Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-50319 State: PUBLISHED Published: 2024-11-12T15:32:20.257Z Last Updated: 2024-11-13T15:43:27.844Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-835 Description: An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release
CVE ID: CVE-2024-50320 State: PUBLISHED Published: 2024-11-12T15:32:52.112Z Last Updated: 2024-11-12T18:57:00.316Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-835 Description: An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release
CVE ID: CVE-2024-50321 State: PUBLISHED Published: 2024-11-12T15:33:32.796Z Last Updated: 2024-11-12T18:49:52.819Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-835 Description: An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release
CVE ID: CVE-2024-50322 State: PUBLISHED Published: 2024-11-12T15:36:09.760Z Last Updated: 2024-11-19T04:55:49.893Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-22 Description: Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-50323 State: PUBLISHED Published: 2024-11-12T15:37:08.015Z Last Updated: 2024-11-19T04:56:06.281Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-89 Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-50324 State: PUBLISHED Published: 2024-11-12T15:37:52.162Z Last Updated: 2024-11-19T04:56:07.498Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-22 Description: Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-50326 State: PUBLISHED Published: 2024-11-12T15:40:06.902Z Last Updated: 2024-11-19T04:56:00.999Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-89 Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-50327 State: PUBLISHED Published: 2024-11-12T15:40:38.609Z Last Updated: 2024-11-19T04:55:54.842Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-89 Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-50328 State: PUBLISHED Published: 2024-11-12T15:41:17.871Z Last Updated: 2024-11-19T04:55:58.542Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-89 Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-50329 State: PUBLISHED Published: 2024-11-12T15:41:54.415Z Last Updated: 2024-11-19T04:56:08.860Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-22 Description: Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-50330 State: PUBLISHED Published: 2024-11-12T15:42:20.786Z Last Updated: 2024-11-19T04:56:10.026Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-89 Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-50331 State: PUBLISHED Published: 2024-11-12T15:34:00.342Z Last Updated: 2024-11-12T18:48:08.968Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-125 Description: An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information in memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release
CVE ID: CVE-2024-50332 State: PUBLISHED Published: 2024-11-05T18:40:14.977Z Last Updated: 2024-11-05T18:58:13.409Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL injection in DeleteRelationShip. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/salesagility/Suit
his vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-53xh-mjmq-j35p
CVE ID: CVE-2024-50333 State: PUBLISHED Published: 2024-11-05T18:41:24.241Z Last Updated: 2024-11-05T18:57:18.443Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-20 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels() function can be used to write attacker-controlled data into the custom language file that will be included at the runtime. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workaro
me. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-qrv6-3q86-qv89
CVE ID: CVE-2024-50334 State: PUBLISHED Published: 2024-10-29T14:36:13.466Z Last Updated: 2024-10-29T14:53:25.455Z Vendors: Erudika Products: scoold Problem Types: CWE-288 Description: Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type: application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive informati
nauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Erudika/scoold/security/advisories/GHSA-fhwp-f6g7-rr3p
CVE ID: CVE-2024-50335 State: PUBLISHED Published: 2024-11-05T18:42:14.203Z Last Updated: 2024-11-05T18:56:13.460Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-79 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious JavaScript code. This can be exploited to steal CSRF tokens and perform unauthorized actions, such as creating new administrative users without proper authentication. The vulnera
s and perform unauthorized actions, such as creating new administrative users without proper authentication. The vulnerability arises due to insufficient input validation and sanitization of the Publish Key field within the SuiteCRM application. When an attacker injects a malicious script, it gets executed within the context of an authenticated user's session. The injected script (o.js) then leverages the captured CSRF token to forge requests that create new administrative users, effectively compromising the integrity and security of the CRM instance. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerabilit
dressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-8rw6-g96j-3w7m
CVE ID: CVE-2024-50336 State: PUBLISHED Published: 2024-11-12T16:38:53.164Z Last Updated: 2025-11-03T22:28:21.121Z Vendors: matrix-org Products: matrix-js-sdk Problem Types: CWE-22 Description: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/matrix-org/matrix-js-sdk/security/advisories/G
P Vulnrichment: - CVE Program Container: References: - https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr - https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5
CVE ID: CVE-2024-50338 State: PUBLISHED Published: 2025-01-14T18:11:23.188Z Last Updated: 2025-01-14T18:35:33.115Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: git-ecosystem Products: git-credential-manager Problem Types: CWE-200 Description: Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format `key=value`. Git's documentation restricts the use of the NUL (`\0`) character and newlines to form part of the keys or values. When Git reads from standard input, it c
se of the NUL (`\0`) character and newlines to form part of the keys or values. When Git reads from standard input, it considers both LF and CRLF as newline characters for the credential protocol by virtue of calling `strbuf_getline` that calls to `strbuf_getdelim_strip_crlf`. Git also validates that a newline is not present in the value by checking for the presence of the line-feed character (LF, `\n`), and errors if this is the case. This captures both LF and CRLF-type newlines. Git Credential Manager uses the .NET standard library `StreamReader` class to read the standard input stream line-by-line and parse the `key=value` credential protocol format. The implementation of the `ReadLineAsy
d input stream line-by-line and parse the `key=value` credential protocol format. The implementation of the `ReadLineAsync` method considers LF, CRLF, and CR as valid line endings. This is means that .NET considers a single CR as a valid newline character, whereas Git does not. This mismatch of newline treatment between Git and GCM means that an attacker can craft a malicious remote URL. When a user clones or otherwise interacts with a malicious repository that requires authentication, the attacker can capture credentials for another Git remote. The attack is also heightened when cloning from repositories with submodules when using the `--recursive` clone option as the user is not able to in
d when cloning from repositories with submodules when using the `--recursive` clone option as the user is not able to inspect the submodule remote URLs beforehand. This issue has been patched in version 2.6.1 and all users are advised to upgrade. Users unable to upgrade should only interact with trusted remote repositories, and not clone with `--recursive` to allow inspection of any submodule URLs before cloning those submodules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g - https://git-scm.com/docs/git-credential#IOFMT - https://github.com/dotnet/runtime/blob/e476b43b5cb42eb4
86c2-4x57-wc8g - https://git-scm.com/docs/git-credential#IOFMT - https://github.com/dotnet/runtime/blob/e476b43b5cb42eb44ce23b1c7b793aa361624cf6/src/libraries/System.Private.CoreLib/src/System/IO/StreamReader.cs#L926 - https://github.com/git-ecosystem/git-credential-manager/blob/ae009e11a0fbef804ad9f78816d84a0bc7e052fe/src/shared/Core/StreamExtensions.cs#L138-L141 - https://github.com/git-ecosystem/git-credential-manager/compare/749e287571c78a2b61f926ccce6a707050871ab8...99e2f7f60e7364fe807e7925f361a81f3c47bd1b - https://github.com/git-ecosystem/git-credential-manager/releases/tag/v2.6.1 - https://github.com/git/git/blob/6a11438f43469f3815f2f0fc997bd45792ff04c0/credential.c#L311 - https://le
ses/tag/v2.6.1 - https://github.com/git/git/blob/6a11438f43469f3815f2f0fc997bd45792ff04c0/credential.c#L311 - https://learn.microsoft.com/en-us/dotnet/api/system.io.streamreader?view=net-8.0
CVE ID: CVE-2024-50339 State: PUBLISHED Published: 2024-12-11T17:48:42.230Z Last Updated: 2024-12-11T18:31:59.719Z Vendors: glpi-project Products: glpi Problem Types: CWE-79, CWE-287 Description: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-v977-g4r9-6r72 - https://github.com/glpi-project/glpi/releases/tag/10.0.17
CVE ID: CVE-2024-50340 State: PUBLISHED Published: 2024-11-06T21:09:46.750Z Last Updated: 2024-11-07T15:29:50.292Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: symfony Products: symfony Problem Types: CWE-74 Description: symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAP
ing the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j - https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa
CVE ID: CVE-2024-50341 State: PUBLISHED Published: 2024-11-06T21:06:49.426Z Last Updated: 2024-11-07T15:27:06.600Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: symfony Products: symfony Problem Types: CWE-287 Description: symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All use
versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/symfony/symfony/security/advisories/GHSA-jxgr-3v7q-3w9v - https://github.com/symfony/symfony/commit/22a0789a0085c3ee96f4ef715ecad8255cf0e105
CVE ID: CVE-2024-50342 State: PUBLISHED Published: 2024-11-06T21:03:12.331Z Last Updated: 2024-11-07T15:26:33.540Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: symfony Products: symfony Problem Types: CWE-200 Description: symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All us
5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxm - https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b
CVE ID: CVE-2024-50343 State: PUBLISHED Published: 2024-11-06T21:00:55.266Z Last Updated: 2025-11-03T19:31:45.637Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: symfony Products: symfony Problem Types: CWE-20 Description: symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional An
tch the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/symfony/symfony/security/advisories/GHSA-g3rh-rrhp-jhh9 - https://github.com/symfony/symfony/commit/7d1032bbead9a4229b32fa6ebca32681c80cb76f
CVE ID: CVE-2024-50344 State: PUBLISHED Published: 2024-10-30T15:51:30.047Z Last Updated: 2024-10-30T16:02:30.738Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: mkucej Products: i-librarian-free Problem Types: CWE-80 Description: I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will th
exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mkucej/i-librarian-free/security/advisories/GHSA-c2rm-w62w-5xmj - https://github.com/mkucej/i-librarian-free/commit/a67d7949ffb02fd912ebdcf552df006b44066d78
CVE ID: CVE-2024-50345 State: PUBLISHED Published: 2024-11-06T20:56:21.062Z Last Updated: 2025-11-03T19:31:47.017Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: symfony Products: symfony Problem Types: CWE-601 Description: symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https:
nother domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp - https://url.spec.whatwg.org