/client` (referred to as `config.build.client` in astro code) folder. All astro servers make the folder in question accessible to the public internet without any authentication. It contains `.map` files corresponding
folder in question accessible to the public internet without any authentication. It contains `.map` files corresponding to the code that runs on the server. All **server-output** projects on Astro 5 versions **v5.0.3** through **v5.0.7**, that have **sourcemaps enabled**, either directly or through an add-on such as `sentry`, are affected. The fix for **server-output** projects was released in **astro@5.0.8**. Additionally, all **static-output** projects built using Astro 4 versions **4.16.17 or older**, or Astro 5 versions **5.0.8 or older**, that have **sourcemaps enabled** are also affected. The fix for **static-output** projects was released in **astro@5.0.9**, and backported to Astro v4
** are also affected. The fix for **static-output** projects was released in **astro@5.0.9**, and backported to Astro v4 in **astro@4.16.18**. The immediate impact is limited to source code. Any secrets or environment variables are not exposed unless they are present verbatim in the source code. There is no immediate loss of integrity within the the vulnerable server. However, it is possible to subsequently discover another vulnerability via the revealed source code . There is no immediate impact to availability of the vulnerable server. However, the presence of an unsafe regular expression, for example, can quickly be exploited to subsequently compromise the availability. The fix for **serv
egular expression, for example, can quickly be exploited to subsequently compromise the availability. The fix for **server-output** projects was released in **astro@5.0.8**, and the fix for **static-output** projects was released in **astro@5.0.9** and backported to Astro v4 in **astro@4.16.18**. Users are advised to update immediately if they are using sourcemaps or an integration that enables sourcemaps. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr - https://github.com/withastro/astro/issues/12703 - https://github.com/getsentry/sentry-javascript/blob/develop/packages/astro/src/integration/index.t
/astro/issues/12703 - https://github.com/getsentry/sentry-javascript/blob/develop/packages/astro/src/integration/index.ts#L50 - https://github.com/withastro/astro/blob/176fe9f113fd912f9b61e848b00bbcfecd6d5c2c/packages/astro/src/core/build/static-build.ts#L139
CVE ID: CVE-2024-56161 State: PUBLISHED Published: 2025-02-03T17:24:01.185Z Last Updated: 2025-04-02T22:03:14.707Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: AMD Products: AMD EPYC™ 7001 Series, AMD EPYC™ 7002 Series, AMD EPYC™ 7003 Series, AMD EPYC™ 9004 Series Problem Types: CWE-347 Description: Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.a
der AMD SEV-SNP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html
CVE ID: CVE-2024-56169 State: PUBLISHED Published: 2024-12-18T00:00:00.000Z Last Updated: 2025-02-10T22:14:44.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintain a backup cache of the remote RPKI data. This can be employed as a fallback in case a new fetch fails or yields incorrect files. However, the product currently uses its cache merely as a bandwidth saving tool (because fetching is performed through deltas). If a fetch fails midway or yields incorrect files, there is no viable fallback. This leads to incomplete route origin validation
h fails midway or yields incorrect files, there is no viable fallback. This leads to incomplete route origin validation data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nicmx.github.io/FORT-validator/CVE.html - https://github.com/NICMx/FORT-validator/issues/82
CVE ID: CVE-2024-56170 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-26T19:07:44.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients are supposed to verify. Assuming everything else is correct, the most recent version of a manifest should be prioritized over other versions, to prevent replays, accidental or otherwise. Manifests contain the manifestNumber and thisUpdate fields, which can be used to gauge the relevance of a given manifest, when compared to other manifests. The former is a serial-like sequential number, an
e the relevance of a given manifest, when compared to other manifests. The former is a serial-like sequential number, and the latter is the date on which the manifest was created. However, the product does not compare the up-to-dateness of the most recently fetched manifest against the cached manifest. As such, it's prone to a rollback to a previous version if it's served a valid outdated manifest. This leads to outdated route origin validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nicmx.github.io/FORT-validator/CVE.html
CVE ID: CVE-2024-56171 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-11-03T20:49:05.224Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: xmlsoft Products: libxml2 Problem Types: CWE-416 Description: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libxml2/-/issues/828
CVE ID: CVE-2024-56173 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-18T15:52:01.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from JavaScript in an SVG document. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/32344323720973-Configured-Commerce-Security-Advisory-COM-2024-01