Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-52057 State: PUBLISHED Published: 2024-12-13T10:12:32.502Z Last Updated: 2025-02-07T21:46:00.779Z Vendors: RTI Products: Connext Professional Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0, from 6.1.0 before 6.1.2.17, from 6.0.0 before 6.0.*, from 5.2.0 before 5.3.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52057
CVE ID: CVE-2024-52058 State: PUBLISHED Published: 2024-12-13T10:17:25.490Z Last Updated: 2025-02-07T21:48:07.958Z Vendors: RTI Products: Connext Professional Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext Professional (System Designer) allows OS Command Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52058
CVE ID: CVE-2024-52059 State: PUBLISHED Published: 2024-12-13T10:18:35.943Z Last Updated: 2025-09-23T17:49:42.593Z Vendors: RTI Products: Connext Professional Problem Types: CWE-120, CWE-122, CWE-190 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52059
CVE ID: CVE-2024-52060 State: PUBLISHED Published: 2024-12-13T10:19:22.641Z Last Updated: 2025-02-07T21:48:32.911Z Vendors: RTI Products: Connext Professional Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service, Cloud Discovery Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.1.45. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.c
re 6.0.*, from 5.3.0 before 5.3.1.45. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52060
CVE ID: CVE-2024-52061 State: PUBLISHED Published: 2024-12-13T10:20:13.392Z Last Updated: 2025-02-07T21:48:42.491Z Vendors: RTI Products: Connext Professional Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Service, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024
5.3.1.45. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52061
CVE ID: CVE-2024-52062 State: PUBLISHED Published: 2024-12-13T10:20:49.069Z Last Updated: 2025-02-07T21:48:51.526Z Vendors: RTI Products: Connext Professional Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52062
CVE ID: CVE-2024-52063 State: PUBLISHED Published: 2024-12-13T10:21:25.292Z Last Updated: 2025-02-07T21:49:01.365Z Vendors: RTI Products: Connext Professional Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52063
CVE ID: CVE-2024-52064 State: PUBLISHED Published: 2024-12-13T10:21:58.790Z Last Updated: 2025-02-07T21:49:10.582Z Vendors: RTI Products: Connext Professional Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52064
CVE ID: CVE-2024-52065 State: PUBLISHED Published: 2024-12-13T10:22:34.728Z Last Updated: 2025-02-07T21:49:18.883Z Vendors: RTI Products: Connext Professional Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52065
CVE ID: CVE-2024-52066 State: PUBLISHED Published: 2024-12-13T10:23:18.645Z Last Updated: 2025-02-06T17:45:36.007Z Vendors: RTI Products: Connext Professional Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2024-52066
CVE ID: CVE-2024-52067 State: PUBLISHED Published: 2024-11-21T09:28:43.910Z Last Updated: 2024-11-21T15:37:48.210Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: CWE-532 Description: Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments
log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments of Apache NiFi with the default Logback configuration do not log Parameter Context values. Upgrading to Apache NiFi 2.0.0 or 1.28.1 is the recommendation mitigation, eliminating Parameter value logging from the flow synchronization process regardless of the Logback configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/9rz5rwn2zc7pfjq7ppqldqlc067tlcwd
CVE ID: CVE-2024-52268 State: PUBLISHED Published: 2024-11-13T05:49:50.361Z Last Updated: 2024-11-13T14:39:00.337Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Vektor,Inc. Products: VK All in One Expansion Unit Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing the web site using the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vektor-inc.co.jp/en/update/regarding-vulnerabilities-in-vk-all-in-one-expansion-unit-vers
ichment: References: - https://vektor-inc.co.jp/en/update/regarding-vulnerabilities-in-vk-all-in-one-expansion-unit-version-9-100-0-and-earlier/ - https://jvn.jp/en/jp/JVN05136799/
CVE ID: CVE-2024-52269 State: PUBLISHED Published: 2024-12-04T11:25:45.886Z Last Updated: 2025-01-06T17:39:56.341Z Vendors: DocuSign Products: DocuSign Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user. For reference see: CVE-2024-52276 This issue affects DocuSign: through 2024-12-04. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories - https://www.loom.com/share/65ce5423d2a04e0bbd2688a178d5427f
CVE ID: CVE-2024-52270 State: PUBLISHED Published: 2024-12-05T10:55:30.071Z Last Updated: 2024-12-05T16:52:35.673Z Vendors: DropBox(HelloSign) Products: DropBox Sign Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DropBox Sign(HelloSign): through 2024-12-04. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories
: through 2024-12-04. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories - https://www.loom.com/share/48f63594e14c49e19840ad9cb7d60453?sid=816c6afa-0b67-4b0b-98ff-d5c58d464038 - https://new.space/s/ZuHoujvkjdzfY7Uihah7Yg#SKWLU_g2Cihfj4qsq9XNy6F4saxVAzD876PujiDOYfs - https://drive.proton.me/urls/Z6DHXNRZQC#jkfO38rjOiOj - https://sign.dropbox.com/ - https://app.hellosign.com/
CVE ID: CVE-2024-52271 State: PUBLISHED Published: 2024-12-05T13:56:08.185Z Last Updated: 2024-12-05T16:53:23.959Z Vendors: Documenso Products: Documenso, Documenso SaaS (Hosted) Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects Documenso: through 1.8.0, >1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
>1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories - https://github.com/documenso/documenso - https://www.documenso.com/ - https://github.com/documenso/documenso/issues/1512
CVE ID: CVE-2024-52272 State: PUBLISHED Published: 2024-12-04T10:18:05.774Z Last Updated: 2024-12-04T21:03:30.238Z Vendors: Shenzhen Tenda Technology Co Products: Tenda AC6V2 Problem Types: CWE-121 Description: Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromAdvSetLanip(overflow arg:lanMask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories
CVE ID: CVE-2024-52273 State: PUBLISHED Published: 2024-12-04T10:19:27.926Z Last Updated: 2024-12-04T21:03:11.511Z Vendors: Shenzhen Tenda Technology Co Products: Tenda AC6V2 Problem Types: CWE-121 Description: Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoublePppoeConfig->guest_ip_check(overflow arg: mask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories
CVE ID: CVE-2024-52274 State: PUBLISHED Published: 2024-12-04T10:19:57.657Z Last Updated: 2024-12-04T21:02:57.748Z Vendors: Shenzhen Tenda Technology Co Products: Tenda AC6V2 Problem Types: CWE-121 Description: Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoubleL2tpConfig->guest_ip_check(overflow arg: mask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories
CVE ID: CVE-2024-52275 State: PUBLISHED Published: 2024-12-04T10:20:15.778Z Last Updated: 2024-12-04T21:02:19.667Z Vendors: Shenzhen Tenda Technology Co Products: Tenda AC6V2 Problem Types: CWE-121 Description: Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromWizardHandle modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories - https://www.tendacn.com/download/detail-3316.html - https://www.tendacn.com/download/detail-3794.html
CVE ID: CVE-2024-52276 State: PUBLISHED Published: 2024-12-04T10:13:06.765Z Last Updated: 2025-01-06T17:41:35.365Z Vendors: DocuSign Products: DocuSign Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. 1. Displayed version does not show the layer flattened version, which is provided when the "Print" option is used. 2. Displayed version does not show the layer flattened version, which is provided when the combined download option is used. 3. Displayed version does not show the layer flattened version, which is also the provided version when downloading the result in the uncombined option. Once d
layer flattened version, which is also the provided version when downloading the result in the uncombined option. Once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DocuSign: through 2024-12-04. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories - https://www.loom.com/share/65ce5423d2a04e0bbd2688a178d5427f - https://new.space/s/3SG3wQxTSg7lq-vLzUjy-Q#mmrg4t0wMThwTqs9nogVHdLAjMFlkgFnKHn_Q8u9cCs - https://drive.proton.me/urls/QD7Z493XX4#Yn3eKAjuZA5m
CVE ID: CVE-2024-52277 State: PUBLISHED Published: 2024-12-04T10:16:26.509Z Last Updated: 2024-12-05T16:50:47.391Z Vendors: DocuSeal Products: DocuSeal Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DocuSeal: through 1.8.1, >1.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories - https://github.com/docusealco/docuseal
otes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories - https://github.com/docusealco/docuseal - https://docuseal.com/ - https://docuseal.eu/
CVE ID: CVE-2024-52278 State: REJECTED Published: 2024-12-04T11:15:02.871Z Last Updated: 2024-12-04T11:40:15.716Z Description: No description available.
CVE ID: CVE-2024-52279 State: PUBLISHED Published: 2025-08-03T10:02:05.153Z Last Updated: 2025-11-04T21:09:03.247Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4838 - https://issues.apache.org/jira/browse/ZEPPELIN-6095 - https://ww
ences: - https://github.com/apache/zeppelin/pull/4838 - https://issues.apache.org/jira/browse/ZEPPELIN-6095 - https://www.cve.org/CVERecord?id=CVE-2024-31864 - https://lists.apache.org/thread/dxb98vgrb21rrl3k0fzonpk66onr6o4q
CVE ID: CVE-2024-52280 State: PUBLISHED Published: 2025-04-11T11:12:44.180Z Last Updated: 2025-04-11T13:22:07.089Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SUSE Products: rancher Problem Types: CWE-200 Description: A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to access, when they have at least some generic permissions on the type. This issue affects rancher: before 2175e09, before 6e30359, before c744f0b. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52280 - https://github.com/ranc
CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52280 - https://github.com/rancher/steve/security/advisories/GHSA-j5hq-5jcr-xwx7
CVE ID: CVE-2024-52281 State: PUBLISHED Published: 2025-04-16T08:31:11.378Z Last Updated: 2025-04-18T03:55:42.362Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: SUSE Products: rancher Problem Types: CWE-79 Description: A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52281 - https://github.com/rancher/rancher/security/advisories/GHSA-2v2w-8v8c-wcm9
CVE ID: CVE-2024-52282 State: PUBLISHED Published: 2025-04-11T10:57:55.420Z Last Updated: 2025-04-11T13:24:10.230Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: SUSE Products: rancher Problem Types: CWE-200 Description: A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Catalog to read any sensitive information that are contained within the Apps’ values. Additionally, the same information leaks into auditing logs when the audit level is set to equal or above 2. This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4. Additional Analy
set to equal or above 2. This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52282 - https://github.com/rancher/rancher/security/advisories/GHSA-9c5p-35gj-jqp4
CVE ID: CVE-2024-52283 State: PUBLISHED Published: 2024-11-28T09:07:45.917Z Last Updated: 2024-11-28T12:25:17.261Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: SUSE Products: hackweek Problem Types: CWE-79 Description: Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain project Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52283
CVE ID: CVE-2024-52284 State: PUBLISHED Published: 2025-09-02T11:49:49.379Z Last Updated: 2025-09-02T13:31:49.988Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SUSE Products: Rancher Problem Types: CWE-312 Description: Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52284 - https://github.com/advisories/GHSA-6h9x-9j5v-7w9h
CVE ID: CVE-2024-52285 State: PUBLISHED Published: 2025-03-11T09:47:58.676Z Last Updated: 2025-03-11T14:07:41.226Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Siemens Products: SiPass integrated AC5102 (ACC-G2), SiPass integrated ACC-AP Problem Types: CWE-306 Description: A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.8), SiPass integrated ACC-AP (All versions < V6.4.8). Affected devices expose several MQTT URLs without authentication. This could allow an unauthenticated remote attacker to access sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/
access sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-515903.html
CVE ID: CVE-2024-52286 State: PUBLISHED Published: 2024-11-11T19:14:47.330Z Last Updated: 2025-01-09T14:29:29.689Z Vendors: Stirling-Tools Products: Stirling-PDF Problem Types: CWE-20, CWE-79 Description: Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The issue stems to the code starting at `Line 24` in `src/main/resources/static/js/merge.js`. The file name is directly being input into InnerHTML with no sanitization
4` in `src/main/resources/static/js/merge.js`. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags. As HTML tags can include JavaScript code, this can be used to execute JavaScript code in the context of the user. This is a self-injection style attack and relies on a user uploading the malicious file themselves and it impact only them, not other users. A user might be social engineered into running this to launch a phishing attack. Nevertheless, this breaks the expected security restrictions in place by the application. This issue has been addressed in version 0.32.0 a
breaks the expected security restrictions in place by the application. This issue has been addressed in version 0.32.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-9j55-gvf2-cqwv - https://github.com/Stirling-Tools/Stirling-PDF/commit/404e31468ec98413f1906cc7ee3d49091638c693
CVE ID: CVE-2024-52287 State: PUBLISHED Published: 2024-11-21T17:23:40.640Z Last Updated: 2024-11-21T21:05:11.287Z Vendors: goauthentik Products: authentik Problem Types: CWE-285 Description: authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-v6m7-8j37-8f4v - https://github.com/goauthentik/authentik/commit/e9c29e1644e9199b4ba58d2b10eb8c322138
ty/advisories/GHSA-v6m7-8j37-8f4v - https://github.com/goauthentik/authentik/commit/e9c29e1644e9199b4ba58d2b10eb8c322138eea2