Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
he calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/libgit2/libgit2/security/advisories/GHSA-54mf-x2rh-hq9v - https://github.com/libgit2/libgit2/commit/add2dabb3c16aa49b33904dcdc07cd915efc12fa
rity/advisories/GHSA-54mf-x2rh-hq9v - https://github.com/libgit2/libgit2/commit/add2dabb3c16aa49b33904dcdc07cd915efc12fa - https://github.com/libgit2/libgit2/releases/tag/v1.6.5 - https://github.com/libgit2/libgit2/releases/tag/v1.7.2 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S635BGHHZUMRPI7QOXOJ45QHDD5FFZ3S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4M3P7WIEPXNRLBINQRJFXUSTNKBCHYC7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7CNDW3PF6NHO7OXNM5GN6WSSGAMA7MZE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.f
t.org/message/7CNDW3PF6NHO7OXNM5GN6WSSGAMA7MZE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z6MXOX7I43OWNN7R6M54XLG6U5RXY244/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGNHOEE2RBLH7KCJUPUNYG4CDTW4HTBT/
CVE ID: CVE-2024-24576 State: PUBLISHED Published: 2024-04-09T17:28:41.800Z Last Updated: 2025-11-04T18:29:08.712Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: rust-lang Products: rust Problem Types: CWE-78, CWE-88 Description: Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability i
e spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected. The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an argument. On Windows, the implementation of this is more complex than other platforms, because the Windows API only provides a single string containing all the arguments to the spawne
x than other platforms, because the Windows API only provides a single string containing all the arguments to the spawned process, and it's up to the spawned process to split them. Most programs use the standard C run-time argv, which in practice results in a mostly consistent way arguments are splitted. One exception though is `cmd.exe` (used among other things to execute batch files), which has its own argument splitting logic. That forces the standard library to implement custom escaping for arguments passed to batch files. Unfortunately it was reported that our escaping logic was not thorough enough, and it was possible to pass malicious arguments that would result in arbitrary shell exe
logic was not thorough enough, and it was possible to pass malicious arguments that would result in arbitrary shell execution. Due to the complexity of `cmd.exe`, we didn't identify a solution that would correctly escape arguments in all cases. To maintain our API guarantees, we improved the robustness of the escaping code, and changed the `Command` API to return an `InvalidInput` error when it cannot safely escape an argument. This error will be emitted when spawning the process. The fix is included in Rust 1.77.2. Note that the new escaping logic for batch files errs on the conservative side, and could reject valid arguments. Those who implement the escaping themselves or only handle trus
the conservative side, and could reject valid arguments. Those who implement the escaping themselves or only handle trusted inputs on Windows can also use the `CommandExt::raw_arg` method to bypass the standard library's escaping logic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh - https://doc.rust-lang.org/std/io/enum.ErrorKind.html#variant.InvalidInput - https://doc.rust-lang.org/std/os/windows/process/trait.CommandExt.html#tymethod.raw_arg - https://doc.rust-lang.org/std/process/struct.Command.html - https://doc.rust-lang.org/std/process/struct.Command.html#method.arg -
.rust-lang.org/std/process/struct.Command.html - https://doc.rust-lang.org/std/process/struct.Command.html#method.arg - https://doc.rust-lang.org/std/process/struct.Command.html#method.args - https://github.com/rust-lang/rust/issues - https://www.rust-lang.org/policies/security - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W7WRFOIAZXYUPGXGR5UEEW7VTTOD4SZ3/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RPH3PF7DVSS2LVIRLW254VWUPVKJN46P/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N323QAEEUVTJ354BTVQ7UB6LYXUX2BCL/ - http://www.openwall.com/li
ves/list/package-announce@lists.fedoraproject.org/message/N323QAEEUVTJ354BTVQ7UB6LYXUX2BCL/ - http://www.openwall.com/lists/oss-security/2024/04/09/16
CVE ID: CVE-2024-24577 State: PUBLISHED Published: 2024-02-06T21:36:12.517Z Last Updated: 2025-05-15T19:43:35.897Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: libgit2 Products: libgit2 Problem Types: CWE-122 Description: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later
as_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8 - https://github.com/libgit2/libgit2/releases/tag/v1.6.5 - https://github.com/libgit2/libgit2/releases/tag/v1.7.2 - https://lists.fedoraproject.org/archives/list/p
es/tag/v1.6.5 - https://github.com/libgit2/libgit2/releases/tag/v1.7.2 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S635BGHHZUMRPI7QOXOJ45QHDD5FFZ3S/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4M3P7WIEPXNRLBINQRJFXUSTNKBCHYC7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7CNDW3PF6NHO7OXNM5GN6WSSGAMA7MZE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z6MXOX7I43OWNN7R6M54XLG6U5RXY244/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGNHOEE2
4XLG6U5RXY244/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGNHOEE2RBLH7KCJUPUNYG4CDTW4HTBT/ - https://lists.debian.org/debian-lts-announce/2024/02/msg00012.html
CVE ID: CVE-2024-24578 State: PUBLISHED Published: 2024-03-18T21:13:03.626Z Last Updated: 2024-08-26T13:54:04.130Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: jens-maus Products: RaspberryMatic Problem Types: CWE-23, CWE-306 Description: RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `Firmware
atric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-637h
CVE ID: CVE-2024-24579 State: PUBLISHED Published: 2024-01-31T16:40:35.385Z Last Updated: 2024-08-23T16:26:39.050Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: anchore Products: stereoscope Problem Types: CWE-22 Description: stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. Specifically, use of `github.com/anchore/stereoscope/pkg/file.UntarToDirectory()` function, the `github.com/anchore/stereoscope/pkg/image/
of `github.com/anchore/stereoscope/pkg/file.UntarToDirectory()` function, the `github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider` struct, or the higher level `github.com/anchore/stereoscope/pkg/image.Image.Read()` function express this vulnerability. As a workaround, if you are using the OCI archive as input into stereoscope then you can switch to using an OCI layout by unarchiving the tar archive and provide the unarchived directory to stereoscope. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv - https://github.com/anchore/stereoscope/commit/09dacab4d9ee6
nchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv - https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204
CVE ID: CVE-2024-24580 State: PUBLISHED Published: 2024-08-14T13:45:29.360Z Last Updated: 2024-08-16T15:49:23.793Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Data Center GPU Max Series 1100 and 1550 products Problem Types: denial of service, CWE-92 Description: Improper conditions check in some Intel(R) Data Center GPU Max Series 1100 and 1550 products may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01094.html
CVE ID: CVE-2024-24581 State: PUBLISHED Published: 2024-04-02T06:23:03.141Z Last Updated: 2025-03-04T21:53:06.014Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-787 Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution through out-of-bounds write. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md
CVE ID: CVE-2024-24582 State: PUBLISHED Published: 2025-02-12T21:19:27.722Z Last Updated: 2025-11-03T20:36:50.996Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) processors Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html
CVE ID: CVE-2024-24583 State: PUBLISHED Published: 2024-05-28T14:02:40.872Z Last Updated: 2025-02-13T17:40:15.459Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: libigl Products: libigl Problem Types: CWE-125 Description: Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.This vulnerabilitty concerns the`readMSH` function while processing `MshLoader::ELEMENT_TRI` elements. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosinte
I` elements. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1928
CVE ID: CVE-2024-24584 State: PUBLISHED Published: 2024-05-28T14:02:40.957Z Last Updated: 2025-02-13T17:40:16.104Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: libigl Products: libigl Problem Types: CWE-125 Description: Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.This vulnerabilitty concerns the`readMSH` function while processing `MshLoader::ELEMENT_TET` elements. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosinte
T` elements. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1928
CVE ID: CVE-2024-24590 State: PUBLISHED Published: 2024-02-06T14:40:26.963Z Last Updated: 2025-06-17T21:29:28.345Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Allegro.AI Products: ClearML Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE ID: CVE-2024-24591 State: PUBLISHED Published: 2024-02-06T14:40:56.097Z Last Updated: 2025-05-15T19:44:27.786Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Allegro.AI Products: ClearML Problem Types: CWE-22 Description: A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-
nt: References: - https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE ID: CVE-2024-24592 State: PUBLISHED Published: 2024-02-06T14:41:24.002Z Last Updated: 2024-08-22T19:15:24.399Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Allegro.AI Products: ClearML Problem Types: CWE-425 Description: Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE ID: CVE-2024-24593 State: PUBLISHED Published: 2024-02-06T14:41:44.470Z Last Updated: 2025-06-17T14:25:25.374Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Allegro.AI Products: ClearML Problem Types: CWE-352 Description: A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off ne
tial workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE ID: CVE-2024-24594 State: PUBLISHED Published: 2024-02-06T14:42:08.052Z Last Updated: 2024-08-01T23:28:11.107Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Allegro.AI Products: ClearML Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views the Debug Samples tab in the web UI. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE ID: CVE-2024-24595 State: PUBLISHED Published: 2024-02-05T21:15:19.026Z Last Updated: 2025-05-15T19:47:08.697Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Allegro.AI Products: ClearML Problem Types: CWE-522 Description: Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE ID: CVE-2024-24621 State: PUBLISHED Published: 2024-07-25T21:44:48.110Z Last Updated: 2024-08-01T23:28:11.063Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: Softaculous Products: Webuzo Problem Types: CWE-697 Description: Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-authentication-bypass/
CVE ID: CVE-2024-24622 State: PUBLISHED Published: 2024-07-25T21:44:53.974Z Last Updated: 2024-08-01T23:28:11.074Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Softaculous Products: Webuzo Problem Types: CWE-78 Description: Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.exodusintel.com/2024/07/24/softaculous-webuzo-password-reset-command-injection/
CVE ID: CVE-2024-24623 State: PUBLISHED Published: 2024-07-25T21:44:51.964Z Last Updated: 2024-08-01T23:28:11.161Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Softaculous Products: Webuzo Problem Types: CWE-78 Description: Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-ftp-management-command-injection/
CVE ID: CVE-2024-24680 State: PUBLISHED Published: 2024-02-06T00:00:00.000Z Last Updated: 2025-11-04T18:29:09.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/5.0/releases/security/ - https://www.djangoproject.com/weblog/2024/feb/06/security-releases/ - https://lists.fedoraproject.org
leases/security/ - https://www.djangoproject.com/weblog/2024/feb/06/security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/
CVE ID: CVE-2024-24681 State: PUBLISHED Published: 2024-02-23T00:00:00.000Z Last Updated: 2025-11-04T18:29:11.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single hardcoded key (used to encrypt provisioning documents) across customers' installations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gitaware/CVE/tree/main/CVE-2024-24681 - https://seclists.org/fulldisclosure/2024/Feb/22
CVE ID: CVE-2024-24683 State: PUBLISHED Published: 2024-03-19T08:20:18.989Z Last Updated: 2025-02-13T17:40:17.349Z Vendors: Apache Software Foundation Products: Apache Hop Engine Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Hop Engine.This issue affects Apache Hop Engine: before 2.8.0. Users are recommended to upgrade to version 2.8.0, which fixes the issue. When Hop Server writes links to the PrepareExecutionPipelineServlet page one of the parameters provided to the user was not properly escaped. The variable not properly escaped is the "id", which is not directly accessible by users creating pipelines making the risk of exploiting this low. This issu
the "id", which is not directly accessible by users creating pipelines making the risk of exploiting this low. This issue only affects users using the Hop Server component and does not directly affect the client. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/ts203zssv1n9qth1wdlhk2bhos3vcq6t - http://www.openwall.com/lists/oss-security/2024/03/18/1