Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23301 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-11-04T22:05:44.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rear/rear/issues/3122 - https://github.com/rear/rear/pull/3123 - https://lists.debian.org/debian-lts-announce/2024/02/msg00003.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m
ounce/2024/02/msg00003.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JIN57LUPBI2GDJOK3PYXNHJTZT3AQTZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHKMPXJNXEJJE6EVYE5HM7EKEJFQMBN7/
CVE ID: CVE-2024-23302 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-13T19:55:51.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2024-23304 State: PUBLISHED Published: 2024-02-06T04:19:49.092Z Last Updated: 2025-06-04T15:17:58.476Z Vendors: Cybozu, Inc. Products: Cybozu KUNAI for Android Problem Types: Denial-of-service (DoS) Description: Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cs.cybozu.co.jp/2024/010691.html - https://jvn.jp/en/jp/JVN18743512/
CVE ID: CVE-2024-23305 State: PUBLISHED Published: 2024-02-20T15:29:34.253Z Last Updated: 2025-11-04T18:28:43.963Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-787 Description: An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .vmrk file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulner
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1918
CVE ID: CVE-2024-23306 State: PUBLISHED Published: 2024-02-14T16:30:23.515Z Last Updated: 2025-08-28T19:17:40.190Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Next SPK, BIG-IP Next CNF Problem Types: CWE-522 Description: A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000137886
CVE ID: CVE-2024-23307 State: PUBLISHED Published: 2024-01-25T06:59:37.190Z Last Updated: 2025-06-17T21:19:30.512Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Linux Products: Linux kernel Problem Types: CWE-190 Description: Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.openanolis.cn/show_bug.cgi?id=7975
CVE ID: CVE-2024-23308 State: PUBLISHED Published: 2024-02-14T16:30:24.610Z Last Updated: 2024-08-01T22:59:32.144Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-476 Description: When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD process to terminate. The condition results from setting the Request Body Handling option in the Header-Based Content Profile for an Allowed URL with "Apply value and content signatures and detect threat campaigns." Note: Software versions which have reached End of Technical Support (EoTS) are
signatures and detect threat campaigns." Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000137416
CVE ID: CVE-2024-23309 State: PUBLISHED Published: 2024-10-30T13:35:15.373Z Last Updated: 2024-10-30T15:03:05.748Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: LevelOne Products: WBR-6012 Problem Types: CWE-291 Description: The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for authentication. Attackers could spoof an IP address to gain unauthorized access without needing a session token. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1996
CVE ID: CVE-2024-23310 State: PUBLISHED Published: 2024-02-20T15:29:31.928Z Last Updated: 2025-11-04T18:28:45.201Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-825 Description: A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_report
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1923
CVE ID: CVE-2024-23312 State: PUBLISHED Published: 2024-11-13T21:08:10.586Z Last Updated: 2024-11-14T14:47:10.082Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Binary Configuration Tool software for Windows Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01138.html
CVE ID: CVE-2024-23313 State: PUBLISHED Published: 2024-02-20T15:29:32.465Z Last Updated: 2025-11-04T18:28:46.415Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-191 Description: An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
e to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1922
CVE ID: CVE-2024-23314 State: PUBLISHED Published: 2024-02-14T16:30:23.152Z Last Updated: 2024-08-27T15:25:06.327Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next SPK Problem Types: CWE-908 Description: When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000137675
CVE ID: CVE-2024-23315 State: PUBLISHED Published: 2024-05-28T15:30:15.074Z Last Updated: 2025-02-13T17:39:40.449Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AutomationDirect Products: P3-550E Problem Types: CWE-284 Description: A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can send an unauthenticated packet to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1941 - https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003yZ72AI/sa00037 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1941
CVE ID: CVE-2024-23316 State: PUBLISHED Published: 2024-05-31T19:08:35.381Z Last Updated: 2024-08-01T22:59:32.210Z Vendors: Ping Identity Products: PingAccess Problem Types: CWE-444 Description: HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.pingidentity.com/s/article/SECADV045-PA-HTTP-Smuggling - https://docs.pingidentity.com/r/en-us/pingaccess-80/pa_801_rn - https://www.pingidentity.com/en/resources/downloads/p
- https://docs.pingidentity.com/r/en-us/pingaccess-80/pa_801_rn - https://www.pingidentity.com/en/resources/downloads/pingaccess.html
CVE ID: CVE-2024-23317 State: PUBLISHED Published: 2024-07-11T02:39:28.129Z Last Updated: 2024-08-01T22:59:32.128Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Gallagher Products: Controller 6000 and Controller 7000 Problem Types: CWE-73 Description: External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. This issue affects: 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.8
1a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2024-23317
CVE ID: CVE-2024-23319 State: PUBLISHED Published: 2024-02-09T14:42:22.126Z Last Updated: 2024-08-01T22:59:32.207Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-352 Description: Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-23320 State: PUBLISHED Published: 2024-02-23T16:57:09.741Z Last Updated: 2025-02-13T17:39:41.154Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
ecommended to upgrade to version 3.2.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/dolphinscheduler/pull/15487 - https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm - https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq - https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp - http://www.openwall.com/lists/oss-security/2024/02/23/3
CVE ID: CVE-2024-23321 State: PUBLISHED Published: 2024-07-22T09:24:15.807Z Last Updated: 2025-02-13T17:39:41.709Z Vendors: Apache Software Foundation Products: Apache RocketMQ Problem Types: CWE-200 Description: For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist, could potentially acquire the administrator's account and password through specific interfaces. Such an action would grant them full control over RocketMQ, provided they have access to the
hrough specific interfaces. Such an action would grant them full control over RocketMQ, provided they have access to the broker IP address list. To mitigate these security threats, it is strongly advised that users upgrade to version 5.3.0 or newer. Additionally, we recommend users to use RocketMQ ACL 2.0 instead of the original RocketMQ ACL when upgrading to version Apache RocketMQ 5.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/lr8npobww786nrnddd1pcy974r17c830 - http://www.openwall.com/lists/oss-security/2024/07/22/1
CVE ID: CVE-2024-23322 State: PUBLISHED Published: 2024-02-09T22:51:53.539Z Last Updated: 2024-08-01T22:59:32.223Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-416 Description: Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout.
her through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-6p83-mfmh-qv38 - https://github.com/envoyproxy/envoy/commit/843f9e6a123ed47ce139b421c14e7126f2ac685e
CVE ID: CVE-2024-23323 State: PUBLISHED Published: 2024-02-09T22:50:18.938Z Last Updated: 2024-08-01T22:59:32.269Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: envoyproxy Products: envoy Problem Types: CWE-400, CWE-1176 Description: Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnr
re advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-x278-4w4x-r7ch - https://github.com/envoyproxy/envoy/commit/71eeee8f0f0132f39e402b0ee23b361ee2f4e645
CVE ID: CVE-2024-23324 State: PUBLISHED Published: 2024-02-09T22:48:26.889Z Last Updated: 2024-08-19T16:12:49.967Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-20 Description: Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional
.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6 - https://github.com/envoyproxy/envoy/commit/29989f6cc8bfd8cd2ffcb7c42711eb02c7a5168a
CVE ID: CVE-2024-23325 State: PUBLISHED Published: 2024-02-09T22:47:13.048Z Last Updated: 2024-08-27T16:33:56.336Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-755, CWE-248 Description: Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by the OS. Envoy is susceptible to crashing on a host with IPv6 disabled and a listener config with proxy protocol enabled when it receives a request where the client presents its IPv6 address. It is valid for a client to present its IPv6 address to a target server even though the whole chain is c
s IPv6 address. It is valid for a client to present its IPv6 address to a target server even though the whole chain is connected via IPv4. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-5m7c-mrwr-pm26 - https://github.com/envoyproxy/envoy/commit/bacd3107455b8d387889467725eb72aa0d5b5237
CVE ID: CVE-2024-23326 State: PUBLISHED Published: 2024-06-04T20:05:48.230Z Last Updated: 2024-08-01T22:59:32.189Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-391 Description: Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch.
tly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c
CVE ID: CVE-2024-23327 State: PUBLISHED Published: 2024-02-09T22:41:54.896Z Last Updated: 2025-06-09T18:42:27.781Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-476 Description: Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workar
s been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j - https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9c5d3ab4c5c128ed1369969d54a
CVE ID: CVE-2024-23328 State: PUBLISHED Published: 2024-02-01T15:40:24.236Z Last Updated: 2024-08-28T16:36:41.670Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: dataease Products: dataease Problem Types: CWE-502 Description: Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java.` The blacklist of mysql jdbc attacks can be bypassed and attackers can further exploit it for deserialized execution or reading arbitrary files.
jdbc attacks can be bypassed and attackers can further exploit it for deserialized execution or reading arbitrary files. This vulnerability is patched in 1.18.15 and 2.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-8x8q-p622-jf25 - https://github.com/dataease/dataease/commit/4128adf5fc4592b55fa1722a53b178967545d46a - https://github.com/dataease/dataease/commit/bb540e6dc83df106ac3253f331066129a7487d1a
CVE ID: CVE-2024-23329 State: PUBLISHED Published: 2024-01-19T19:49:54.624Z Last Updated: 2024-11-13T17:15:21.418Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dgtlmoon Products: changedetection.io Problem Types: CWE-863 Description: changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an imp
eds to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr - https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f