Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7989 State: REJECTED Published: N/A Last Updated: 2024-08-26T20:16:07.092Z Description: No description available.
CVE ID: CVE-2024-7990 State: PUBLISHED Published: 2025-03-20T10:08:55.590Z Last Updated: 2025-03-20T19:00:39.768Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the `/api/v1/models/add` endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious scripts that can be executed by any user, including administrators, potentially leading to arbitrary code execution. Additional Ana
t can be executed by any user, including administrators, potentially leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/2256e336-0f67-449e-a82d-7fc57081a21c
CVE ID: CVE-2024-7991 State: PUBLISHED Published: 2024-10-29T21:49:02.128Z Last Updated: 2025-08-26T18:23:54.066Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, DWG TrueView, RealDWG Problem Types: CWE-787 Description: A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in t
malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE ID: CVE-2024-7992 State: PUBLISHED Published: 2024-10-29T21:50:13.232Z Last Updated: 2025-08-26T18:24:31.298Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, DWG TrueView, RealDWG Problem Types: CWE-121 Description: A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force a Stack-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the contex
ous actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE ID: CVE-2024-7993 State: PUBLISHED Published: 2024-10-16T21:47:31.739Z Last Updated: 2025-08-26T18:25:22.824Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit Problem Types: CWE-787 Description: A maliciously crafted PDF file, when parsed through Autodesk Revit, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0018
CVE ID: CVE-2024-7994 State: PUBLISHED Published: 2024-10-16T21:47:51.258Z Last Updated: 2025-01-28T20:10:30.617Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit Problem Types: CWE-121 Description: A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Stack-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://autodesk.com/trust/security-advisories/adsk-sa-2024-0017
CVE ID: CVE-2024-7995 State: PUBLISHED Published: 2024-11-05T20:06:43.521Z Last Updated: 2025-08-26T18:27:06.333Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: VRED Design Problem Types: CWE-426 Description: A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the VRED Design application. Exploitation of this vulnerability may lead to code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0022
CVE ID: CVE-2024-7998 State: PUBLISHED Published: 2024-08-21T05:30:35.851Z Last Updated: 2024-12-03T18:48:03.793Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N) Vendors: Octopus Deploy Products: Octopus Server Problem Types: Incorrect OIDC cookie expiration time Description: In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2024/sa2024-07/
CVE ID: CVE-2024-7999 State: REJECTED Published: 2025-03-20T10:09:30.143Z Last Updated: 2025-04-15T15:50:22.034Z Description: No description available.
CVE ID: CVE-2024-8000 State: PUBLISHED Published: 2025-03-04T20:20:53.517Z Last Updated: 2025-03-04T20:33:37.805Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Arista Networks Products: EOS Problem Types: CWE-1284 Description: On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. Note: supplicants with pending captive-portal authentication during ASU would be impacted with this bug. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
on during ASU would be impacted with this bug. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/21086-security-advisory-0109
CVE ID: CVE-2024-8001 State: PUBLISHED Published: 2024-11-13T09:47:38.973Z Last Updated: 2025-01-09T16:32:53.405Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: VIWIS Products: LMS Problem Types: CWE-862, CWE-863 Description: A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. A user with the role learner can use the administrative print function with an active session before and after an exam slot to access the entire exam including solutions in the web application. It is
active session before and after an exam slot to access the entire exam including solutions in the web application. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284352 - https://vuldb.com/?ctiid.284352 - https://www.scip.ch/?news.20241203
CVE ID: CVE-2024-8002 State: PUBLISHED Published: 2025-01-08T06:50:29.219Z Last Updated: 2025-01-08T14:21:10.658Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: VIWIS Products: LMS Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component File Upload. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 9.12 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
commended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290767 - https://vuldb.com/?ctiid.290767
CVE ID: CVE-2024-8003 State: PUBLISHED Published: 2024-08-20T13:31:05.130Z Last Updated: 2024-08-20T16:13:19.200Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Go-Tribe Products: gotribe-admin Problem Types: CWE-502 Description: A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of the file internal/app/routes/routes.go of the component Log Handler. The manipulation leads to deserialization. The patch is identified as 45ac90d6d1f82716f77dbcdf8e7309c229080e3c. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
c. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275198 - https://vuldb.com/?ctiid.275198 - https://vuldb.com/?submit.393987 - https://github.com/Go-Tribe/gotribe-admin/issues/1 - https://github.com/Go-Tribe/gotribe-admin/issues/1#issuecomment-2298187923 - https://github.com/Go-Tribe/gotribe-admin/commit/45ac90d6d1f82716f77dbcdf8e7309c229080e3c
CVE ID: CVE-2024-8004 State: PUBLISHED Published: 2024-09-02T11:49:05.542Z Last Updated: 2024-09-03T14:47:00.811Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-8005 State: PUBLISHED Published: 2024-08-20T14:00:08.350Z Last Updated: 2024-08-20T16:17:43.495Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: demozx Products: gf_cms Problem Types: CWE-798 Description: A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.2 is able to address this issue. The patch is named be702ada7cb6fdabc02689d90b3813
may be used. Upgrading to version 1.0.2 is able to address this issue. The patch is named be702ada7cb6fdabc02689d90b38139c827458a5. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275199 - https://vuldb.com/?ctiid.275199 - https://vuldb.com/?submit.393981 - https://github.com/demozx/gf_cms/issues/5 - https://github.com/demozx/gf_cms/issues/5#issuecomment-2296590417 - https://github.com/demozx/gf_cms/commit/be702ada7cb6fdabc02689d90b38139c827458a5 - https://github.com/demozx/gf_cms/commit/de51cc57a96ccca905c837ef925c2cc3a5241383
CVE ID: CVE-2024-8006 State: PUBLISHED Published: 2024-08-30T23:53:11.334Z Last Updated: 2024-09-03T19:17:49.301Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: The Tcpdump Group Products: libpcap Problem Types: CWE-476 Description: Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not chec
les. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/the-tcpdump-group/libpcap/commit/0f8a103469ce87d2b8d68c5130a46ddb7fb5eb29 - https://github.com/the-tcpdump-group/libpcap/commit/8a633ee5b9ecd9d38a587ac9b204e2380713b0d6
CVE ID: CVE-2024-8007 State: PUBLISHED Published: 2024-08-21T13:40:25.242Z Last Updated: 2025-11-20T20:57:05.377Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat OpenStack Platform 17.1 for RHEL 8, Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2 Problem Types: CWE-295 Description: A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-mi
sed container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:9990 - https://access.redhat.com/errata/RHSA-2024:9991 - https://access.redhat.com/security/cve/CVE-2024-8007 - https://bugzilla.redhat.com/show_bug.cgi?id=2305975
CVE ID: CVE-2024-8008 State: PUBLISHED Published: 2025-06-02T16:48:12.479Z Last Updated: 2025-10-21T05:53:02.275Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WSO2 Products: WSO2 Enterprise Integrator, WSO2 API Manager, WSO2 Identity Server as Key Manager, WSO2 Identity Server, WSO2 Open Banking IAM, WSO2 Open Banking AM, WSO2 Traffic Manager, WSO2 API Control Plane, WSO2 Universal Gateway, WSO2 Carbon Identity User Store Configuration UI Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection v
ltiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/
ISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/
CVE ID: CVE-2024-8009 State: PUBLISHED Published: 2025-05-15T20:09:47.142Z Last Updated: 2025-11-13T20:58:53.467Z Vendors: Unknown Products: Sensei LMS Problem Types: CWE-863 Incorrect Authorization Description: The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/737bb010-b2fa-4bf4-b124-5fbba67cf935/
CVE ID: CVE-2024-8011 State: PUBLISHED Published: 2024-08-25T11:44:45.839Z Last Updated: 2024-08-26T15:28:33.495Z Vendors: Logitech Products: Options+ Problem Types: CWE-863 Description: Logitech Options+ on MacOS prior 1.72 allows a local attacker to inject dynamic library within Options+ runtime and abuse permissions granted by the user to Options+ such as Camera. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hackerone.com
CVE ID: CVE-2024-8012 State: PUBLISHED Published: 2024-09-10T20:37:19.762Z Last Updated: 2025-06-12T16:56:49.405Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Workspace Control Problem Types: CWE-288 Description: An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-IWC
CVE ID: CVE-2024-8013 State: PUBLISHED Published: 2024-10-28T12:58:05.317Z Last Updated: 2024-10-28T13:39:31.561Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: MongoDB Inc Products: mongocryptd, Mongo_crypt_v1.so Problem Types: CWE-319 Description: A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions
d binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-96254
CVE ID: CVE-2024-8014 State: PUBLISHED Published: 2024-10-09T14:16:33.764Z Last Updated: 2025-11-03T19:34:45.119Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik Reporting Problem Types: CWE-470 Description: In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.telerik.com/reporting/knowledge-base/insecure-type-resolution-cve-2024-8014
CVE ID: CVE-2024-8015 State: PUBLISHED Published: 2024-10-09T14:49:19.603Z Last Updated: 2024-10-09T16:06:49.209Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik Reporting Problem Types: CWE-470 Description: In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/report-server/knowledge-base/insecure-type-resolution-cve-2024-8015
CVE ID: CVE-2024-8016 State: PUBLISHED Published: 2024-08-30T06:52:15.737Z Last Updated: 2024-08-30T14:50:48.923Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: theeventscalendar Products: The Events Calendar Pro Problem Types: CWE-502 Description: The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted input from the 'filters' parameter in widgets. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely. In cer
above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely. In certain configurations, this can be exploitable by lower level users. We confirmed that this plugin installed with Elementor makes it possible for users with contributor-level access and above to exploit this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/34f0e5a6-0bd3-4734-b7e0-27dc825d193f?source=cve - https://theeventscalendar.com/release-notes/events-calendar-pro/events-calendar-pro-7-0-2-1/ - https://theeventscalendar.com/blog/news/important-security-update-for-the-events-calendar-pro/
CVE ID: CVE-2024-8017 State: PUBLISHED Published: 2025-03-20T10:11:31.223Z Last Updated: 2025-03-20T14:19:30.503Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-79 Description: An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin if the victim is an admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.
t to an admin if the victim is an admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ef06c7c8-1cb2-42a7-a6e6-17b2e1c744f7
CVE ID: CVE-2024-8018 State: PUBLISHED Published: 2025-03-20T10:10:31.431Z Last Updated: 2025-10-15T12:49:53.530Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: imartinez Products: imartinez/privategpt Problem Types: CWE-770 Description: A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible. This uncontrolled resource consumption can lead to prolonged unavailability of the service, disrupting operations and causing pot
ntrolled resource consumption can lead to prolonged unavailability of the service, disrupting operations and causing potential data inaccessibility and loss of productivity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0661fa3b-bea4-4156-abed-a65d51958505
CVE ID: CVE-2024-8019 State: PUBLISHED Published: 2025-03-20T10:08:48.918Z Last Updated: 2025-03-20T19:02:39.949Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: lightning-ai Products: lightning-ai/pytorch-lightning Problem Types: CWE-434 Description: In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive loca
lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/2754298b-5af5-48ef-8b38-999093ddf2bd - https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a
CVE ID: CVE-2024-8020 State: PUBLISHED Published: 2025-03-20T10:09:26.822Z Last Updated: 2025-10-15T12:49:53.948Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: lightning-ai Products: lightning-ai/pytorch-lightning Problem Types: CWE-248 Description: A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8b642a78-