Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-27261 State: PUBLISHED Published: 2024-04-12T12:13:17.338Z Last Updated: 2024-08-02T00:27:59.747Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Storage Defender Problem Types: CWE-749 Description: IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.2 could allow a privileged user to install a potentially dangerous tar file, which could give them access to subsequent systems where the package was installed. IBM X-Force ID: 283986. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7148023 - https://exchange.xforce.ibmcloud.com/vulnerabilities
ner: References: - https://www.ibm.com/support/pages/node/7148023 - https://exchange.xforce.ibmcloud.com/vulnerabilities/283986
CVE ID: CVE-2024-27263 State: PUBLISHED Published: 2025-01-28T00:10:27.595Z Last Updated: 2025-01-28T15:18:15.494Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-300 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to obtain sensitive information from the dashboard UI using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176072
CVE ID: CVE-2024-27264 State: PUBLISHED Published: 2024-05-22T19:21:55.242Z Last Updated: 2024-08-02T00:27:59.731Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: i Problem Types: 264 Permissions, Privileges, Access Controls Description: IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 284563. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7154595 - https://exchange.xforce.i
hment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7154595 - https://exchange.xforce.ibmcloud.com/vulnerabilities/284563
CVE ID: CVE-2024-27265 State: PUBLISHED Published: 2024-03-14T18:37:33.414Z Last Updated: 2024-08-02T00:27:59.755Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: IBM Products: Integration Bus for z/OS Problem Types: CWE-352 Description: IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 284564. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7140678 - https://exchange.xforce.ibmcloud.com/vulnerab
Container: References: - https://www.ibm.com/support/pages/node/7140678 - https://exchange.xforce.ibmcloud.com/vulnerabilities/284564
CVE ID: CVE-2024-27266 State: PUBLISHED Published: 2024-03-14T18:32:28.919Z Last Updated: 2024-08-02T00:28:00.241Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: Maximo Asset Management Problem Types: CWE-611 Description: IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 284566. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7141270 - https://exchange.xforce.ibmclo
: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7141270 - https://exchange.xforce.ibmcloud.com/vulnerabilities/284566
CVE ID: CVE-2024-27267 State: PUBLISHED Published: 2024-08-14T15:59:46.807Z Last Updated: 2025-09-29T17:05:49.132Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: SDK, Java Technology Edition Problem Types: CWE-362 Description: The Object Request Broker (ORB) in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 and 8.0.0.0 through 8.0.8.26 is vulnerable to remote denial of service, caused by a race condition in the management of ORB listener threads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165421
CVE ID: CVE-2024-27268 State: PUBLISHED Published: 2024-04-04T17:26:50.305Z Last Updated: 2024-08-02T00:27:59.848Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: WebSphere Application Server Liberty Problem Types: CWE-770 Description: IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 284574. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7145809 - h
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7145809 - https://exchange.xforce.ibmcloud.com/vulnerabilities/284574 - https://www.kb.cert.org/vuls/id/421644
CVE ID: CVE-2024-27269 State: PUBLISHED Published: 2024-05-10T16:58:20.964Z Last Updated: 2024-08-02T00:27:59.955Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-286 Description: IBM QRadar SIEM 7.5 could allow a privileged user to configure user management that would disclose unintended sensitive information across tenants. IBM X-Force ID: 284575. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7150684 - https://exchange.xforce.ibmcloud.com/vulnerabilities/284575
CVE ID: CVE-2024-27270 State: PUBLISHED Published: 2024-03-27T12:42:52.797Z Last Updated: 2024-08-02T00:27:59.901Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: WebSphere Application Server Liberty Problem Types: CWE-79 Description: IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7145231 - https://exchange.xforce.ibmcloud.com/vulnerabilities/
er: References: - https://www.ibm.com/support/pages/node/7145231 - https://exchange.xforce.ibmcloud.com/vulnerabilities/284576
CVE ID: CVE-2024-27273 State: PUBLISHED Published: 2024-05-07T20:17:47.250Z Last Updated: 2024-08-02T00:27:59.896Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: AIX Problem Types: CWE-266 Description: IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could potentially expose applications using Unix domain datagram sockets with SO_PEERID operation and may lead to privilege escalation. IBM X-Force ID: 284903. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7150297 - https://exchange.xforce.ibmcloud.com/vulnerabilities/284903
CVE ID: CVE-2024-27275 State: PUBLISHED Published: 2024-06-15T13:49:32.863Z Last Updated: 2025-09-29T15:04:45.978Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: i Problem Types: CWE-266 Description: IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administrator privilege can configure a physical file trigger to execute with the privileges of a user socially engineered to access the target file. The correction is to require administrator privilege to configure trigger support. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Cont
inistrator privilege to configure trigger support. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7157637
CVE ID: CVE-2024-27277 State: PUBLISHED Published: 2024-03-21T17:07:55.943Z Last Updated: 2024-08-02T00:27:59.952Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Protect Plus Server Problem Types: CWE-200 Description: The private key for the IBM Storage Protect Plus Server 10.1.0 through 10.1.16 certificate can be disclosed, undermining the security of the certificate. IBM X-Force ID: 285205. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7144861 - https://exchange.xforce.ibmcloud.com/vulnerabilities/285205
CVE ID: CVE-2024-27278 State: PUBLISHED Published: 2024-03-05T23:49:14.943Z Last Updated: 2025-03-27T14:25:32.763Z Vendors: OpenPNE Project Products: OpenPNE Plugin "opTimelinePlugin" Problem Types: Cross-site scripting (XSS) Description: OpenPNE Plugin "opTimelinePlugin" 1.2.11 and earlier contains a cross-site scripting vulnerability. On the site which uses the affected product, when a user configures the profile with some malicious contents, an arbitrary script may be executed on the web browsers of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://www.openpne.jp/archives/13458/ - https://jvn.jp/en/jp/JVN78084105/
CVE ID: CVE-2024-27279 State: PUBLISHED Published: 2024-03-12T08:19:48.705Z Last Updated: 2024-10-31T18:12:32.261Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series, a-blog cms Ver.2.11.x series, a-blog cms Ver.2.10.x series, a-blog cms Problem Types: Directory traversal Description: Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with editor or higher privilege who can login to the product may obtain arbi
If this vulnerability is exploited, a user with editor or higher privilege who can login to the product may obtain arbitrary files on the server including password files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVN-48443978.html - https://jvn.jp/en/jp/JVN48443978/
CVE ID: CVE-2024-27280 State: PUBLISHED Published: 2024-05-08T20:51:20.388Z Last Updated: 2025-11-04T17:17:47.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
version is stringio 3.0.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/1399856 - https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/
CVE ID: CVE-2024-27281 State: PUBLISHED Published: 2024-05-08T20:56:26.427Z Last Updated: 2025-11-04T17:17:50.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rd
so possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1187477 - https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/
CVE ID: CVE-2024-27282 State: PUBLISHED Published: 2024-05-08T20:40:42.040Z Last Updated: 2025-11-04T17:17:53.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2122624 - https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/
CVE ID: CVE-2024-27283 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-27T18:51:01.835Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious files to arbitrary locations on the server on which the application is installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/VTS23-020
CVE ID: CVE-2024-27284 State: PUBLISHED Published: 2024-02-28T15:46:37.388Z Last Updated: 2024-08-12T13:21:23.387Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Metaswitch Products: cassandra-rs Problem Types: CWE-416 Description: cassandra-rs is a Cassandra (CQL) driver for Rust. Code that attempts to use an item (e.g., a row) returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Metaswitch/cassandra-rs/security/advisorie
Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Metaswitch/cassandra-rs/security/advisories/GHSA-x9xc-63hg-vcfq - https://github.com/Metaswitch/cassandra-rs/commit/ae054dc8044eac9c2c7ae2b1ab154b53ca7f8df7
CVE ID: CVE-2024-27285 State: PUBLISHED Published: 2024-02-28T19:22:15.026Z Last Updated: 2025-02-13T17:46:21.796Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: lsegal Products: yard Problem Types: CWE-79 Description: YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lsegal/yard/security/advisories/
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc - https://github.com/lsegal/yard/pull/1538 - https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa - https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml - https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/
CVE ID: CVE-2024-27286 State: PUBLISHED Published: 2024-03-20T19:35:59.164Z Last Updated: 2025-03-31T16:30:29.284Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: zulip Products: zulip Problem Types: CWE-200 Description: Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, move only subsequent messages as well, or move just a single message. If the user chose to just move one message, and was moving it from a public stream to a private stream, Zulip would successfully move the message, -- but active users who did not have access to the private stream, but whose client had
successfully move the message, -- but active users who did not have access to the private stream, but whose client had already received the message, would continue to see the message in the public stream until they reloaded their client. Additionally, Zulip did not remove view permissions on the message from recently-active users, allowing the message to show up in the "All messages" view or in search results, but not in "Inbox" or "Recent conversations" views. While the bug has been present since moving messages between streams was first introduced in version 3.0, this option became much more common starting in Zulip 8.0, when the default option in the picker for moving the very last messa
tion became much more common starting in Zulip 8.0, when the default option in the picker for moving the very last message in a conversation was changed. This issue is fixed in Zulip Server 8.3. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zulip/zulip/security/advisories/GHSA-478x-rfqr-w4jf - https://github.com/zulip/zulip/commit/3db1733310ddd944c2e690ba673232345c928eec
CVE ID: CVE-2024-27287 State: PUBLISHED Published: 2024-03-06T18:19:48.117Z Last Updated: 2024-08-26T14:04:49.512Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: esphome Products: esphome Problem Types: CWE-79 Description: ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with `Content-Type: text/html; charset=UTF-8`, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session
e: text/html; charset=UTF-8`, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page` /edit?configuration=[xss file]`. Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards. In
user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards. In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values. Version 2024.2.2 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/esphome/esphome/security/advisories/GHSA-9p43-hj5j-96h5 - https://github.com/esphome/esphome/commit/37d2b3c7977a4ccbec59726ca7549cb776661455
CVE ID: CVE-2024-27288 State: PUBLISHED Published: 2024-03-06T18:23:50.053Z Last Updated: 2024-08-27T16:52:53.993Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-863 Description: 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp - https://
ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp - https://github.com/1Panel-dev/1Panel/releases/tag/v1.10.1-lts
CVE ID: CVE-2024-27289 State: PUBLISHED Published: 2024-03-06T18:28:12.291Z Last Updated: 2025-06-12T15:45:56.361Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: jackc Products: pgx Problem Types: CWE-89 Description: pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in
aceholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a minus directly before a placeholder. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p - https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df
CVE ID: CVE-2024-27290 State: PUBLISHED Published: 2024-02-29T21:44:18.512Z Last Updated: 2024-08-05T15:06:29.373Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jhpyle Products: docassemble Problem Types: CWE-79 Description: Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The vulnerability has been patched in version 1.4.97 of the master branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jhpyle/docassemble/sec
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jhpyle/docassemble/security/advisories/GHSA-pcfx-g2j2-f6f6 - https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa
CVE ID: CVE-2024-27291 State: PUBLISHED Published: 2024-02-29T21:49:26.633Z Last Updated: 2024-08-05T17:12:17.718Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jhpyle Products: docassemble Problem Types: CWE-601 Description: Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, it is possible to create a URL that acts as an open redirect. The vulnerability has been patched in version 1.4.97 of the master branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jhpyle/docassemble/security/advisories/GHSA-7wxf-r2qv-9xwr - https://github.com/jhpyle/docassemble
- https://github.com/jhpyle/docassemble/security/advisories/GHSA-7wxf-r2qv-9xwr - https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa