Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-32650 State: PUBLISHED Published: 2024-04-19T16:05:44.050Z Last Updated: 2024-08-02T02:13:40.195Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: rustls Products: rustls Problem Types: CWE-835 Description: Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
rability is fixed in 0.23.5, 0.22.4, and 0.21.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj - https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d - https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e - https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e
CVE ID: CVE-2024-32651 State: PUBLISHED Published: 2024-04-25T23:49:28.540Z Last Updated: 2025-02-13T17:52:14.004Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: dgtlmoon Products: changedetection.io Problem Types: CWE-1336 Description: changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can
y could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4r7v-whpg-8rx3 - https://github.com/dgtlmoon/changedetection.io/releases/tag/0.45.21 - https://www.onsecurity.io/blog/server-side-template-injection-with-jinja2 - https://blog.hacktivesecurity.com/index.php/2024/05/08/cve-2024-32651-server-side-template-injection-changedetection-io/
CVE ID: CVE-2024-32652 State: PUBLISHED Published: 2024-04-19T18:29:42.857Z Last Updated: 2024-08-02T02:13:40.330Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: honojs Products: node-server Problem Types: CWE-755 Description: The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment:
nd other strings. The version 1.10.1 includes the fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx - https://github.com/honojs/node-server/issues/159 - https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204
CVE ID: CVE-2024-32653 State: PUBLISHED Published: 2024-04-22T22:13:47.917Z Last Updated: 2024-08-02T02:13:40.330Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) Vendors: skylot Products: jadx Problem Types: CWE-20 Description: jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary code into the package name. The vulnerability allows an attacker to execute commands with shell privileges. Version 1.5.0 contains a patch for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/skylot/jadx/security
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/skylot/jadx/security/advisories/GHSA-3pp3-hg2q-9gpm - https://github.com/skylot/jadx/blob/9114821fb12558874e01421bf38b0d34fb39df72/jadx-gui/src/main/java/jadx/gui/device/protocol/ADBDevice.java#L108-L109 - https://github.com/skylot/jadx/releases/tag/v1.5.0
CVE ID: CVE-2024-32655 State: PUBLISHED Published: 2024-05-09T14:29:14.067Z Last Updated: 2024-12-12T20:56:10.332Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: npgsql Products: npgsql Problem Types: CWE-190, CWE-89 Description: Npgsql is the .NET data provider for PostgreSQL. The `WriteBind()` method in `src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs` uses `int` variables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes too large. This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the
write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. This vulnerability is fixed in 4.0.14, 4.1.13, 5.0.18, 6.0.11, 7.0.7, and 8.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/npgsql/npgsql/security/advisories/GHSA-x9vc
ADP Vulnrichment: - CVE Program Container: References: - https://github.com/npgsql/npgsql/security/advisories/GHSA-x9vc-6hfv-hg8c - https://github.com/npgsql/npgsql/commit/091655eed0c84e502ab424950c930339d17c1928 - https://github.com/npgsql/npgsql/commit/3183efb2bdcca159c8c2e22af57e18ea8f853cf0 - https://github.com/npgsql/npgsql/commit/67acbe027e28477ac2199e15cfb554bb2ffaf169 - https://github.com/npgsql/npgsql/commit/703d9af8fa48dfe8c0180e36edb8278f34342d7b - https://github.com/npgsql/npgsql/commit/a22a42d8141d7a3528f43c02c095a409507cf1af - https://github.com/npgsql/npgsql/commit/e34e2ba8042e666d9af54a1b255fba4d5b11df56 - https://github.com/npgsql/npgsql/commit/f7e7ead0702d776a8f551f5786c4c
/commit/e34e2ba8042e666d9af54a1b255fba4d5b11df56 - https://github.com/npgsql/npgsql/commit/f7e7ead0702d776a8f551f5786c4cac2d65c4bc6 - https://github.com/npgsql/npgsql/releases/tag/v4.0.14 - https://github.com/npgsql/npgsql/releases/tag/v4.1.13 - https://github.com/npgsql/npgsql/releases/tag/v5.0.18 - https://github.com/npgsql/npgsql/releases/tag/v6.0.11 - https://github.com/npgsql/npgsql/releases/tag/v7.0.7 - https://github.com/npgsql/npgsql/releases/tag/v8.0.3 - https://www.youtube.com/watch?v=Tfg1B8u1yvE
CVE ID: CVE-2024-32656 State: PUBLISHED Published: 2024-04-22T22:16:52.424Z Last Updated: 2024-08-02T02:13:40.308Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ant-media Products: Ant-Media-Server Problem Types: CWE-862 Description: Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileged operating system user account to escalate privileges to the root user account on the system. This vulnerability arises from Ant Media Server running with Java Management Extensions (JMX) enabled and authentication disabled on localhost on port 5599/TCP. This vulnerabili
ith Java Management Extensions (JMX) enabled and authentication disabled on localhost on port 5599/TCP. This vulnerability is nearly identical to the local privilege escalation vulnerability CVE-2023-26269 identified in Apache James. Any unprivileged operating system user can connect to the JMX service running on port 5599/TCP on localhost and leverage the MLet Bean within JMX to load a remote MBean from an attacker-controlled server. This allows an attacker to execute arbitrary code within the Java process run by Ant Media Server and execute code within the context of the `antmedia` service account on the system. Version 2.9.0 contains a patch for the issue. As a workaround, one may remove
`antmedia` service account on the system. Version 2.9.0 contains a patch for the issue. As a workaround, one may remove certain parameters from the `antmedia.service` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ant-media/Ant-Media-Server/security/advisories/GHSA-qwhw-hh9j-54f5 - https://github.com/ant-media/Ant-Media-Server/commit/9cb38500729e0ff302da0290b9cfe1ec4dd6c764
CVE ID: CVE-2024-32657 State: PUBLISHED Published: 2024-04-22T22:24:06.762Z Last Updated: 2024-08-02T02:13:40.333Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: NixOS Products: hydra Problem Types: CWE-79 Description: Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving NixOS `.iso` files. The issue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14
ssue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14:30 UTC. The nixpkgs package were fixed in unstable and 23.11. Users with custom Hydra packages can apply the fix commit to their local installations. The vulnerability is only triggered when opening HTML build artifacts, so not opening them until the vulnerability is fixed works around the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx - https://github.com/NixOS/nixpkgs/pull/306017 - https://github.com/NixOS/nixpkgs/pull/306018 - https://github.com/NixOS
- https://github.com/NixOS/nixpkgs/pull/306017 - https://github.com/NixOS/nixpkgs/pull/306018 - https://github.com/NixOS/hydra/commit/b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3
CVE ID: CVE-2024-32658 State: PUBLISHED Published: 2024-04-23T17:41:21.212Z Last Updated: 2025-11-03T20:37:24.166Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v - https://github.com/FreeRDP/FreeRDP/commit/
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v - https://github.com/FreeRDP/FreeRDP/commit/1a755d898ddc028cc818d0dd9d49d5acff4c44bf - https://oss-fuzz.com/testcase-detail/4852534033317888 - https://oss-fuzz.com/testcase-detail/6196819496337408 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/
st/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE ID: CVE-2024-32659 State: PUBLISHED Published: 2024-04-23T19:40:24.919Z Last Updated: 2025-11-03T20:37:25.594Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jgr-7r33-x87w - ht
: - CISA ADP Vulnrichment: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jgr-7r33-x87w - https://github.com/FreeRDP/FreeRDP/commit/6430945ce003a5e24d454d8566f54aae1b6b617b - https://oss-fuzz.com/testcase-detail/6156779722440704 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/pa
nce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE ID: CVE-2024-32660 State: PUBLISHED Published: 2024-04-23T20:03:28.529Z Last Updated: 2025-11-03T20:37:27.005Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-770 Description: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxv6-2cw6-m3mx - https://github.c
m Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxv6-2cw6-m3mx - https://github.com/FreeRDP/FreeRDP/commit/5e5d27cf310e4c10b854be7667bfb7a5d774eb47 - https://oss-fuzz.com/testcase-detail/5559242514825216 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/package-announce
raproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE ID: CVE-2024-32661 State: PUBLISHED Published: 2024-04-23T20:05:50.310Z Last Updated: 2025-11-03T20:37:28.396Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-476 Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p5m5-342g-pv9m - https://github.com/FreeRDP/Fre
eferences: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p5m5-342g-pv9m - https://github.com/FreeRDP/FreeRDP/commit/71e463e31b4d69f4022d36bfc814592f56600793 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE ID: CVE-2024-32662 State: PUBLISHED Published: 2024-04-23T20:17:30.949Z Last Updated: 2025-02-13T17:52:17.136Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available. Additional Analyst Note
r certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vffh-j6hh-95f4 - https://github.com/FreeRDP/FreeRDP/commit/626d10a94a88565d957ddc30768ed08b320049a7 - https://oss-fuzz.com/testcase-detail/4985227207311360 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/a
t/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE ID: CVE-2024-32663 State: PUBLISHED Published: 2024-05-07T14:48:20.366Z Last Updated: 2025-11-03T19:29:48.378Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: suricata Problem Types: CWE-400, CWE-770 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount of HTTP/2 traffic can lead to Suricata using a large amount of memory. The issue has been addressed in Suricata 7.0.5 and 6.0.19. Workarounds include disabling the HTTP/2 parser and reducing `app-layer.protocols.http2.max-table-size` value (default is 65536). Additional Analy
ing the HTTP/2 parser and reducing `app-layer.protocols.http2.max-table-size` value (default is 65536). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OISF/suricata/security/advisories/GHSA-9jxm-qw9v-266r - https://github.com/OISF/suricata/commit/08d93f7c3762781b743f88f9fdc4389eb9c3eb64 - https://github.com/OISF/suricata/commit/c0af92295e833d1db29b184d63cd3b829451d7fd - https://github.com/OISF/suricata/commit/d24b37a103c04bb2667e449e080ba4c8e56bb019 - https://github.com/OISF/suricata/commit/e68ec4b227d19498f364a41eb25d3182f0383ca5 - https://redmine.openinfosecfoundation.org/issues/6892 - https://redmine.openinfosecfoundation.org/i
1eb25d3182f0383ca5 - https://redmine.openinfosecfoundation.org/issues/6892 - https://redmine.openinfosecfoundation.org/issues/6900
CVE ID: CVE-2024-32664 State: PUBLISHED Published: 2024-05-07T14:57:01.967Z Last Updated: 2024-08-02T02:13:40.336Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OISF Products: suricata Problem Types: CWE-122, CWE-120 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, specially crafted traffic or datasets can cause a limited buffer overflow. This vulnerability is fixed in 7.0.5 and 6.0.19. Workarounds include not use rules with `base64_decode` keyword with `bytes` option with value 1, 2 or 5 and for 7.0.x, setting `app-layer.protocols.smtp.mime.body-md
4_decode` keyword with `bytes` option with value 1, 2 or 5 and for 7.0.x, setting `app-layer.protocols.smtp.mime.body-md5` to false. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OISF/suricata/security/advisories/GHSA-79vh-hpwq-3jh7 - https://github.com/OISF/suricata/commit/311002baf288a225f62cf18a90c5fdd294447379 - https://github.com/OISF/suricata/commit/d5ffecf11ad2c6fe89265e518f5d7443caf26ba4
CVE ID: CVE-2024-32666 State: PUBLISHED Published: 2024-09-16T16:38:38.415Z Last Updated: 2024-09-16T17:39:55.684Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) RAID Web Console software Problem Types: denial of service, CWE-476 Description: NULL pointer dereference in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE ID: CVE-2024-32667 State: PUBLISHED Published: 2024-11-13T21:09:05.191Z Last Updated: 2024-11-14T19:43:48.497Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: n/a Products: OpenCL(TM) software Problem Types: denial of service, CWE-125 Description: Out-of-bounds read for some OpenCL(TM) software may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01163.html
CVE ID: CVE-2024-32668 State: PUBLISHED Published: 2024-09-05T04:42:25.457Z Last Updated: 2024-09-20T16:03:06.718Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-193, CWE-787 Description: An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privileged software running in a guest VM can exploit the vulnerability to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. Additional Analyst Notes: - CISA ADP Vulnrichment: -
is constrained by the capabilities available to the bhyve process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:12.bhyve.asc
CVE ID: CVE-2024-32669 State: PUBLISHED Published: 2024-05-09T06:02:53.218Z Last Updated: 2024-08-02T02:13:40.338Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Samsung Open Source Products: Escargot Problem Types: CWE-20, CWE-125, CWE-787 Description: Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the test code and does not include in the release. This issue affects escargot: 4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Samsung/escargot/pull/1326