Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rary are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae - https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd
CVE ID: CVE-2024-5570 State: PUBLISHED Published: 2024-06-28T06:00:03.518Z Last Updated: 2025-08-27T12:00:30.978Z Vendors: Unknown Products: Simple Photoswipe Problem Types: CWE-862 Missing Authorization Description: The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/49b3a8cb-f606-4cf7-80ec-bfdafd74e848/
CVE ID: CVE-2024-5571 State: PUBLISHED Published: 2024-06-05T08:33:15.749Z Last Updated: 2024-08-01T21:18:06.783Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute wi
ts in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's EmbedPress PDF widget in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7becdab6-f952-4649-8cea-4efadf841619?source=cve - https://plugins
ps://www.wordfence.com/threat-intel/vulnerabilities/id/7becdab6-f952-4649-8cea-4efadf841619?source=cve - https://plugins.trac.wordpress.org/browser/embedpress/tags/4.0.0/EmbedPress/Elementor/Widgets/Embedpress_Pdf.php#L690 - https://plugins.trac.wordpress.org/changeset/3097114/
CVE ID: CVE-2024-5573 State: PUBLISHED Published: 2024-06-26T06:00:05.425Z Last Updated: 2024-08-01T21:18:06.816Z Vendors: Unknown Products: Easy Table of Contents Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/3b01044b-355f-40d3-8e11-23a890f98c76/
CVE ID: CVE-2024-5574 State: PUBLISHED Published: 2024-06-19T05:37:43.474Z Last Updated: 2024-08-01T21:18:06.325Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: codevibrant Products: WP Magazine Modules Lite Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'blockLayout' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing
cated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0aeaf421-513b-4c9d-bd36-58af28c86bc1?source=cve - https://plugins.trac.wordpress.org/browser/wp-magazine-modules-lite/trunk/includes/src/banner/element.php#L1363 - https://plugins.trac.wordpress.org/changeset/310
/wp-magazine-modules-lite/trunk/includes/src/banner/element.php#L1363 - https://plugins.trac.wordpress.org/changeset/3104046/
CVE ID: CVE-2024-5575 State: PUBLISHED Published: 2024-07-13T06:00:12.200Z Last Updated: 2024-08-01T21:18:06.451Z Vendors: Unknown Products: Ditty Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/65d1abb7-92e9-4cc4-a1d0-84985b484af3/
CVE ID: CVE-2024-5576 State: PUBLISHED Published: 2024-08-20T05:30:03.314Z Last Updated: 2024-08-20T13:34:08.230Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeum Products: Tutor LMS Elementor Addons Problem Types: CWE-79 Description: The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's Course Carousel widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrar
ributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdd1b1c-84b5-451a-a921-80be3b154398?source=cve - https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/tags/2.1.4/templates/course/course-carousel.php#L81 - https://plugins.trac.wordpress.org/changeset/3136459/#file9 - https://plugins.trac.wordpress.org/changeset/3136459/#file13 - https://plugins.trac.wordpress.org/changeset/3136459/ - https://wordpress.
rac.wordpress.org/changeset/3136459/#file13 - https://plugins.trac.wordpress.org/changeset/3136459/ - https://wordpress.org/plugins/tutor-lms-elementor-addons/#developers
CVE ID: CVE-2024-5577 State: PUBLISHED Published: 2024-06-14T07:31:06.775Z Last Updated: 2024-08-01T21:18:06.777Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mcnardelli Products: Where I Was, Where I Will Be Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version <= 1.1.1 via the WIW_HEADER parameter of the /system/include/include_user.php file. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external servers, allow
makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external servers, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution. This requires allow_url_include to be set to true in order to exploit, which is not commonly enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68e0f54d-08ec-4e41-ac9b-d72cdde5a724?source=cve - https://plugins.trac.wordpress.org/browser/where-i-was-where-i-will-be/trunk/system/include/include_user.php
CVE ID: CVE-2024-5578 State: PUBLISHED Published: 2024-11-05T06:00:06.744Z Last Updated: 2024-11-05T16:21:20.702Z Vendors: Unknown Products: Table of Contents Plus Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/641e4fc3-4214-4c2e-8245-15e9dcdd37b4/
CVE ID: CVE-2024-5579 State: PUBLISHED Published: 2024-11-22T20:05:25.729Z Last Updated: 2024-11-25T18:06:06.622Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Allegra Products: Allegra Problem Types: CWE-502 Description: Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the renderFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrust
e issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23451. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1162/ - https://alltena.com/en/resources/release-notes/relnotes-7-5-2
CVE ID: CVE-2024-5580 State: PUBLISHED Published: 2024-11-22T20:05:26.675Z Last Updated: 2024-11-25T18:06:06.491Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Allegra Products: Allegra Problem Types: CWE-502 Description: Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted d
sue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23452. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1163/ - https://alltena.com/en/resources/release-notes/relnotes-7-5-2
CVE ID: CVE-2024-5581 State: PUBLISHED Published: 2024-11-22T20:05:27.761Z Last Updated: 2024-11-25T18:06:06.771Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Allegra Products: Allegra Problem Types: CWE-22 Description: Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulner
of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23453. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1164/ - https://alltena.com/en/resources/release-notes/relnotes-7-5-2
CVE ID: CVE-2024-5582 State: PUBLISHED Published: 2024-07-17T07:32:19.774Z Last Updated: 2024-08-01T21:18:06.605Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: magazine3 Products: Schema & Structured Data for WP & AMP Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and including, 1.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for
1.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab650b99-ab15-4ddc-a622-cb43ab554ba7?source=cve - https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.31/modules/elementor/widgets/qanda-block.php#L355 - https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/
s/elementor/widgets/qanda-block.php#L355 - https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/trunk/modules/elementor/widgets/class-qanda-block.php#L369 - https://wordpress.org/plugins/schema-and-structured-data-for-wp/#developers
CVE ID: CVE-2024-5583 State: PUBLISHED Published: 2024-08-22T02:02:03.867Z Last Updated: 2024-08-22T13:34:15.403Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: posimyththemes Products: The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Problem Types: CWE-79 Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel_direction parameter of testimonials widget in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping on user supplie
t in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/55981e72-8d1a-4075-a372-6bddc95e99d8?source=cve - https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.5.6/modules/widgets/tp_testimonial_listout.php#L2284
CVE ID: CVE-2024-5584 State: PUBLISHED Published: 2024-06-11T09:32:02.511Z Last Updated: 2024-08-01T21:18:06.755Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ladela Products: WordPress Online Booking and Scheduling Plugin – Bookly Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Color Profile parameter in all versions up to, and including, 23.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers
ing, 23.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with the staff member role and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad9fcd1-b3a3-4711-ad23-d27c3e2091f4?source=cve - https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/23.2/backend/modules/staff/resources/js/staff-list.js#L44
CVE ID: CVE-2024-5585 State: PUBLISHED Published: 2024-06-09T18:36:50.477Z Last Updated: 2025-02-13T17:54:21.435Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: PHP Group Products: PHP Problem Types: CWE-116, CWE-78 Description: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell. Additional Anal
a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385 - http://www.openwall.com/lists/oss-security/2024/06/07/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ - https://security.netapp.com/advisory/ntap-20240726-0002/
CVE ID: CVE-2024-5586 State: PUBLISHED Published: 2024-08-23T13:54:53.458Z Last Updated: 2024-08-23T14:40:48.724Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/cve-2024-5586.html
CVE ID: CVE-2024-5587 State: PUBLISHED Published: 2024-06-02T10:00:07.703Z Last Updated: 2024-08-20T13:47:48.501Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Casdoor Problem Types: CWE-552 Description: A vulnerability was found in Casdoor up to 1.335.0. It has been classified as problematic. Affected is an unknown function of the file /conf/app.conf of the component Configuration File Handler. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266838 is the identifier assigned to this vulnerability. NOTE: The vendor was co
osed to the public and may be used. VDB-266838 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.266838 - https://vuldb.com/?ctiid.266838 - https://vuldb.com/?submit.343357 - https://www.yuque.com/yuqueyonghunhj6tg/ygf5oy/wkwg66pioe4f5av0
CVE ID: CVE-2024-5588 State: PUBLISHED Published: 2024-06-02T15:00:04.597Z Last Updated: 2024-08-01T21:18:06.580Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Learning Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Learning Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file processscore.php. The manipulation of the argument LessonID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266839. Additional Anal
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266839. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.266839 - https://vuldb.com/?ctiid.266839 - https://vuldb.com/?submit.347576 - https://github.com/Lanxiy7th/lx_CVE_report-/issues/12
CVE ID: CVE-2024-5589 State: PUBLISHED Published: 2024-06-03T00:00:04.785Z Last Updated: 2024-08-01T21:18:06.556Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /admin/config_MT.php?action=delete. The manipulation of the argument Mid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266847. NOTE: T
has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266847. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.266847 - https://vuldb.com/?ctiid.266847 - https://vuldb.com/?submit.344780 - https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-config_MT.md
CVE ID: CVE-2024-5590 State: PUBLISHED Published: 2024-06-03T00:31:03.973Z Last Updated: 2024-08-20T17:57:08.734Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. This vulnerability affects unknown code of the file /protocol/iscuser/uploadiscuser.php of the component JSON Content Handler. The manipulation of the argument messagecontent leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of thi
he attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266848. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.266848 - https://vuldb.com/?ctiid.266848 - https://vuldb.com/?submit.344785 - https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-uploadiscuser.md
CVE ID: CVE-2024-5591 State: PUBLISHED Published: 2025-01-03T14:33:51.872Z Last Updated: 2025-01-03T17:53:10.817Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Jazz Foundation Problem Types: CWE-209 Description: IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180120