Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-31184 State: PUBLISHED Published: 2024-09-18T13:57:35.823Z Last Updated: 2024-09-18T17:12:39.993Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MeterStats::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31184
CVE ID: CVE-2024-31185 State: PUBLISHED Published: 2024-09-18T13:57:43.147Z Last Updated: 2024-09-18T17:12:09.394Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-690 Description: Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MeterBandList::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31185
CVE ID: CVE-2024-31186 State: PUBLISHED Published: 2024-09-18T13:57:51.823Z Last Updated: 2024-09-18T15:52:19.872Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::QueueGetConfigReply::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31186
CVE ID: CVE-2024-31187 State: PUBLISHED Published: 2024-09-18T13:57:59.801Z Last Updated: 2024-09-18T15:51:22.751Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartReplyPortDescription::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31187
CVE ID: CVE-2024-31188 State: PUBLISHED Published: 2024-09-18T13:58:06.828Z Last Updated: 2024-09-18T15:50:36.674Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartReplyTableFeatures::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31188
CVE ID: CVE-2024-31189 State: PUBLISHED Published: 2024-09-18T13:58:13.572Z Last Updated: 2024-09-18T15:49:55.840Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartRequestTableFeatures::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31189
CVE ID: CVE-2024-31190 State: PUBLISHED Published: 2024-09-18T13:58:22.935Z Last Updated: 2024-09-18T15:48:13.971Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartReplyMeterConfig::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31190
CVE ID: CVE-2024-31191 State: PUBLISHED Published: 2024-09-18T13:58:29.821Z Last Updated: 2024-09-18T15:39:25.540Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartReplyMeter::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31191
CVE ID: CVE-2024-31192 State: PUBLISHED Published: 2024-09-18T13:58:36.083Z Last Updated: 2024-09-18T15:38:38.187Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartReplyGroupDesc::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31192
CVE ID: CVE-2024-31193 State: PUBLISHED Published: 2024-09-18T13:58:42.560Z Last Updated: 2024-09-18T15:32:28.107Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartReplyGroup::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31193
CVE ID: CVE-2024-31194 State: PUBLISHED Published: 2024-09-18T13:58:50.195Z Last Updated: 2024-09-18T15:30:19.011Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartReplyPortStats::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31194
CVE ID: CVE-2024-31195 State: PUBLISHED Published: 2024-09-18T13:58:58.395Z Last Updated: 2024-09-18T15:29:21.659Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartReplyTable::unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31195
CVE ID: CVE-2024-31196 State: PUBLISHED Published: 2024-09-18T13:59:05.532Z Last Updated: 2024-09-18T15:28:32.418Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-690 Description: Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::ActionList::unpack10. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31196
CVE ID: CVE-2024-31197 State: PUBLISHED Published: 2024-09-18T13:59:12.331Z Last Updated: 2024-09-18T15:25:14.645Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-170 Description: Improper Null Termination vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of10::Port:unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31197
CVE ID: CVE-2024-31198 State: PUBLISHED Published: 2024-09-18T13:59:19.379Z Last Updated: 2024-09-18T15:13:36.931Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Open Networking Foundation (ONF) Products: libfluid Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of10::Port:unpack. This issue affects libfluid: 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31198
CVE ID: CVE-2024-31199 State: PUBLISHED Published: 2024-07-31T13:16:16.628Z Last Updated: 2024-09-30T14:07:42.327Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H) Vendors: Plug&Track Products: Sensor Net Connect V2 Problem Types: CWE-79 Description: A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently inject arbitrary Javascript code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31199
CVE ID: CVE-2024-31200 State: PUBLISHED Published: 2024-07-31T13:16:57.751Z Last Updated: 2024-07-31T14:21:55.581Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Plug&Track Products: Sensor Net Connect V2 Problem Types: CWE-201 Description: A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative session is open in the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31200
CVE ID: CVE-2024-31201 State: PUBLISHED Published: 2024-07-31T13:17:30.914Z Last Updated: 2024-08-01T14:52:47.793Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Plug&Track Products: Thermoscan IP Problem Types: CWE-428 Description: A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenarios where incorrect permissions were assigned to the C:\ path to attempt a privilege escalation on the local machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31201
CVE ID: CVE-2024-31202 State: PUBLISHED Published: 2024-07-31T13:17:59.411Z Last Updated: 2024-09-30T14:08:22.100Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Plug&Track Products: Thermoscan IP Problem Types: CWE-732 Description: A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege Escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31202
CVE ID: CVE-2024-31203 State: PUBLISHED Published: 2024-07-31T13:18:24.871Z Last Updated: 2024-09-30T14:09:39.568Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Plug&Track Products: Thermoscan IP Problem Types: CWE-121 Description: A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll dynamic library packaged with the ThermoscanIP installer allows a local attacker to possibly trigger a Denial-of-Service (DoS) condition on the target component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31203
CVE ID: CVE-2024-31204 State: PUBLISHED Published: 2024-04-04T20:37:45.155Z Last Updated: 2024-12-12T20:53:23.243Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: mailcow Products: mailcow-dockerized Problem Types: CWE-79 Description: mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEV_MODE. The system saves exception details into a session array without proper sanitization or encoding. These details are later rendered into HTML and executed
ls into a session array without proper sanitization or encoding. These details are later rendered into HTML and executed in a JavaScript block within the user's browser, without adequate escaping of HTML entities. This flaw allows for Cross-Site Scripting (XSS) attacks, where attackers can inject malicious scripts into the admin panel by triggering exceptions with controlled input. The exploitation method involves using any function that might throw an exception with user-controllable argument. This issue can lead to session hijacking and unauthorized administrative actions, posing a significant security risk. Version 2024-04 contains a fix for the issue. Additional Analyst Notes: - CISA ADP
, posing a significant security risk. Version 2024-04 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-fp6h-63w4-5hcm - https://www.sonarsource.com/blog/remote-code-execution-in-mailcow-always-sanitize-error-messages
CVE ID: CVE-2024-31205 State: PUBLISHED Published: 2024-04-08T14:26:30.971Z Last Updated: 2024-08-02T01:46:04.600Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: saleor Products: saleor Problem Types: CWE-352 Description: Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token
ion, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/saleor/saleor/security/advisories/GHSA-ff69-fwjf-3c9w - https://github.com/saleor/saleor/commit/36699c6f5c99590d24f
.com/saleor/saleor/security/advisories/GHSA-ff69-fwjf-3c9w - https://github.com/saleor/saleor/commit/36699c6f5c99590d24f46e3d5c5b1a3c2fd072e7
CVE ID: CVE-2024-31206 State: PUBLISHED Published: 2024-04-04T22:10:29.200Z Last Updated: 2024-08-26T20:27:25.984Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: JstnMcBrd Products: dectalk-tts Problem Types: CWE-300, CWE-319, CWE-598 Description: dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no worka
m of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w - https://github.com/JstnMcBrd/dectalk-tts/issues/3 - https://github.com/JstnMcBrd/dectalk-tts/pull/4 - https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105 - https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e
0d8ac156f27da553ac4ead46d16989a350105 - https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18
CVE ID: CVE-2024-31207 State: PUBLISHED Published: 2024-04-04T15:51:54.683Z Last Updated: 2024-08-02T01:46:04.483Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: vitejs Products: vite Problem Types: CWE-200, CWE-284 Description: Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vitejs/vite/security/
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g - https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0 - https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48 - https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67 - https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9 - https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258 - https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649
CVE ID: CVE-2024-31208 State: PUBLISHED Published: 2024-04-23T17:26:39.171Z Last Updated: 2025-02-13T17:47:51.943Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: element-hq Products: synapse Problem Types: CWE-770 Description: Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate excessive data in the database of such instances, resulting in a denial of service. Servers in private federations, or those that do not federate
abase of such instances, resulting in a denial of service. Servers in private federations, or those that do not federate, are not affected. Server administrators should upgrade to 1.105.1 or later. Some workarounds are available. One can ban the malicious users or ACL block servers from the rooms and/or leave the room and purge the room using the admin API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/element-hq/synapse/security/advisories/GHSA-3h7q-rfh9-xm4v - https://github.com/element-hq/synapse/commit/55b0aa847a61774b6a3acdc4b177a20dc019f01a - https://github.com/element-hq/synapse/releases/tag/v1.105.1 - https://lists.fedora
a847a61774b6a3acdc4b177a20dc019f01a - https://github.com/element-hq/synapse/releases/tag/v1.105.1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RR53FNHV446CB37TP45GZ6F6HZLZCK3K/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R6FCCO4ODTZ3FDS7TMW76PKOSEL2TQVB/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSF4NJJSTSQRJQ47PLYYSCFYKJBP7DET/
CVE ID: CVE-2024-31209 State: PUBLISHED Published: 2024-04-04T16:04:43.255Z Last Updated: 2024-09-03T18:26:21.909Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: erlef Products: oidcc Problem Types: CWE-400 Description: oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/erlef/oidcc/security/advisor
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p - https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c - https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649 - https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a - https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388
CVE ID: CVE-2024-31210 State: PUBLISHED Published: 2024-04-04T22:59:28.955Z Last Updated: 2024-08-02T01:46:04.580Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-434 Description: WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary available in the Media Library de
nto place outside of the `uploads` directory) then the uploaded file remains temporary available in the Media Library despite it not being allowed. If the `DISALLOW_FILE_EDIT` constant is set to `true` on the site _and_ FTP credentials are required when uploading a new theme or plugin, then this technically allows an RCE when the user would otherwise have no means of executing arbitrary PHP code. This issue _only_ affects Administrator level users on single site installations, and Super Admin level users on Multisite installations where it's otherwise expected that the user does not have permission to upload or execute arbitrary PHP code. Lower level users are not affected. Sites where the `