Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ulnerability. The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true
CVE ID: CVE-2024-10038 State: PUBLISHED Published: 2024-11-13T02:02:33.697Z Last Updated: 2024-11-13T14:41:53.150Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: cmanon Products: WP-Strava Problem Types: CWE-80 Description: The WP-Strava plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site instal
ry web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f200526-890c-4a2a-9d8e-334443ef7e0b?source=cve - https://github.com/cmanon/wp-strava/blob/5b9499dab0eeada3887e5b64cf471e7978147154/src/WPStrava/Auth.php#L92-L93
CVE ID: CVE-2024-10040 State: PUBLISHED Published: 2024-10-18T04:32:52.212Z Last Updated: 2024-10-18T17:19:54.761Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: paulirish-1 Products: Infinite-Scroll Problem Types: CWE-352 Description: The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation on the process_ajax_edit and process_ajax_delete function. This makes it possible for unauthenticated attackers to make changes to plugin settings via a forged request granted they can trick a site administrator into performing an action such as
s to plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4045575a-35f0-46e5-afb7-93eee9be3a97?source=cve - https://plugins.trac.wordpress.org/browser/infinite-scroll/trunk/includes/presets.php#L252 - https://plugins.trac.wordpress.org/browser/infinite-scroll/trunk/includes/presets.php#L275
CVE ID: CVE-2024-10041 State: PUBLISHED Published: 2024-10-23T13:46:27.963Z Last Updated: 2025-11-20T18:11:42.832Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Problem Types: CWE-922 Description: A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain specula
its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10379 - https://access.redhat.com/errata/RHSA-2024:11250 - https://access.redhat.com/errata/RHSA-2024:9941 - https://access.redhat.com/security/cve/CVE-2024-10041 - https://bugzilla.redhat.com/show_bug.cgi?id=2319212
CVE ID: CVE-2024-10042 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:04:50.961Z Description: No description available.
CVE ID: CVE-2024-10043 State: PUBLISHED Published: 2024-12-12T12:02:29.814Z Last Updated: 2024-12-12T15:44:38.834Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issu
disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/499577 - https://hackerone.com/reports/2774817
CVE ID: CVE-2024-10044 State: PUBLISHED Published: 2024-12-30T11:47:46.995Z Last Updated: 2024-12-30T14:13:58.433Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: lm-sys Products: lm-sys/fastchat Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's credentials to perform unauthorized web actions or access unauthorized web resources by combining it with the POST /register_worker endpoin
orm unauthorized web actions or access unauthorized web resources by combining it with the POST /register_worker endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/44633540-377d-4ac4-b3a3-c2d0fa19d0e6
CVE ID: CVE-2024-10045 State: PUBLISHED Published: 2024-10-23T07:34:53.463Z Last Updated: 2024-10-23T13:46:41.016Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: smub Products: Transients Manager Problem Types: CWE-352 Description: The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the process_actions function. This makes it possible for unauthenticated attackers to delete transients via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst No
granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03b8b5a2-979d-42d0-86f5-48ee73162d22?source=cve - https://plugins.trac.wordpress.org/browser/transients-manager/trunk/src/TransientsManager.php#L993 - https://plugins.trac.wordpress.org/changeset/3171619/transients-manager/trunk/src/TransientsManager.php
CVE ID: CVE-2024-10046 State: PUBLISHED Published: 2024-12-07T01:45:48.881Z Last Updated: 2024-12-09T16:22:22.056Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: persianscript Products: افزونه پیامک ووکامرس Persian WooCommerce SMS Problem Types: CWE-79 Description: The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing
d attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/175a69da-c47a-40f3-98c7-7cfcdf98f9f6?source=cve - https://plugins.trac.wordpress.org/browser/persian-woocommerce-sms/tags/7.0.3/src/SMS/Archive.php#L93 - https://plugins.trac.wordpress.org/changeset/3201912/
CVE ID: CVE-2024-10047 State: PUBLISHED Published: 2025-03-20T10:09:35.799Z Last Updated: 2025-03-20T18:37:08.644Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-36 Description: parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the /open_file endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/69c3a27c-bd93-4aff-a46b-56798f28a3ce
CVE ID: CVE-2024-10048 State: PUBLISHED Published: 2024-10-29T08:31:18.188Z Last Updated: 2024-10-29T14:52:54.958Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ifeelweb, worschtebrot Products: Post Status Notifier, Post Status Notifier Lite Problem Types: CWE-79 Description: The Post Status Notifier Lite and Premium plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.11.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user
r unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/90220c8d-8efc-48a2-955c-3155598f5f19?source=cve - https://plugins.trac.wordpress.org/changeset/3174969/post-status-notifier-lite/tags/1.11.7/lib/Psn/Admin/ListTable/Rules.php
CVE ID: CVE-2024-10049 State: PUBLISHED Published: 2024-10-18T04:32:51.669Z Last Updated: 2024-10-18T13:06:09.382Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ioannup Products: Edit WooCommerce Templates Problem Types: CWE-79 Description: The Edit WooCommerce Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a l
eb scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3704b365-cbdf-4c74-9619-59f0a10e3c6a?source=cve - https://plugins.trac.wordpress.org/browser/woo-edit-templates/trunk/includes/list-table-theme-templates.php#L87
CVE ID: CVE-2024-10050 State: PUBLISHED Published: 2024-10-24T08:32:21.540Z Last Updated: 2024-10-24T13:31:13.419Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: brainstormforce Products: Elementor Header & Footer Builder Problem Types: CWE-200 Description: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfe_template shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the contents of Draft, Private and Password-protected posts they do not own. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ts of Draft, Private and Password-protected posts they do not own. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/662f6ae2-2047-4bbf-b4a6-2d536051e389?source=cve - https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.43/inc/class-header-footer-elementor.php#L634 - https://plugins.trac.wordpress.org/changeset/3173344/header-footer-elementor/trunk/inc/class-header-footer-elementor.php?contextall=1
CVE ID: CVE-2024-10051 State: PUBLISHED Published: 2025-03-20T10:10:53.295Z Last Updated: 2025-10-15T12:49:23.701Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: shaunwei Products: shaunwei/realchar Problem Types: CWE-770 Description: Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service (DoS) attack. The vulnerability exists in the file upload request handling, where appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request causes the server to continuously process each character. This leads to excessive resource consumption and renders the service unavailable. The issue is unauthenticated and doe
. This leads to excessive resource consumption and renders the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6db72368-e7bc-43ee-a4ae-6092f710c263
CVE ID: CVE-2024-10054 State: PUBLISHED Published: 2025-05-15T20:06:39.956Z Last Updated: 2025-05-20T16:04:01.640Z Vendors: Unknown Products: Happyforms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5a9fd64b-3207-4acb-92ff-1cca08c41ac9/
CVE ID: CVE-2024-10055 State: PUBLISHED Published: 2024-10-18T07:35:25.743Z Last Updated: 2024-10-18T13:52:32.995Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ninjateam Products: Click to Chat – WP Support All-in-One Floating Widget Problem Types: CWE-79 Description: The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaio_snapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to
ser supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c13600-0791-4ade-9c28-f43f164aedae?source=cve - https://wordpress.org/plugins/support-chat/#developers - https://plugins.trac.wordpress.org/changeset/3169768/
CVE ID: CVE-2024-10056 State: PUBLISHED Published: 2024-12-05T09:23:06.958Z Last Updated: 2024-12-05T11:13:24.462Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: eyale-vc Products: Contact Form Builder by vcita Problem Types: CWE-79 Description: The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's livesite-pay shortcode in all versions up to, and including, 4.10.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will ex
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1b419c-2276-415d-8c54-15da9125c442?source=cve - https://wordpress.org/plugins/contact-form-with-a-meeting-scheduler-by-vcita/#developers - https://plugins.trac.wordpress.org/changeset/3200766/
CVE ID: CVE-2024-10057 State: PUBLISHED Published: 2024-10-18T09:32:17.586Z Last Updated: 2024-10-18T14:35:45.705Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fahadmahmood Products: RSS Feed Widget Problem Types: CWE-79 Description: The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b77ea258-dced-4c36-bd0d-8977a347d1c9?source=cve - https://wordpress.org/plugins/rss-feed-widget/#developers - https://plugins.trac.wordpress.org/changeset/3170773/
CVE ID: CVE-2024-10068 State: PUBLISHED Published: 2024-10-17T11:00:04.758Z Last Updated: 2024-10-17T17:56:34.782Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenSight Software Products: FlashFXP Problem Types: CWE-427 Description: A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcrypto-1_1.dll of the file FlashFXP.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any w
sclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280716 - https://vuldb.com/?ctiid.280716 - https://vuldb.com/?submit.419684
CVE ID: CVE-2024-10069 State: PUBLISHED Published: 2024-10-17T15:00:09.083Z Last Updated: 2024-10-17T15:49:23.334Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. Affected by this issue is the function actionPassMainApplication of the file /com/esafenet/servlet/client/MailDecryptApplicationService.java. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addi
to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280718 - https://vuldb.com/?ctiid.280718 - https://vuldb.com/?submit.419869 - https://flowus.cn/share/20a4440e-1268-4df1-ab95-8583b450b7c4?code=G8A6P3
CVE ID: CVE-2024-10070 State: PUBLISHED Published: 2024-10-17T15:00:14.030Z Last Updated: 2024-10-17T15:29:43.814Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in ESAFENET CDG 5. This affects the function actionPolicyPush of the file /com/esafenet/policy/action/PolicyPushControlAction.java. The manipulation of the argument policyId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst
nd may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280719 - https://vuldb.com/?ctiid.280719 - https://vuldb.com/?submit.419870 - https://flowus.cn/share/b2afb61c-cdbe-4303-b799-f7c82a9643fb?code=G8A6P3
CVE ID: CVE-2024-10071 State: PUBLISHED Published: 2024-10-17T16:00:07.353Z Last Updated: 2024-10-17T17:52:04.132Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability classified as critical was found in ESAFENET CDG 5. This vulnerability affects the function actionUpdateEncryptPolicyEdit of the file /com/esafenet/servlet/policy/EncryptPolicyService.java. The manipulation of the argument encryptPolicyId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Ad
d to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280720 - https://vuldb.com/?ctiid.280720 - https://vuldb.com/?submit.420913 - https://flowus.cn/share/d1a29ce2-346c-4a8e-836a-e9533c32fad1?code=G8A6P3
CVE ID: CVE-2024-10072 State: PUBLISHED Published: 2024-10-17T16:31:06.271Z Last Updated: 2024-10-17T18:35:18.200Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. This issue affects the function actionAddEncryptPolicyGroup of the file /com/esafenet/servlet/policy/EncryptPolicyService.java. The manipulation of the argument checklist leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A
ed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280721 - https://vuldb.com/?ctiid.280721 - https://vuldb.com/?submit.420914 - https://flowus.cn/share/dd690c21-bb5c-4db4-a737-afb2cf54c8e1?code=G8A6P3
CVE ID: CVE-2024-10073 State: PUBLISHED Published: 2024-10-17T16:31:08.443Z Last Updated: 2024-10-17T18:35:10.889Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: flairNLP Products: flair Problem Types: CWE-94 Description: A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\clustering.py of the component Mode File Loader. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted
tability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280722 - https://vuldb.com/?ctiid.280722 - https://vuldb.com/?submit.420055 - https://github.com/bayuncao/vul-cve-20 - https://github.com/bayuncao/vul-cve-20/blob/main/PoC.py
CVE ID: CVE-2024-10074 State: PUBLISHED Published: 2024-12-03T12:15:19.668Z Last Updated: 2024-12-03T14:26:34.062Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v4.1.1 and prior versions allow a local attacker cause the common permission is upgraded to root through use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-12.md