Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3736 State: PUBLISHED Published: 2024-04-13T14:00:06.364Z Last Updated: 2024-08-01T20:20:01.106Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: cym1102 Products: nginxWebUI Problem Types: CWE-434 Description: A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /adminPage/main/upload. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260575. Additional Analyst Notes: - CISA ADP Vulnr
d may be used. The associated identifier of this vulnerability is VDB-260575. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260575 - https://vuldb.com/?ctiid.260575 - https://github.com/cym1102/nginxWebUI/issues/138 - https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf
CVE ID: CVE-2024-3737 State: PUBLISHED Published: 2024-04-13T16:31:05.372Z Last Updated: 2024-08-01T20:20:01.222Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: cym1102 Products: nginxWebUI Problem Types: CWE-22 Description: A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been rated as critical. Affected by this issue is the function findCountByQuery of the file /adminPage/www/addOver. The manipulation of the argument dir leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260576. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
ed. The identifier of this vulnerability is VDB-260576. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260576 - https://vuldb.com/?ctiid.260576 - https://github.com/cym1102/nginxWebUI/issues/138 - https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf
CVE ID: CVE-2024-3738 State: PUBLISHED Published: 2024-04-13T17:31:04.866Z Last Updated: 2024-09-03T17:59:26.886Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: cym1102 Products: nginxWebUI Problem Types: CWE-295 Description: A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program
and may be used. The identifier VDB-260577 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.260577 - https://vuldb.com/?ctiid.260577 - https://github.com/cym1102/nginxWebUI/issues/138 - https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf
CVE ID: CVE-2024-3739 State: PUBLISHED Published: 2024-04-13T18:31:05.295Z Last Updated: 2024-08-01T20:20:01.086Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: cym1102 Products: nginxWebUI Problem Types: CWE-78 Description: A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260578 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
s the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260578 - https://vuldb.com/?ctiid.260578 - https://github.com/cym1102/nginxWebUI/issues/138 - https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf
CVE ID: CVE-2024-3740 State: PUBLISHED Published: 2024-04-13T20:31:05.513Z Last Updated: 2024-08-12T13:11:49.334Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: cym1102 Products: nginxWebUI Problem Types: CWE-502 Description: A vulnerability, which was classified as critical, has been found in cym1102 nginxWebUI up to 3.9.9. This issue affects the function exec of the file /adminPage/conf/reload. The manipulation of the argument nginxExe leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260579. Additional Analyst Notes: - CVE Program Container: - CI
. The associated identifier of this vulnerability is VDB-260579. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.260579 - https://vuldb.com/?ctiid.260579 - https://vuldb.com/?submit.311216 - https://github.com/cym1102/nginxWebUI/issues/138 - https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf
CVE ID: CVE-2024-3741 State: PUBLISHED Published: 2024-04-18T22:04:46.300Z Last Updated: 2024-08-01T20:20:01.174Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Electrolink Products: Compact DAB Transmitter, Medium DAB Transmitter, High Power DAB Transmitter, Compact FM Transmitter, Modular FM Transmitter, Digital FM Transmitter, VHF TV Transmitter, UHF TV Transmitter Problem Types: CWE-302 Description: Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except 'NO' to the login cookie and have full system access. Additional Analyst Notes: - CISA ADP Vulnrichment:
ry value except 'NO' to the login cookie and have full system access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02
CVE ID: CVE-2024-3742 State: PUBLISHED Published: 2024-04-18T22:15:35.521Z Last Updated: 2024-08-01T20:20:00.923Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Electrolink Products: Compact DAB Transmitter, Medium DAB Transmitter, High Power DAB Transmitter, Compact FM Transmitter, Modular FM Transmitter, Digital FM Transmitter, VHF TV Transmitter, UHF TV Transmitter Problem Types: CWE-312 Description: Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advi
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02
CVE ID: CVE-2024-3743 State: PUBLISHED Published: 2024-05-02T16:52:50.968Z Last Updated: 2024-08-01T20:20:01.037Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group, Shape Separator, Content Switcher, Info Circle and Timeline widgets in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated
d including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f36fea15-0475-45ee-b913-790db6373aef?source=cve - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/bg-slider/module.php#L269 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/shape-s
le.php#L269 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/shape-separator/shapes/triangle-bottom-right.php#L1 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/content-switcher/skins/skin-3.php#L43 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/info-circle/skins/skin-base.php#L154 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/timeline/skins/skin-base.php#L1363 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078419%40addon-elements-for-elementor-
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078419%40addon-elements-for-elementor-page-builder%2Ftrunk&old=3077362%40addon-elements-for-elementor-page-builder%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3744 State: PUBLISHED Published: 2024-05-15T00:42:36.881Z Last Updated: 2025-02-13T17:52:59.394Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Kubernetes Products: azure-file-csi-driver Problem Types: CWE-532 Description: A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag. Ad
equests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ - https://github.com/kubernetes/kubernetes/issues/124759 - http://www.openwall.com/lists/oss-security/2024/05/09/4
CVE ID: CVE-2024-3745 State: PUBLISHED Published: 2024-05-18T12:34:46.896Z Last Updated: 2024-08-01T20:20:01.089Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MSI Products: MSI Afterburner Problem Types: CWE-863 Description: MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fluidattacks.com/advisories/gershwin/ - https://forums.guru3d.com/threads/msi-ab-rtss-development-news-thread.412822/page-227#
ttacks.com/advisories/gershwin/ - https://forums.guru3d.com/threads/msi-ab-rtss-development-news-thread.412822/page-227#post-6231456 - https://forums.guru3d.com/threads/msi-ab-rtss-development-news-thread.412822/page-227#post-6231768
CVE ID: CVE-2024-3746 State: PUBLISHED Published: 2024-04-30T19:45:21.951Z Last Updated: 2025-08-27T21:23:00.955Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Measuresoft Products: ScadaPro Problem Types: CWE-284 Description: The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write or overwrite files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-01
CVE ID: CVE-2024-3747 State: PUBLISHED Published: 2024-05-02T16:52:47.323Z Last Updated: 2024-08-12T20:10:05.013Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: creativethemeshq Products: Blocksy Problem Types: CWE-20 Improper Input Validation Description: The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and including, 2.0.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f71928-3f1d-4c15-8655-41cdfb707370?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=224954%40blocksy%2F2.0.40&old=224210%40blocksy%2F2.0.39
CVE ID: CVE-2024-3748 State: PUBLISHED Published: 2024-05-15T06:00:04.491Z Last Updated: 2024-08-01T20:20:01.097Z Vendors: Unknown Products: SP Project & Document Manager Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/01427cfb-5c51-4524-9b9d-e09a603bc34c/
CVE ID: CVE-2024-3749 State: PUBLISHED Published: 2024-05-15T06:00:04.713Z Last Updated: 2024-08-01T20:20:01.139Z Vendors: Unknown Products: SP Project & Document Manager Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/d14bb16e-ce1d-4c31-8791-bc63174897c0/
CVE ID: CVE-2024-3750 State: PUBLISHED Published: 2024-05-16T02:36:48.950Z Last Updated: 2024-08-01T20:20:01.020Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themeisle Products: Visualizer: Tables and Charts Manager for WordPress Problem Types: CWE-862 Missing Authorization Description: The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData() function in all versions up to, and including, 3.10.15. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform arbitrary SQL queri
is makes it possible for authenticated attackers, with subscriber-level access and above, to perform arbitrary SQL queries that can be leveraged for privilege escalation among many other actions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d27544c-97a5-42cd-ab07-358f819acbc4?source=cve - https://plugins.trac.wordpress.org/browser/visualizer/trunk/classes/Visualizer/Module/Chart.php#L1421 - https://plugins.trac.wordpress.org/changeset/3086048/visualizer/tags/3.11.0/classes/Visualizer/Source/Query.php - https://plugins.trac.wordpress.org/changeset/3086048/visualizer/tags/3.11.0/classes/Visu
s/Visualizer/Source/Query.php - https://plugins.trac.wordpress.org/changeset/3086048/visualizer/tags/3.11.0/classes/Visualizer/Module/Chart.php
CVE ID: CVE-2024-3751 State: PUBLISHED Published: 2024-07-13T06:00:04.549Z Last Updated: 2024-08-01T20:20:01.023Z Vendors: Unknown Products: Seriously Simple Podcasting Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1c684b05-2545-4fa5-ba9e-91d8b8f725ac/
CVE ID: CVE-2024-3752 State: PUBLISHED Published: 2024-05-06T06:00:01.533Z Last Updated: 2024-10-30T15:46:37.120Z Vendors: Unknown Products: Crelly Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/e738540a-2006-4b92-8db1-2476374d35bd/
CVE ID: CVE-2024-3753 State: PUBLISHED Published: 2024-07-13T06:00:04.802Z Last Updated: 2024-08-01T20:20:01.144Z Vendors: Unknown Products: Hostel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/e140e109-4176-4b26-bf63-198262a31409/
CVE ID: CVE-2024-3754 State: PUBLISHED Published: 2024-06-14T06:00:02.574Z Last Updated: 2024-11-08T16:47:13.403Z Vendors: Unknown Products: Alemha watermarker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Alemha watermarker WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/8c6f3e3e-3047-4446-a190-750a60c29fa3/
CVE ID: CVE-2024-3755 State: PUBLISHED Published: 2024-05-06T06:00:01.752Z Last Updated: 2024-11-21T17:05:56.034Z Vendors: Unknown Products: MF Gig Calendar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/d34caeaf-2ecf-44a2-b308-e940bafd402c/
CVE ID: CVE-2024-3756 State: PUBLISHED Published: 2024-05-06T06:00:02.125Z Last Updated: 2024-08-01T20:20:00.980Z Vendors: Unknown Products: MF Gig Calendar Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/
CVE ID: CVE-2024-3757 State: PUBLISHED Published: 2024-05-07T06:27:07.124Z Last Updated: 2024-08-01T20:20:01.126Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-190 Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through integer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md
CVE ID: CVE-2024-3758 State: PUBLISHED Published: 2024-05-07T06:27:11.250Z Last Updated: 2024-08-01T20:20:01.287Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-122 Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through heap buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md
CVE ID: CVE-2024-3759 State: PUBLISHED Published: 2024-05-07T06:27:19.917Z Last Updated: 2024-08-01T20:20:01.133Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md
CVE ID: CVE-2024-3760 State: PUBLISHED Published: 2024-11-14T18:26:21.685Z Last Updated: 2024-11-18T20:42:08.530Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-770 Description: In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can exploit this by automating forgot password requests to flood targeted user accounts with a high volume of password reset emails. This not only overwhelms the victim's mailbox, making it difficult to manage and locate legitimate emails, but also significantly impacts mail servers
ictim's mailbox, making it difficult to manage and locate legitimate emails, but also significantly impacts mail servers by consuming their resources. The increased load can cause performance degradation and, in severe cases, make the mail servers unresponsive or unavailable, disrupting email services for the entire organization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c29e9f36-8261-463d-8862-7f4fdcc8eddc - https://github.com/lunary-ai/lunary/commit/29374bb10020712009c1ec238affe098112a51d6
CVE ID: CVE-2024-3761 State: PUBLISHED Published: 2024-05-20T08:38:06.967Z Last Updated: 2024-08-01T20:20:01.294Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-862 Description: In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at `packages/backend/src/api/v1/datasets` is vulnerable to unauthorized dataset deletion due to missing authorization and authentication mechanisms. This vulnerability allows any user, even those without a valid token, to delete a dataset by sending a DELETE request to the endpoint. The issue was fixed in version 1.2.8. The impact of this vulnerability is signific
ing a DELETE request to the endpoint. The issue was fixed in version 1.2.8. The impact of this vulnerability is significant as it permits unauthorized users to delete datasets, potentially leading to data loss or disruption of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/e95fb0a0-e54a-4da8-a33d-ba858d0cec55 - https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776