Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-55566 State: PUBLISHED Published: 2024-12-09T00:00:00.000Z Last Updated: 2025-04-04T14:30:42.210Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: n/a Products: n/a Problem Types: CWE-335 Description: ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). The impact can be overwriting files or making ColPack graphing unavailable to other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1225617 - https://github.com/CSCsw/ColPack/blob/9a7293a8dfd66a60434496b8df5ebb4274d70339/src/Utilities/extra.cpp#L184-L190 -
617 - https://github.com/CSCsw/ColPack/blob/9a7293a8dfd66a60434496b8df5ebb4274d70339/src/Utilities/extra.cpp#L184-L190 - https://cwe.mitre.org/data/definitions/335.html
CVE ID: CVE-2024-55567 State: PUBLISHED Published: 2025-06-12T00:00:00.000Z Last Updated: 2025-06-17T19:07:52.795Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.01. The SMM module has an SMM call out vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2024018/
CVE ID: CVE-2024-55568 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-20T15:59:31.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The absence of a NULL check leads to a Denial of Service when an attacker sends malformed MM packets to the target. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/qua
iconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-55568/
CVE ID: CVE-2024-55569 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-28T13:50:23.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds writes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-55569/
CVE ID: CVE-2024-55570 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-05T18:40:53.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: /api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018) fixed in V5.0R14.5P4-V3.3R1 allows remote authenticated users of the application to increase their privileges by sending a single HTTP PUT request with rolename=Administrator, aka incorrect access control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/security-advisories/ - https://herolab.usd.de/security-advisories/usd-2024-0014/
CVE ID: CVE-2024-55573 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-01-24T18:15:01.083Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to inject SQL into the form used to create virtual metrics. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55573-centreon-web-critical
reon/centreon/releases - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55573-centreon-web-critical-severity-4264
CVE ID: CVE-2024-55577 State: PUBLISHED Published: 2025-01-15T05:17:04.115Z Last Updated: 2025-01-15T15:05:11.168Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: The Dimensional Gate Co. Products: Linux Ratfor Problem Types: CWE-121 Description: Stack-based buffer overflow vulnerability exists in Linux Ratfor 1.06 and earlier. When the software processes a file which is specially crafted by an attacker, arbitrary code may be executed. As a result, the attacker may obtain or alter information of the user environment or cause the user environment to become unusable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.dgate.org/ratfor/ - ht
t to become unusable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.dgate.org/ratfor/ - https://jvn.jp/en/vu/JVNVU92217718/
CVE ID: CVE-2024-55578 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-12T17:15:13.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zammad.com/en/advisories/zaa-2024-05
CVE ID: CVE-2024-55579 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-17T04:55:16.102Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection objects that trigger execution of arbitrary EXE files. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://c
ay 2023 Patch 18, and February 2023 Patch 15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.qlik.com/t5/Official-Support-Articles/High-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows-CVEs/tac-p/2496004
CVE ID: CVE-2024-55580 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-17T04:55:17.631Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to execute remote commands that could cause high availability damages, including high integrity and confidentiality risks. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15. Additional Analyst Notes: - C
vember 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.qlik.com/t5/Official-Support-Articles/High-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows-CVEs/tac-p/2496004
CVE ID: CVE-2024-55581 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-10T20:03:09.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate (unless the using program specifies a TLS configuration). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.adacore.com/corp/security-advisories/SEC.AWS-0056-v1.pdf
CVE ID: CVE-2024-55582 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T16:18:39.520Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AC:H/AV:P/A:N/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Oxide before 6 has unencrypted Control Plane datastores. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.oxide.computer/security/advisories/20240118-1
CVE ID: CVE-2024-55585 State: PUBLISHED Published: 2025-06-07T00:00:00.000Z Last Updated: 2025-06-13T07:27:37.060Z Vendors: MOPS Products: moPS Problem Types: CWE-306 Description: In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mops.eu - https://karatemuffin.it/data/2025_06_07_CVE-2024-55585_update.json - https://media.ccc.de/v/glt25-504-safety-ja-security-nein-analyse-eines-breit-eingesetzten-einsatzmanagmentsystems- - https://www.mops.eu
CVE ID: CVE-2024-55586 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2025-01-06T17:32:57.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nette/database/releases - https://www.csirt.sk/nette-framework-vulnerability-permits-sql-injection.html - https://github.com/CSIRTTrizna/CVE-2024-55586
CVE ID: CVE-2024-55587 State: PUBLISHED Published: 2024-12-11T00:00:00 Last Updated: 2024-12-12T16:28:35.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/smartfile/python-libarchive/blob/c7677411bfc4ab5701d343bc6ebd9e35c990e80e/libarchive/zip.py#L107 - https://github.com/smartfile/python-libarchive/issues/42 - https://github.com/smartfile/python-libarchive/pull/41
CVE ID: CVE-2024-55590 State: PUBLISHED Published: 2025-03-11T14:54:34.932Z Last Updated: 2025-03-11T16:05:38.384Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiIsolator Problem Types: CWE-78 Description: Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiIsolator version 2.4.0 through 2.4.5 allows an authenticated attacker with at least read-only admin permission and CLI access to execute unauthorized code via specifically crafted CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.for
ecifically crafted CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-178
CVE ID: CVE-2024-55591 State: PUBLISHED Published: 2025-01-14T14:08:34.207Z Last Updated: 2025-10-21T22:55:32.705Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-288 Description: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-
ocket module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-535
CVE ID: CVE-2024-55592 State: PUBLISHED Published: 2025-03-11T14:54:29.067Z Last Updated: 2025-03-11T16:07:03.773Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-863 Description: An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests. Additional Analyst Notes: - CISA ADP
attacker to perform unauthorized operations on incidents via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-377
CVE ID: CVE-2024-55593 State: PUBLISHED Published: 2025-01-14T14:08:36.557Z Last Updated: 2025-01-14T20:56:58.704Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-89 Description: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWeb versions 6.3.17 through 7.6.1 allows attacker to gain information disclosure via crafted SQL queries Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-465
CVE ID: CVE-2024-55594 State: PUBLISHED Published: 2025-03-14T16:25:33.078Z Last Updated: 2025-03-14T16:58:29.982Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-228 Description: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-115
CVE ID: CVE-2024-55595 State: REJECTED Published: N/A Last Updated: 2025-06-10T02:55:05.002Z Description: No description available.
CVE ID: CVE-2024-55597 State: PUBLISHED Published: 2025-03-11T14:54:26.129Z Last Updated: 2025-03-11T16:06:25.836Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-22 Description: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-439
CVE ID: CVE-2024-55599 State: PUBLISHED Published: 2025-07-08T14:41:34.245Z Last Updated: 2025-07-08T20:41:10.059Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-358 Description: An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
ated user to bypass the DNS filter via Apple devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-053
CVE ID: CVE-2024-55601 State: PUBLISHED Published: 2024-12-09T21:11:10.463Z Last Updated: 2024-12-10T17:13:48.519Z Vendors: gohugoio Products: hugo Problem Types: CWE-79 Description: Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtub
rkup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx - https://github.com/gohugoio/hugo/commit/54398f8d572c689f9785d59e907fd910a23401b0 - https://github.com/gohugoio/hugo/releases/tag/v0.139.4 - https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
CVE ID: CVE-2024-55602 State: PUBLISHED Published: 2024-12-10T16:58:12.982Z Last Updated: 2024-12-10T17:22:00.349Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: pwndoc Products: pwndoc Problem Types: CWE-22 Description: PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal (`../`) sequences into the file extension property to read arbitrary files on the system. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://githu
c6e9a2fe6 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pwndoc/pwndoc/security/advisories/GHSA-2mqc-gg7h-76p6 - https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6 - https://gist.github.com/JorianWoltjer/8a42e25c6dfa7604020d2a226e193407 - https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L103 - https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L43-L47
CVE ID: CVE-2024-55603 State: PUBLISHED Published: 2024-12-18T23:52:57.327Z Last Updated: 2024-12-20T20:12:10.648Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-613 Description: Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. Therefore, when a `session_id` is given, kanboard queries the data from the `sessions` sql table. At this point, it does not correctly verify, if
n_id` is given, kanboard queries the data from the `sessions` sql table. At this point, it does not correctly verify, if a given `session_id` has already exceeded its lifetime (`expires_at`). Thus, a session which's lifetime is already `> time()`, is still queried from the database and hence a valid login. The implemented **SessionHandlerInterface::gc** function, that does remove invalid sessions, is called only **with a certain probability** (_Cleans up expired sessions. Called by `session_start()`, based on `session.gc_divisor`, `session.gc_probability` and `session.gc_maxlifetime` settings_) accordingly to the php documentation. In the official Kanboard docker image these values default t
xlifetime` settings_) accordingly to the php documentation. In the official Kanboard docker image these values default to: session.gc_probability=1, session.gc_divisor=1000. Thus, an expired session is only terminated with probability 1/1000. This issue has been addressed in release 1.2.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-gv5c-8pxr-p484 - https://github.com/kanboard/kanboard/commit/7ce61c34d962ca8b5dce776289ddf4b207be6e78 - https://github.com/kanboard/kanboard/blob/main/app/Core/Session/SessionHandler.php#L4
d962ca8b5dce776289ddf4b207be6e78 - https://github.com/kanboard/kanboard/blob/main/app/Core/Session/SessionHandler.php#L40 - https://www.php.net/manual/en/function.session-start.php - https://www.php.net/manual/en/session.configuration.php#ini.session.gc-divisor - https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime - https://www.php.net/manual/en/session.configuration.php#ini.session.gc-probability - https://www.php.net/manual/en/sessionhandlerinterface.gc.php
CVE ID: CVE-2024-55604 State: PUBLISHED Published: 2025-03-25T14:15:05.339Z Last Updated: 2025-03-25T14:44:39.532Z Vendors: appsmithorg Products: appsmith Problem Types: CWE-280 Description: Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invi
expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6
CVE ID: CVE-2024-55605 State: PUBLISHED Published: 2025-01-06T17:07:18.849Z Last Updated: 2025-01-06T17:22:20.313Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: suricata Problem Types: CWE-400 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large input buffer to the to_lowercase, to_uppercase, strip_whitespace, compress_whitespace, dotprefix, header_lowercase, strip_pseudo_headers, url_decode, or xor transform can lead to a stack overflow causing Suricata to crash. The issue has been addressed in Suricata 7.0.8. Additional Analyst Notes: - CISA
ack overflow causing Suricata to crash. The issue has been addressed in Suricata 7.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OISF/suricata/security/advisories/GHSA-x2hr-33vp-w289 - https://redmine.openinfosecfoundation.org/issues/7229
CVE ID: CVE-2024-55626 State: PUBLISHED Published: 2025-01-06T17:47:07.213Z Last Updated: 2025-11-03T19:32:13.234Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: OISF Products: suricata Problem Types: CWE-680 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large BPF filter file provided to Suricata at startup can lead to a buffer overflow at Suricata startup. The issue has been addressed in Suricata 7.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OISF/suricata/security/advisories/GHSA-wmg4-jqx5