Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47007 State: PUBLISHED Published: 2024-10-08T16:27:46.696Z Last Updated: 2024-10-08T18:46:21.255Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-476 Description: A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE ID: CVE-2024-47008 State: PUBLISHED Published: 2024-10-08T16:28:14.887Z Last Updated: 2024-10-08T18:45:02.588Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-918 Description: Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE ID: CVE-2024-47009 State: PUBLISHED Published: 2024-10-08T16:28:53.641Z Last Updated: 2024-10-08T17:40:31.429Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Ivanti Products: Avalanche Problem Types: CWE-22, CWE-288 Description: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE ID: CVE-2024-47010 State: PUBLISHED Published: 2024-10-08T16:29:57.222Z Last Updated: 2024-10-08T17:39:47.159Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Ivanti Products: Avalanche Problem Types: CWE-22, CWE-288 Description: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE ID: CVE-2024-47011 State: PUBLISHED Published: 2024-10-08T16:30:25.388Z Last Updated: 2024-10-08T17:39:16.171Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-22 Description: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE ID: CVE-2024-47012 State: PUBLISHED Published: 2024-10-25T10:34:03.942Z Last Updated: 2024-10-25T18:39:01.508Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In mm_GetMobileIdIndexForNsUpdate of mm_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47013 State: PUBLISHED Published: 2024-10-25T10:34:04.130Z Last Updated: 2024-10-25T18:36:10.859Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47014 State: PUBLISHED Published: 2024-10-25T10:34:04.299Z Last Updated: 2024-10-25T18:32:58.224Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47015 State: PUBLISHED Published: 2024-10-25T10:34:04.460Z Last Updated: 2024-10-25T14:55:51.007Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In ProtocolMiscHwConfigChangeAdapter::GetData() of protocolmiscadapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47016 State: PUBLISHED Published: 2024-10-25T10:34:04.628Z Last Updated: 2024-10-25T14:53:50.030Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: there is a possible privilege escalation due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47017 State: PUBLISHED Published: 2024-10-25T10:34:04.790Z Last Updated: 2024-10-25T14:49:08.403Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In ufshc_scsi_cmd of ufs.c, there is a possible stack variable use after free due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47018 State: PUBLISHED Published: 2024-10-25T10:34:04.977Z Last Updated: 2024-10-25T14:45:54.221Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47019 State: PUBLISHED Published: 2024-10-25T10:34:05.150Z Last Updated: 2024-10-25T14:43:12.598Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In ProtocolEmbmsSaiListAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47020 State: PUBLISHED Published: 2024-10-25T10:34:05.317Z Last Updated: 2024-10-28T20:19:11.314Z Vendors: Google Products: Android Problem Types: Information disclosure Description: Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ABL component, A-331966488. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47021 State: PUBLISHED Published: 2024-10-25T10:34:05.495Z Last Updated: 2024-10-28T20:18:27.173Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In sms_ExtractCbLanguage of sms_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47022 State: PUBLISHED Published: 2024-10-25T10:34:05.677Z Last Updated: 2024-10-28T20:17:19.827Z Vendors: Google Products: Android Problem Types: Information disclosure Description: Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-331255656. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47023 State: PUBLISHED Published: 2024-10-25T10:34:05.871Z Last Updated: 2024-10-28T20:04:06.039Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47024 State: PUBLISHED Published: 2024-10-25T10:34:06.036Z Last Updated: 2024-10-25T16:14:53.163Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In vring_size of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47025 State: PUBLISHED Published: 2024-10-25T10:34:06.191Z Last Updated: 2024-10-25T16:14:33.314Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47026 State: PUBLISHED Published: 2024-10-25T10:34:06.352Z Last Updated: 2024-10-25T16:12:59.109Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In gsc_gsa_rescue of gsc_gsa.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47027 State: PUBLISHED Published: 2024-10-25T10:34:06.522Z Last Updated: 2024-10-25T16:12:48.479Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47028 State: PUBLISHED Published: 2024-10-25T10:34:06.682Z Last Updated: 2024-10-25T16:12:38.787Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In ffu_flash_pack of ffu.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47029 State: PUBLISHED Published: 2024-10-25T10:34:06.850Z Last Updated: 2024-10-25T15:57:26.159Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In TrustySharedMemoryManager::GetSharedMemory of ondevice/trusty/trusty_shared_memory_manager.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47030 State: PUBLISHED Published: 2024-10-25T10:34:07.037Z Last Updated: 2024-10-28T20:02:02.939Z Vendors: Google Products: Android Problem Types: Information disclosure Description: Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-315191818. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47031 State: PUBLISHED Published: 2024-10-25T10:34:07.253Z Last Updated: 2024-10-28T20:00:53.088Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-329163861. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47032 State: PUBLISHED Published: 2025-01-03T03:28:22.448Z Last Updated: 2025-01-03T22:45:44.677Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In construct_transaction_from_cmd of lwis_ioctl.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-47033 State: PUBLISHED Published: 2024-10-25T10:34:07.429Z Last Updated: 2024-10-25T16:12:27.582Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In lwis_allocator_free of lwis_allocator.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47034 State: PUBLISHED Published: 2024-10-25T10:34:07.639Z Last Updated: 2024-10-25T15:56:04.139Z Vendors: Google Products: Android Problem Types: Information disclosure Description: there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47035 State: PUBLISHED Published: 2024-10-25T10:34:07.817Z Last Updated: 2024-10-25T16:00:28.134Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In vring_init of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47038 State: PUBLISHED Published: 2024-12-18T19:01:09.231Z Last Updated: 2024-12-18T19:09:39.210Z Vendors: Google Products: Android Problem Types: CWE-787 Description: In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation of privilege with no additional execution privileges needed. Usercinteraction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-11-01
CVE ID: CVE-2024-47039 State: PUBLISHED Published: 2024-12-18T19:04:29.409Z Last Updated: 2024-12-18T19:16:43.518Z Vendors: Google Products: Android Problem Types: CWE-125 Description: In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-11-01
CVE ID: CVE-2024-47040 State: PUBLISHED Published: 2024-12-18T19:08:48.273Z Last Updated: 2024-12-18T19:16:57.004Z Vendors: Google Products: Android Problem Types: CWE-416 Description: There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-11-01
CVE ID: CVE-2024-47041 State: PUBLISHED Published: 2024-10-25T10:34:08.185Z Last Updated: 2024-10-25T15:52:00.823Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In valid_address of syscall.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-47043 State: PUBLISHED Published: 2024-12-06T18:12:13.447Z Last Updated: 2024-12-06T20:41:32.985Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Ruijie Products: Reyee OS Problem Types: CWE-922 Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and part of the email address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE ID: CVE-2024-47044 State: PUBLISHED Published: 2024-09-26T08:34:30.347Z Last Updated: 2024-10-17T01:33:49.083Z Vendors: NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Products: Hikari Denwa router RT-400MI, Hikari Denwa router PR-400MI, Hikari Denwa router RV-440MI, Home GateWay/Hikari Denwa router PR-500MI/RS-500MI/RT-500MI, Home GateWay/Hikari Denwa router PR-600MI/RX-600MI Problem Types: CWE-451 Description: Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the
vice Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web116.jp/ced/support/news/contents/2024/20240930.html - https://web116.jp/ced/support/version/broadband/rt_400mi/ - https://web116.jp/ced/support/version/broadband/pr_400mi/ - https://web116.jp/ced/support/version/broadband/rv_440mi/ - https
://web116.jp/ced/support/version/broadband/pr_400mi/ - https://web116.jp/ced/support/version/broadband/rv_440mi/ - https://web116.jp/ced/support/version/broadband/500mi/ - https://web116.jp/ced/support/version/broadband/600mi/ - https://jvn.jp/en/jp/JVN78356367/
CVE ID: CVE-2024-47045 State: PUBLISHED Published: 2024-09-26T03:33:48.931Z Last Updated: 2024-09-26T14:45:34.542Z Vendors: National Tax Agency Products: The installer of e-Tax software(common program) Problem Types: CWE-268 Description: Privilege chaining issue exists in the installer of e-Tax software(common program). If this vulnerability is exploited, a malicious DLL prepared by an attacker may be executed with higher privileges than the application privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.e-tax.nta.go.jp/topics/2024/topics_20240924_versionup.htm - https://jvn.jp/en/jp/JVN57749899/
CVE ID: CVE-2024-47046 State: PUBLISHED Published: 2024-10-08T08:40:45.216Z Last Updated: 2024-12-10T13:53:53.235Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Simcenter Femap V2306, Simcenter Femap V2401, Simcenter Femap V2406 Problem Types: CWE-119 Description: A vulnerability has been identified in Simcenter Femap V2306 (All versions), Simcenter Femap V2401 (All versions), Simcenter Femap V2406 (All versions). The affected application is vulnerable to memory corruption while parsing specially crafted BDF files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnri
uld allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-852501.html - https://cert-portal.siemens.com/productcert/html/ssa-881356.html
CVE ID: CVE-2024-47047 State: PUBLISHED Published: 2024-09-17T00:00:00.000Z Last Updated: 2025-03-17T15:00:39.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension. The fixed versions are 7.5.1, 8.5.1, 10.9.1, and 12.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2024-007
CVE ID: CVE-2024-47048 State: PUBLISHED Published: 2024-09-24T00:00:00.000Z Last Updated: 2025-03-25T16:10:41.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketplace and private apps. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RocketChat/Rocket.Chat/pull/33246 - https://docs.rocket.chat/docs/rocketchat-security-fixes-updates-and-advisories
CVE ID: CVE-2024-47049 State: PUBLISHED Published: 2024-09-17T00:00:00.000Z Last Updated: 2025-03-18T19:37:41.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/czim/file-handling/blob/2.3.0/SECURITY.md
CVE ID: CVE-2024-47050 State: PUBLISHED Published: 2024-09-18T21:04:46.642Z Last Updated: 2024-09-19T15:41:19.126Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Mautic Products: Mautic Problem Types: CWE-79 Description: Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-73gr-32wg-qhh7