Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43741 State: PUBLISHED Published: 2022-04-13T13:16:10 Last Updated: 2024-08-04T04:03:08.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities - https://github.com/iiSiLvEr/CVEs/tree/main/CVE-2021-43741
CVE ID: CVE-2021-43742 State: PUBLISHED Published: 2022-04-13T12:19:20 Last Updated: 2024-08-04T04:03:08.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities - https://github.com/iiSiLvEr/CVEs/tree/main/CVE-2021-43742
CVE ID: CVE-2021-43745 State: PUBLISHED Published: 2022-02-24T21:01:55 Last Updated: 2024-08-04T04:03:08.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service vulnerabilty exists in Trilium Notes 0.48.6 in the setupPage function Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zadam/trilium/issues/2340
CVE ID: CVE-2021-43746 State: PUBLISHED Published: 2021-12-20T20:08:39.214Z Last Updated: 2025-04-23T19:16:40.346Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-824 Description: Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initializ
ious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of memory prior to accessing it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE ID: CVE-2021-43747 State: PUBLISHED Published: 2021-12-20T20:08:31.616Z Last Updated: 2025-04-23T19:17:41.956Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-788 Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush
CVE ID: CVE-2021-43748 State: PUBLISHED Published: 2021-12-20T20:08:33.878Z Last Updated: 2025-04-23T19:17:24.204Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-476 Description: Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
im must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE ID: CVE-2021-43749 State: PUBLISHED Published: 2021-12-20T20:08:35.371Z Last Updated: 2025-04-23T19:17:11.827Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-476 Description: Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
CVE ID: CVE-2021-43750 State: PUBLISHED Published: 2021-12-20T20:08:38.486Z Last Updated: 2025-04-23T19:16:47.162Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Premiere Rush Problem Types: CWE-476 Description: Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
CVE ID: CVE-2021-43751 State: PUBLISHED Published: 2023-09-07T12:54:28.242Z Last Updated: 2025-02-27T21:00:24.468Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Premiere Pro Problem Types: CWE-125 Description: Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
ictim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_pro/apsb21-117.html
CVE ID: CVE-2021-43752 State: PUBLISHED Published: 2022-01-14T19:05:03.772Z Last Updated: 2025-04-23T19:11:25.039Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Illustrator Problem Types: CWE-125 Description: Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
ictim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb22-02.html
CVE ID: CVE-2021-43753 State: PUBLISHED Published: 2023-09-07T12:54:30.742Z Last Updated: 2025-02-27T21:00:10.697Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Lightroom Desktop Problem Types: CWE-416 Description: Adobe Lightroom versions 4.4 (and earlier) are affected by a use-after-free vulnerability in the processing of parsing TIF files that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/lightroom/apsb21-119.html
CVE ID: CVE-2021-43754 State: PUBLISHED Published: 2022-06-15T18:38:08.968Z Last Updated: 2025-04-23T18:14:47.512Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Prelude Problem Types: CWE-787 Description: Adobe Prelude version 22.1.1 (and earlier) is affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/prelude/apsb21-114.html
CVE ID: CVE-2021-43755 State: PUBLISHED Published: 2022-06-15T19:50:32.493Z Last Updated: 2025-04-23T18:12:20.605Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: After Effects Problem Types: CWE-787 Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/securit
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE ID: CVE-2021-43756 State: PUBLISHED Published: 2022-06-15T18:40:29.478Z Last Updated: 2025-04-23T18:14:40.991Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Media Encoder Problem Types: CWE-787 Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html
CVE ID: CVE-2021-43757 State: PUBLISHED Published: 2023-07-12T11:17:45.211Z Last Updated: 2025-03-05T18:53:42.406Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Media Encoder Problem Types: CWE-125 Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious 3GP ​file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
n a malicious 3GP ​file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html
CVE ID: CVE-2021-43758 State: PUBLISHED Published: 2023-07-12T11:17:43.644Z Last Updated: 2025-03-05T18:53:59.844Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Media Encoder Problem Types: CWE-125 Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MP4 file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
a malicious MP4 file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html
CVE ID: CVE-2021-43759 State: PUBLISHED Published: 2023-07-12T11:17:44.428Z Last Updated: 2025-03-05T18:53:52.150Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Media Encoder Problem Types: CWE-125 Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MP4 file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
CVE ID: CVE-2021-43760 State: PUBLISHED Published: 2023-07-12T11:17:42.316Z Last Updated: 2025-03-05T18:54:09.234Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Media Encoder Problem Types: CWE-125 Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MOV file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
a malicious MOV file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html
CVE ID: CVE-2021-43761 State: PUBLISHED Published: 2022-01-13T20:27:20.543662Z Last Updated: 2024-09-17T00:00:45.144Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Experience Manager Problem Types: CWE-79 Description: AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program
a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE ID: CVE-2021-43762 State: PUBLISHED Published: 2022-01-13T20:27:14.547057Z Last Updated: 2024-09-17T03:27:36.327Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Adobe Products: Experience Manager Problem Types: CWE-20 Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE ID: CVE-2021-43763 State: PUBLISHED Published: 2021-12-20T20:08:40.638Z Last Updated: 2025-04-23T19:16:28.680Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Dimension Problem Types: CWE-125 Description: Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.co
F file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb21-116.html - https://www.zerodayinitiative.com/advisories/ZDI-21-1561/
CVE ID: CVE-2021-43764 State: PUBLISHED Published: 2022-01-13T20:27:22.745615Z Last Updated: 2024-09-16T22:36:30.134Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Experience Manager Problem Types: CWE-79 Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe
ge containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE ID: CVE-2021-43765 State: PUBLISHED Published: 2022-01-13T20:27:16.844597Z Last Updated: 2024-09-16T17:04:17.844Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Adobe Products: Experience Manager Problem Types: CWE-79 Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.ado
page containing the vulnerable field. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE ID: CVE-2021-43766 State: PUBLISHED Published: 2022-08-25T17:27:31 Last Updated: 2024-08-04T04:03:08.895Z Vendors: n/a Products: Odyssey Problem Types: CWE-89 Description: Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. This is similar to CVE-2021-23214 for PostgreSQL. Additional Analyst Notes: - CVE Program Container: References: - https://www.postgresql.org/support/security/CVE-2021-23214/ - https://github.com/yandex/odys
am Container: References: - https://www.postgresql.org/support/security/CVE-2021-23214/ - https://github.com/yandex/odyssey/issues/376%2C
CVE ID: CVE-2021-43767 State: PUBLISHED Published: 2022-08-25T17:27:39 Last Updated: 2024-08-04T04:03:08.608Z Vendors: n/a Products: Odyssey Problem Types: CWE-522 Description: Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL. Additional
results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL. Additional Analyst Notes: - CVE Program Container: References: - https://www.postgresql.org/support/security/CVE-2021-23222/ - https://github.com/yandex/odyssey/issues/377%2C
CVE ID: CVE-2021-43768 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:28:31.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Malwarebytes For Teams v.1.0.990 and before and fixed in v.1.0.1003 and later a privilege escalation can occur via the COM interface running in mbamservice.exe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/895316 - https://www.malwarebytes.com/secure/cves/cve-2021-43768
CVE ID: CVE-2021-43771 State: PUBLISHED Published: 2021-11-30T11:18:43 Last Updated: 2024-08-04T04:03:08.683Z Vendors: Trend Micro Products: Trend Micro Antivirus for MAC 2021 Problem Types: Improper Access Control Privilege Escalation Description: Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could allow an attacker to establish a connection that could lead to full local privilege escalation within the application. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program C
w-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-10832 - https://www.zerodayinitiative.com/advisories/ZDI-21-1320/
CVE ID: CVE-2021-43772 State: PUBLISHED Published: 2021-12-03T10:50:09 Last Updated: 2024-08-04T04:03:08.811Z Vendors: Trend Micro Products: Trend Micro Security 2021 (Consumer) Problem Types: Protected Folder Bypass Description: Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be modified without any detection. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-10855
CVE ID: CVE-2021-43774 State: PUBLISHED Published: 2022-03-03T14:32:36 Last Updated: 2024-08-04T04:03:08.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a printer (e.g., by using the default credentials) can download the address book file, which contains the list of users (domain users, FTP users, etc.) stored on the printer, together with their encrypted passwords. The passwords are protected by a weak cipher, such as ROT13, which requires minimal effort to instantly retrieve the original password, giving the attacker a l
ipher, such as ROT13, which requires minimal effort to instantly retrieve the original password, giving the attacker a list of valid domain or FTP usernames and passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.foregenix.com/blog - https://www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_addressbook_announce.html - https://www.foregenix.com/blogs-new-2021/dude-its-just-a-printer
CVE ID: CVE-2021-43775 State: PUBLISHED Published: 2021-11-23T19:15:13 Last Updated: 2024-08-04T04:03:08.638Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: aimhubio Products: aim Problem Types: CWE-22 Description: Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The
and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc - https://github.com/aimhubio/aim/issues/999 - https://github.com/aimhubio/aim/pull/1003 - https://github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738 - https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16