Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5693 State: PUBLISHED Published: 2024-06-11T12:40:13.675Z Last Updated: 2024-08-01T21:18:06.938Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Cross-Origin Image leak via Offscreen Canvas Description: Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1891319 - https://lists.debian.org/debian-lts-announce/2024/06/msg000
es: - https://bugzilla.mozilla.org/show_bug.cgi?id=1891319 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html - https://www.mozilla.org/security/advisories/mfsa2024-25/ - https://www.mozilla.org/security/advisories/mfsa2024-26/ - https://www.mozilla.org/security/advisories/mfsa2024-28/
CVE ID: CVE-2024-5694 State: PUBLISHED Published: 2024-06-11T12:40:17.378Z Last Updated: 2025-03-14T16:18:58.803Z Vendors: Mozilla Products: Firefox Problem Types: Use-after-free in JavaScript Strings Description: An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vulnerability affects Firefox < 127. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1895055 - https://www.mozilla.org/security/advisories/mfsa2024-25/
CVE ID: CVE-2024-5695 State: PUBLISHED Published: 2024-06-11T12:40:17.619Z Last Updated: 2024-10-30T18:55:15.731Z Vendors: Mozilla Products: Firefox Problem Types: Memory Corruption using allocation using out-of-memory conditions Description: If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in rarer situations, memory corruption could have occurred. This vulnerability affects Firefox < 127. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1895579 - https://www.mozilla.org/security/advisories/mfsa2024-25/
CVE ID: CVE-2024-5696 State: PUBLISHED Published: 2024-06-11T12:40:13.963Z Last Updated: 2024-08-01T21:18:07.014Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory Corruption in Text Fragments Description: By manipulating the text in an `&lt;input&gt;` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1896555 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html - https://lists.de
illa.org/show_bug.cgi?id=1896555 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html - https://www.mozilla.org/security/advisories/mfsa2024-25/ - https://www.mozilla.org/security/advisories/mfsa2024-26/ - https://www.mozilla.org/security/advisories/mfsa2024-28/
CVE ID: CVE-2024-5697 State: PUBLISHED Published: 2024-06-11T12:40:17.858Z Last Updated: 2025-03-13T14:15:42.246Z Vendors: Mozilla Products: Firefox Problem Types: Website was able to detect when Firefox was taking a screenshot of them Description: A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. This vulnerability affects Firefox < 127. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1414937 - https://www.mozilla.org/security/advisories/mfsa2024-25/
CVE ID: CVE-2024-5698 State: PUBLISHED Published: 2024-06-11T12:40:18.183Z Last Updated: 2025-03-14T01:00:49.644Z Vendors: Mozilla Products: Firefox Problem Types: Data-list could have overlaid address bar Description: By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 127. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1828259 - https://www.mozilla.org/security/advisories/mfsa2024-25/
CVE ID: CVE-2024-5699 State: PUBLISHED Published: 2024-06-11T12:40:18.427Z Last Updated: 2024-08-12T17:08:34.616Z Vendors: Mozilla Products: Firefox Problem Types: Cookie prefixes not treated as case-sensitive Description: In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This vulnerability affects Firefox < 127. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1891349 - http
ISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1891349 - https://www.mozilla.org/security/advisories/mfsa2024-25/
CVE ID: CVE-2024-5700 State: PUBLISHED Published: 2024-06-11T12:40:14.287Z Last Updated: 2024-08-01T21:18:07.031Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12 Description: Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Re
x ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1862809%2C1889355%2C1893388%2C1895123 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html - https://www.mozilla.org/security/advisories/mfsa2024-25/ - https://www.mozilla.org/security/advisories/mfsa2024-26/ - https://www.mozilla.org/security/advisories/mfsa2024-28/
CVE ID: CVE-2024-5701 State: PUBLISHED Published: 2024-06-11T12:40:18.692Z Last Updated: 2024-08-12T16:49:31.557Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 127 Description: Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1890909%2C1891422%2C1893915%2C1894047%2C1896024 - https://www.mozilla.org/security/advisories/mfsa2024
uglist.cgi?bug_id=1890909%2C1891422%2C1893915%2C1894047%2C1896024 - https://www.mozilla.org/security/advisories/mfsa2024-25/
CVE ID: CVE-2024-5702 State: PUBLISHED Published: 2024-06-11T12:40:12.176Z Last Updated: 2024-08-12T17:00:57.597Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free in networking Description: Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1193389 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html - ht
.org/debian-lts-announce/2024/06/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html - https://www.mozilla.org/security/advisories/mfsa2024-18/ - https://www.mozilla.org/security/advisories/mfsa2024-26/ - https://www.mozilla.org/security/advisories/mfsa2024-28/
CVE ID: CVE-2024-5703 State: PUBLISHED Published: 2024-07-17T07:32:18.614Z Last Updated: 2024-08-01T21:18:07.029Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: icegram Products: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce Problem Types: CWE-862 Missing Authorization Description: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized API access due to a missing capability check in all versions up to, and including, 5.7.26. This makes it possible for authenticated attackers, with Subscribe
y check in all versions up to, and including, 5.7.26. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access the API (provided it is enabled) and add, edit, and delete audience users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22283650-36bf-43e5-a57e-a91025fb2af7?source=cve - https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/admin/class-es-rest-api-admin.php#L25 - https://plugins.trac.wordpress.org/changeset/3118326/email-subscribers/trunk/lite/admin/class-es-rest-api-admin.php
CVE ID: CVE-2024-5704 State: PUBLISHED Published: 2024-07-09T08:33:03.181Z Last Updated: 2024-08-01T21:18:06.932Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: optemiz Products: XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] Problem Types: CWE-862 Missing Authorization Description: The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new and update
1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new and update existing FAQs, FAQ lists, and modify FAQ associations with products. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3e476d-0885-4e8c-a682-bd64d9f13b53?source=cve - https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L100 - https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L216 - https://plugins.trac.wordpress.org/browser/faq-for-woocomm
unk/includes/admin/faq-woocommerce-admin-functions.php#L216 - https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L269 - https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L326 - https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L385
CVE ID: CVE-2024-5705 State: PUBLISHED Published: 2025-02-19T22:55:08.706Z Last Updated: 2025-02-20T20:55:44.629Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics, Pentaho Business Analytics Server Problem Types: CWE-863 Description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. (CWE-863) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, have modules enabled by default that all
usiness Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, have modules enabled by default that allow execution of system level processes. When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34296615099405--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Authorization-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-5705
CVE ID: CVE-2024-5706 State: PUBLISHED Published: 2025-02-19T22:49:46.583Z Last Updated: 2025-02-20T21:33:54.478Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics, Pentaho Business Analytics Server Problem Types: CWE-99 Description: The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not restrict JNDI identifiers during
a Integration & Analytics versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not restrict JNDI identifiers during the creation of Community Dashboards, allowing control of system-level data sources. An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34296195570189--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Improper-Control-of-Resource-Iden
s/articles/34296195570189--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Improper-Control-of-Resource-Identifiers-Resource-Injection-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-5706
CVE ID: CVE-2024-5708 State: PUBLISHED Published: 2024-08-06T05:31:58.857Z Last Updated: 2024-08-06T13:29:11.005Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpbakery Products: WPBakery Visual Composer Problem Types: CWE-79 Description: The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute w
ove, and with post permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23ff12f0-eb9d-4bb3-8db0-0e794c0f0594?source=cve - https://wpbakery.com/
CVE ID: CVE-2024-5709 State: PUBLISHED Published: 2024-08-06T05:31:59.492Z Last Updated: 2024-08-06T13:32:26.259Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpbakery Products: WPBakery Visual Composer Problem Types: CWE-22 Description: The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layout_name' parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be
o include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7fad30c8-fd8a-4cf2-a3aa-16a374231b87?source=cve - https://wpbakery.com/
CVE ID: CVE-2024-5710 State: PUBLISHED Published: 2024-06-27T18:41:19.900Z Last Updated: 2025-10-15T12:49:43.063Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: berriai Products: berriai/litellm Problem Types: CWE-862 Description: berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enablin
any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/70897f59-a966-4d93-b71e-745e3da91970
CVE ID: CVE-2024-5711 State: PUBLISHED Published: 2024-07-08T00:00:13.917Z Last Updated: 2024-08-01T21:18:06.848Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: stitionai Products: stitionai/devika Problem Types: CWE-79 Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat input. This vulnerability is due to the lack of input validation and sanitization on both the frontend and backend components of the application. Specifically, the application fails to sanitize user input in the chat feature, leading to the execution of arbitrary JavaScript co
y, the application fails to sanitize user input in the chat feature, leading to the execution of arbitrary JavaScript code in the context of the user's browser session. This issue affects all versions of the application. The impact of this vulnerability includes the potential for stolen credentials, extraction of sensitive information from chat logs, projects, and other data accessible through the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/6c00ff84-574b-4b4f-bd58-aa7ec1809662 - https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2
CVE ID: CVE-2024-5712 State: PUBLISHED Published: 2024-06-28T19:19:23.739Z Last Updated: 2024-08-01T21:18:06.901Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: stitionai Products: stitionai/devika Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows attackers to perform unauthorized actions in the context of a victim's browser, such as deleting projects or changing application settings, without any CSRF protection implemented. Successful exploitation disrupts the integrity and availability of the application and its dat
F protection implemented. Successful exploitation disrupts the integrity and availability of the application and its data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/301aeafb-af28-4b0b-a2cf-9a2ff1da1ef4
CVE ID: CVE-2024-5713 State: PUBLISHED Published: 2024-07-13T06:00:12.794Z Last Updated: 2024-08-01T21:18:07.087Z Vendors: Unknown Products: If-So Dynamic Content Personalization Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/eb3f24a7-3171-42c3-9016-e29da4f384fa/
CVE ID: CVE-2024-5714 State: PUBLISHED Published: 2024-06-27T18:42:29.236Z Last Updated: 2025-10-15T12:49:43.690Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers in requests, enabling them to invite users to projects in other organizations, change members to projects in other organizations with escalated privileges, and change members from other organizations to their own or other projects, also with escalated privileges. This vulner
and change members from other organizations to their own or other projects, also with escalated privileges. This vulnerability is due to the backend's failure to validate project identifiers against the current user's organization ID and projects belonging to it, as well as a misconfiguration in attribute naming (`org_id` should be `orgId`) that prevents proper user organization validation. As a result, attackers can cause inconsistencies on the platform for affected users and organizations, including unauthorized privilege escalation. The issue is present in the backend API endpoints for user invitation and modification, specifically in the handling of project IDs in requests. Additional A
PI endpoints for user invitation and modification, specifically in the handling of project IDs in requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/8cff4afa-131b-4a7e-9f0d-8a3c69f3d024 - https://github.com/lunary-ai/lunary/commit/43206bacac3b43ad9f2db6dafd165e61a21e6b97
CVE ID: CVE-2024-5715 State: PUBLISHED Published: 2024-07-13T06:00:12.983Z Last Updated: 2024-08-01T21:18:06.857Z Vendors: Unknown Products: wp-eMember Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/d86bc001-51ae-4dcc-869b-80c91251cc2e/
CVE ID: CVE-2024-5716 State: PUBLISHED Published: 2024-11-22T20:05:28.736Z Last Updated: 2024-11-26T15:57:54.521Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-307 Description: Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password reset mechanism. The issue results from the lack of restriction of excessive authentication attempts. An attacker can leve