Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-39308 State: PUBLISHED Published: 2024-07-08T14:33:55.144Z Last Updated: 2024-08-02T04:19:20.581Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: railsadminteam Products: rails_admin Problem Types: CWE-79 Description: RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc - https://github.com/railsadminteam/r
ps://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc - https://github.com/railsadminteam/rails_admin/issues/3686 - https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef - https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673 - https://rubygems.org/gems/rails_admin/versions/2.3.0 - https://rubygems.org/gems/rails_admin/versions/3.1.3
CVE ID: CVE-2024-39309 State: PUBLISHED Published: 2024-07-01T21:15:26.242Z Last Updated: 2024-08-02T04:19:20.712Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-288, CWE-89 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CV
in versions 6.5.7 and 7.1.0. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r - https://github.com/parse-community/parse-server/pull/9167 - https://github.com/parse-community/parse-server/pull/9168 - https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3 - https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b
CVE ID: CVE-2024-39310 State: PUBLISHED Published: 2024-07-01T21:19:35.867Z Last Updated: 2024-08-02T04:19:20.713Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: XjSv Products: Basil Problem Types: CWE-79 Description: The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default Wor
trary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/XjSv/Basil/security/advisories/GHSA-cr7v-8v2h-49vx - https://github.com/XjSv/Basil/commit/e2b1dbf1637d1ec2663f9aa1a563b02dc76a8146
CVE ID: CVE-2024-39311 State: PUBLISHED Published: 2025-03-28T14:38:03.816Z Last Updated: 2025-03-28T15:37:35.064Z Vendors: publify Products: publify Problem Types: CWE-79 Description: Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core` rubygem, publisher on a `publify` application is able to perform a cross-site scripting (XSS) attack on an administrator using the redirect functionality. The exploitation of this XSS vulnerability requires the administrator to click a malicious link. An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvio
malicious link. An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvious to an administrator that this is a malicious link. A publisher may attempt to use this vulnerability to escalate their privileges and become an administrator. Version 10.0.1 of Publify and version 10.0.2 of the `publify_core` rubygem fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q
CVE ID: CVE-2024-39312 State: PUBLISHED Published: 2024-07-08T16:30:25.044Z Last Updated: 2024-08-02T04:19:20.621Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: randombit Products: botan Problem Types: CWE-295 Description: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subt
only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/randombit/botan/security/advisories/GHSA-jp24-56jm-gg86
CVE ID: CVE-2024-39313 State: PUBLISHED Published: 2024-07-01T21:23:38.247Z Last Updated: 2024-08-02T04:19:20.681Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: KisaragiEffective Products: toy-blog Problem Types: CWE-200 Description: toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Kisara
ble. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-rf2q-5q4q-5fwr - https://github.com/KisaragiEffective/toy-blog/commit/f13a45f68c9560124558e6bb445ad441a4cf4732
CVE ID: CVE-2024-39314 State: PUBLISHED Published: 2024-07-01T21:33:54.000Z Last Updated: 2024-08-02T04:19:20.704Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: KisaragiEffective Products: toy-blog Problem Types: CWE-214, CWE-200 Description: toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this w
nch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-q8g2-c3x5-gp89 - https://github.com/KisaragiEffective/toy-blog/commit/4d003e46a944d8f44ea02c63f4beefa4cbe1f4f7
CVE ID: CVE-2024-39315 State: PUBLISHED Published: 2024-07-02T20:02:06.120Z Last Updated: 2024-08-02T04:19:20.747Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: pomerium Products: pomerium Problem Types: CWE-201 Description: Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of a cross-site scripting vulnerability in an upstream application proxied through Pomerium. If an attacker c
e presence of a cross-site scripting vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the `/.pomerium` endpoint. Upstream applications that authenticate only the ID token may be vulnerable to user impersonation using a token obtained in this manner. Note that an OAuth2 access token or ID token by itself is not sufficient to hijack a user's Pomerium session. Upstream applications should not be vulnerable to user impersonation via these tokens provided the application verifies the Pomerium JWT for each request, the connection be
er impersonation via these tokens provided the application verifies the Pomerium JWT for each request, the connection between Pomerium and the application is secured by mTLS, or the connection between Pomerium and the application is otherwise secured at the network layer. The issue is patched in Pomerium v0.26.1. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pomerium/pomerium/security/advisories/GHSA-rrqr-7w59-637v - https://github.com/pomerium/pomerium/commit/4c7c4320afb2ced70ba19b46de1ac4383f3daa48
CVE ID: CVE-2024-39316 State: PUBLISHED Published: 2024-07-02T15:57:39.107Z Last Updated: 2024-08-02T04:19:20.629Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: rack Products: rack Problem Types: CWE-1333 Description: Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a
oding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7 - https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f - https://github.com/rack/rack/commit/412c980450
- https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f - https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
CVE ID: CVE-2024-39317 State: PUBLISHED Published: 2024-07-11T15:23:22.307Z Last Updated: 2024-08-02T04:19:20.749Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: wagtail Products: wagtail Problem Types: CWE-1333 Description: Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be explo
of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8 - https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2 - https://github.com/wagtail/wagta
- https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2 - https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797 - https://github.com/wagtail/wagtail/commit/b783c096b6d4fd2cfc05f9137a0be288850e99a2
CVE ID: CVE-2024-39318 State: PUBLISHED Published: 2024-07-31T15:38:48.237Z Last Updated: 2024-08-01T19:44:20.703Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: ibexa Products: admin-ui Problem Types: CWE-79 Description: The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated editors and administrators will have the required permission. It is not persistent, i.e. the payload is only executed during the upload. In effect, an attacker will have to trick an ed
is not persistent, i.e. the payload is only executed during the upload. In effect, an attacker will have to trick an editor/administrator into uploading a strangely named file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ibexa/admin-ui/security/advisories/GHSA-qm44-wjm2-pr59 - https://github.com/ezsystems/ezplatform-admin-ui/security/advisories/GHSA-gc5h-6jx9-q2qh - https://github.com/ezsystems/ezplatform-admin-ui/commit/7a9f991b200fa5a03d49cd07f50577c8bc90a30b - https://github.com/ibexa/admin-ui/commit/8dc413fad1045fcfbe65dbcb0bea8516accc4c3e - https://developers.ibexa.co/security-advisories/ibexa-sa-2024-004-dom-based-xss-in-file-upload
CVE ID: CVE-2024-39319 State: PUBLISHED Published: 2024-09-26T16:07:01.482Z Last Updated: 2024-09-26T18:24:00.120Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: aimeos Products: ai-controller-frontend Problem Types: CWE-639 Description: aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aimeos/ai-controller-frontend/security/advisories/GHSA-rw3j-574h-mrcq - https://github.com/aimeos/ai-controller-frontend/commit/2ad5c062a629af374da470a319914c321c9bfee2 - https://github.com/aimeos/ai-controller-frontend/commit/53eebdc51fae34440dfd768a7811c169c7779aa9 - https://github.com/aimeos/ai-controller-frontend/commit/5833db6d18a889b94dc036dfb84b6f5cca73fbac - https://github.com/aimeos/ai-controller-frontend/commit/6ea6b82f5a1fc18c574cb6f97225930d139b14a5 - https://github.com/aimeos/ai-controller-frontend/commit/700da5ea2b622724b68c8684346bf
5a1fc18c574cb6f97225930d139b14a5 - https://github.com/aimeos/ai-controller-frontend/commit/700da5ea2b622724b68c8684346bf74ac3bbca9b - https://github.com/aimeos/ai-controller-frontend/commit/7c93139f86eff9ec26b117a8918e06ce6cc0000f - https://github.com/aimeos/ai-controller-frontend/commit/ae7baa3f2fbf594c2c1e4b1aae83364a84b241a6 - https://github.com/aimeos/ai-controller-frontend/commit/cd8c95aa4663f54bd66a69c5952f2e42405426f3 - https://github.com/aimeos/ai-controller-frontend/commit/d4eac06f3a25330c089d8be4397f2ab1936dd9bb - https://github.com/aimeos/ai-controller-frontend/commit/f7c6a9ce2a6f5a9ad4af31313508870a78398f85
CVE ID: CVE-2024-39320 State: PUBLISHED Published: 2024-07-30T14:33:48.589Z Last Updated: 2024-08-02T04:19:20.670Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: discourse Products: discourse Problem Types: CWE-74, CWE-1021 Description: Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/adviso
: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-4p82-xh38-gq4p - https://github.com/discourse/discourse/commit/188cb58daa833839c54c266ce22db150a3f3a210 - https://github.com/discourse/discourse/commit/76f06f6b1491db6bd09a4017d2c5591431b3b16e
CVE ID: CVE-2024-39321 State: PUBLISHED Published: 2024-07-05T17:32:06.688Z Last Updated: 2024-08-02T04:19:20.719Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: traefik Products: traefik Problem Types: CWE-639 Description: Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - ht
workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9 - https://github.com/traefik/traefik/releases/tag/v2.11.6 - https://github.com/traefik/traefik/releases/tag/v3.0.4 - https://github.com/traefik/traefik/releases/tag/v3.1.0-rc3
CVE ID: CVE-2024-39322 State: PUBLISHED Published: 2024-07-02T20:19:01.919Z Last Updated: 2024-08-02T04:19:20.705Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: aimeos Products: ai-admin-jsonadm Problem Types: CWE-863 Description: aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
3, 2023.10.4, and 2024.4.2 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/ai-admin-jsonadm/security/advisories/GHSA-8fj2-587w-5whr - https://github.com/aimeos/ai-admin-jsonadm/commit/02a063fbd616d4e0a5aaf89f1642a856aa5ac5a5 - https://github.com/aimeos/ai-admin-jsonadm/commit/16d013d0e28cecd19781f434d83fabebcc78cdc2 - https://github.com/aimeos/ai-admin-jsonadm/commit/4c966e02bd52589c3c9382777cfe170eddf17b00 - https://github.com/aimeos/ai-admin-jsonadm/commit/640954243ce85c2c303a00dd6481ed39b3d218fb - https://github.com/aimeos/ai-admin-jsonadm/commit/7d1c05e8368b0a6419820fe402deac9960500026
CVE ID: CVE-2024-39323 State: PUBLISHED Published: 2024-07-02T16:03:03.253Z Last Updated: 2024-08-02T04:19:20.645Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: aimeos Products: ai-admin-graphql Problem Types: CWE-1220, CWE-863 Description: aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
and 2024.04.6 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-vc7j-99jw-jrqm - https://github.com/aimeos/ai-admin-graphql/commit/2d89d98cdcad880a9244b50736b08c1a171379ca - https://github.com/aimeos/ai-admin-graphql/commit/54d6b7cf4530cb3b95f52775c24056c48e6d26e9 - https://github.com/aimeos/ai-admin-graphql/commit/787028de0a3ecbf3e9f63ab1454eac99ce7693a9
CVE ID: CVE-2024-39324 State: PUBLISHED Published: 2024-07-02T20:09:22.872Z Last Updated: 2024-08-02T04:19:20.752Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: aimeos Products: ai-admin-graphql Problem Types: CWE-1220, CWE-863 Description: aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
10.6, and 2024.4.2 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-jj68-cp4v-98qf - https://github.com/aimeos/ai-admin-graphql/commit/4eabc2b973509ffa5924e7f88c8f87ee96e93b38 - https://github.com/aimeos/ai-admin-graphql/commit/687059d7eb2e1d55a09ed72dad3814f35edad038 - https://github.com/aimeos/ai-admin-graphql/commit/a839a5adf16fee4221d444b7d2f5140d8cabf0ac - https://github.com/aimeos/ai-admin-graphql/commit/acbb044620f4ff8e8d78a775cd205ec47cf119b3
CVE ID: CVE-2024-39325 State: PUBLISHED Published: 2024-07-02T20:36:58.336Z Last Updated: 2024-08-02T04:19:20.638Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: aimeos Products: ai-controller-frontend Problem Types: CWE-841 Description: aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refer
1.10.8, and 2020.10.15 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/ai-controller-frontend/security/advisories/GHSA-m9gv-6p22-qgmj - https://github.com/aimeos/ai-controller-frontend/commit/16b8837d2466e3665b3c826ce87934b01a847268 - https://github.com/aimeos/ai-controller-frontend/commit/24a57001e56759d1582d2a0080fc1ca3ba328630 - https://github.com/aimeos/ai-controller-frontend/commit/28549808e0f6432a34cd3fb95556deeb86ca276d - https://github.com/aimeos/ai-controller-frontend/commit/b1960c0b6e5ee93111a5360c9ce949b3e7528cf7 - https://github.com/aimeos/ai-controller-frontend/commit/dafa072783bb692f111ed092d9d2
b6e5ee93111a5360c9ce949b3e7528cf7 - https://github.com/aimeos/ai-controller-frontend/commit/dafa072783bb692f111ed092d9d2932c113eb855