Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-24758 State: PUBLISHED Published: 2024-02-16T21:40:37.716Z Last Updated: 2025-02-13T17:40:21.660Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: nodejs Products: undici Problem Types: CWE-200 Description: Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nodejs/u
y. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3 - https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef - https://security.netapp.com/advisory/ntap-20240419-0007/ - http://www.openwall.com/lists/oss-security/2024/03/11/1
CVE ID: CVE-2024-24759 State: PUBLISHED Published: 2024-09-05T16:30:38.659Z Last Updated: 2024-09-05T17:46:08.516Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: mindsdb Products: mindsdb Problem Types: CWE-918 Description: MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-vp96-94xr - https://github.com/mindsdb/mindsdb/commit/5f7496481bd3db1d06a2d2e62c0dce960a1fe12b
CVE ID: CVE-2024-24760 State: PUBLISHED Published: 2024-02-02T15:28:22.086Z Last Updated: 2025-05-15T19:49:55.480Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mailcow Products: mailcow-dockerized Problem Types: CWE-610 Description: mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of a Docker container, even when the port is bound to 127.0.0.1. The vulnerability has been addressed by implementing additional iptables/nftables rules. T
e port is bound to 127.0.0.1. The vulnerability has been addressed by implementing additional iptables/nftables rules. These rules drop packets for Docker containers on ports 3306, 6379, 8983, and 12345, where the input interface is not `br-mailcow` and the output interface is `br-mailcow`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-gmpj-5xcm-xxx6 - https://github.com/mailcow/mailcow-dockerized/commit/087481ac12bfa5dd715f3630f0b1697be94f7e88
CVE ID: CVE-2024-24761 State: PUBLISHED Published: 2024-03-06T17:25:59.423Z Last Updated: 2024-08-22T18:34:53.055Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: galette Products: galette Problem Types: CWE-863 Description: Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per default restricted to only administrators and staff members. From configuration, it is possible to restrict to up-to-date members or to everyone. Version 1.0.2 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/
his issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/galette/galette/security/advisories/GHSA-jrqg-mpwv-pxpv - https://github.com/galette/galette/commit/a5c18bb9819b8da1b3ef58f3e79577083c657fbb
CVE ID: CVE-2024-24762 State: PUBLISHED Published: 2024-02-05T14:33:06.481Z Last Updated: 2025-05-09T16:32:50.015Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Kludex, tiangolo, encode Products: python-multipart, fastapi, starlette Problem Types: CWE-400 Description: `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event lo
he RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p - https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4 - https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389 - https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-
astapi/security/advisories/GHSA-qf9m-vfgh-m389 - https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238 - https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74 - https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5 - https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc - https://github.com/tiangolo/fastapi/releases/tag/0.109.1
CVE ID: CVE-2024-24763 State: PUBLISHED Published: 2024-02-20T17:35:08.825Z Last Updated: 2024-08-01T23:28:11.975Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: jumpserver Products: jumpserver Problem Types: CWE-601 Description: JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
tains a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5 - https://github.com/jumpserver/jumpserver/releases/tag/v3.10.0
CVE ID: CVE-2024-24764 State: PUBLISHED Published: 2024-06-26T00:02:49.362Z Last Updated: 2024-08-01T23:28:12.102Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L) Vendors: octobercms Products: october Problem Types: CWE-601 Description: October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15. Additional Analyst Notes: - CISA AD
the scope of the active host. This vulnerability has been patched in version 3.5.15. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/octobercms/october/security/advisories/GHSA-v2vf-jv88-3fp5
CVE ID: CVE-2024-24765 State: PUBLISHED Published: 2024-03-06T17:31:56.841Z Last Updated: 2024-08-06T14:01:47.283Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IceWhaleTech Products: CasaOS-UserService Problem Types: CWE-200 Description: CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue. Additional Analyst Notes: - CVE Program Contain
possibly obtain system root privileges. Version 0.4.7 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c - https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e - https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
CVE ID: CVE-2024-24766 State: PUBLISHED Published: 2024-03-06T18:10:25.869Z Last Updated: 2024-08-01T23:28:11.932Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IceWhaleTech Products: CasaOS-UserService Problem Types: CWE-204 Description: CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`. If the password is incorrect application give
ername is incorrect application gives the error `**User does not exist**`. If the password is incorrect application gives the error `**Invalid password**`. Version 0.4.7 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c967-2652-gfjm - https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7 - https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
CVE ID: CVE-2024-24767 State: PUBLISHED Published: 2024-03-06T18:06:26.237Z Last Updated: 2024-08-28T17:53:11.773Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: IceWhaleTech Products: CasaOS-UserService Problem Types: CWE-307 Description: CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issu
nerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c69x-5xmw-v44x - https://github.com/IceWhaleTech/CasaOS-UserService/commit/62006f61b55951048dbace4ebd9e483274838699 - https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
CVE ID: CVE-2024-24768 State: PUBLISHED Published: 2024-02-05T15:07:41.738Z Last Updated: 2025-06-17T21:29:25.811Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-315 Description: 1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-9xfw-j
m Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-9xfw-jjq2-7v8h - https://github.com/1Panel-dev/1Panel/pull/3817 - https://github.com/1Panel-dev/1Panel/commit/1169648162c4b9b48e0b4aa508f9dea4d6bc50d5
CVE ID: CVE-2024-24770 State: PUBLISHED Published: 2024-03-14T18:47:46.804Z Last Updated: 2024-08-26T15:21:53.399Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: vantage6 Products: vantage6 Problem Types: CWE-362, CWE-208 Description: vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes `/recover/lost` and `/2fa/lost`. These routes send emails to users if they have lost their password or MFA token. This issue has been addressed in commit `aecfd
outes send emails to users if they have lost their password or MFA token. This issue has been addressed in commit `aecfd6d0e` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vantage6/vantage6/security/advisories/GHSA-5h3x-6gwf-73jm - https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53 - https://github.com/vantage6/vantage6/commit/aecfd6d0e83165a41a60ebd52d2287b0217be26b
CVE ID: CVE-2024-24771 State: PUBLISHED Published: 2024-02-07T14:51:10.303Z Last Updated: 2024-08-01T23:28:12.208Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: open-formulieren Products: open-forms Problem Types: CWE-284, CWE-287, CWE-654 Description: Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromised could potentially have the second-factor authentication bypassed if an attacker somehow managed to authenticate to Open Forms. The maintainers of Open Forms do not believe
ion bypassed if an attacker somehow managed to authenticate to Open Forms. The maintainers of Open Forms do not believe it is or has been possible to perform this login. However, if this were possible, the victim's account may be abused to view (potentially sensitive) submission data or have been used to impersonate other staff accounts to view and/or modify data. Three mitigating factors to help prevent exploitation include: the usual login page (at `/admin/login/`) does not fully log in the user until the second factor was succesfully provided; the additional non-MFA protected login page at `/api/v2/api-authlogin/` was misconfigured and could not be used to log in; and there are no additio
ected login page at `/api/v2/api-authlogin/` was misconfigured and could not be used to log in; and there are no additional ways to log in. This also requires credentials of a superuser to be compromised to be exploitable. Versions 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain the following patches to address these weaknesses: Move and only enable the API auth endpoints (`/api/v2/api-auth/login/`) with `settings.DEBUG = True`. `settings.DEBUG = True` is insecure and should never be applied in production settings. Additionally, apply a custom permission check to the hijack flow to only allow second-factor-verified superusers to perform user hijacking. Additional Analyst Notes: - CISA ADP Vulnrichmen
only allow second-factor-verified superusers to perform user hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/open-formulieren/open-forms/security/advisories/GHSA-64r3-x3gf-vp63 - https://github.com/open-formulieren/open-forms/releases/tag/2.2.9 - https://github.com/open-formulieren/open-forms/releases/tag/2.3.7 - https://github.com/open-formulieren/open-forms/releases/tag/2.4.5 - https://github.com/open-formulieren/open-forms/releases/tag/2.5.2
CVE ID: CVE-2024-24772 State: PUBLISHED Published: 2024-02-28T11:26:45.745Z Last Updated: 2025-02-12T09:27:34.758Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-89 Description: A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://
hich fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/gfl3ckwy6y9tpz9jmpv62orh2q346sn5
CVE ID: CVE-2024-24773 State: PUBLISHED Published: 2024-02-28T11:24:58.179Z Last Updated: 2025-02-13T17:40:22.462Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-863 Description: Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/h66fy6nj41cfx07z
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/h66fy6nj41cfx07zh7l552w6dmtjh501 - http://www.openwall.com/lists/oss-security/2024/02/28/4
CVE ID: CVE-2024-24774 State: PUBLISHED Published: 2024-02-09T14:46:58.777Z Last Updated: 2024-08-21T15:26:06.746Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-24775 State: PUBLISHED Published: 2024-02-14T16:30:23.876Z Last Updated: 2024-08-16T18:09:20.275Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-476 Description: When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000137333
CVE ID: CVE-2024-24776 State: PUBLISHED Published: 2024-02-09T14:50:45.443Z Last Updated: 2024-08-01T23:28:12.437Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-24777 State: PUBLISHED Published: 2024-10-30T13:35:19.175Z Last Updated: 2024-10-30T15:03:06.843Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: LevelOne Products: WBR-6012 Problem Types: CWE-352 Description: A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6. A specially crafted HTTP request can lead to unauthorized access. An attacker can stage a malicious web page to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1981
CVE ID: CVE-2024-24778 State: PUBLISHED Published: 2025-03-03T10:37:04.509Z Last Updated: 2025-03-03T18:03:22.434Z Vendors: Apache Software Foundation Products: Apache StreamPipes Problem Types: CWE-269 Description: Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/j14w6wghlwwrgfgc6hoz9f94fwxtlgzh
CVE ID: CVE-2024-24779 State: PUBLISHED Published: 2024-02-28T11:28:02.395Z Last Updated: 2025-02-13T17:40:23.167Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-863 Description: Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which
pache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/xzhz1m5bb9zxhyqgoy4q2d689b3zp4pq - http://www.openwall.com/lists/oss-security/2024/02/28/6
CVE ID: CVE-2024-24780 State: PUBLISHED Published: 2025-05-14T10:42:20.580Z Last Updated: 2025-05-15T04:01:59.925Z Vendors: Apache Software Foundation Products: Apache IoTDB Problem Types: Remote Code Execution with untrusted URI of User-defined function Description: Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/xp
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmj
CVE ID: CVE-2024-24781 State: PUBLISHED Published: 2024-02-13T13:46:31.571Z Last Updated: 2024-11-07T19:05:15.767Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: HIMA Products: F30 03X YY (COM), F30 03X YY (CPU), F35 03X YY (COM), F35 03X YY (CPU), F60 CPU 03X YY (COM), F60 CPU 03X YY (CPU), F-COM 01, F-COM 01 coated, F-CPU 01, F-CPU 01 coated, X-COM 01 E YY, X-COM 01 YY, X-CPU 01, X-CPU 31, X-SB 01 Problem Types: CWE-400 Description: An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive traffic on a single ethernet port. Additional Analyst Notes: - CVE Program Container: -
ected devices through excessive traffic on a single ethernet port. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-013