Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-54125 State: PUBLISHED Published: 2024-12-17T05:36:50.078Z Last Updated: 2024-12-17T14:59:39.736Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SHUEISHA INC. Products: "Shonen Jump+" App for Android Problem Types: CWE-939 Description: Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shonenjumpplus.com/article/info20241216 - https://jvn.jp/en/jp/JVN084
es: - CISA ADP Vulnrichment: References: - https://shonenjumpplus.com/article/info20241216 - https://jvn.jp/en/jp/JVN08430039/
CVE ID: CVE-2024-54126 State: PUBLISHED Published: 2024-12-05T12:14:41.814Z Last Updated: 2024-12-05T16:37:56.782Z Vendors: TP-Link Products: Archer C50 Wireless Router Problem Types: CWE-494, CWE-347 Description: This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicious firmware which could lead to complete compromise of the targeted device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid
evice. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0354
CVE ID: CVE-2024-54127 State: PUBLISHED Published: 2024-12-05T12:19:24.519Z Last Updated: 2024-12-05T15:55:53.552Z Vendors: TP-Link Products: Archer C50 Wireless Router Problem Types: CWE-312 Description: This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the UART shell on the vulnerable device. Successful exploitation of this vulnerability could allow the attacker to obtain Wi-Fi credentials of the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0354
CVE ID: CVE-2024-54128 State: PUBLISHED Published: 2024-12-05T16:55:53.434Z Last Updated: 2024-12-06T15:56:34.323Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-80 Description: Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
n. This vulerability is fixed in 10.13.4 and 11.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f
CVE ID: CVE-2024-54129 State: PUBLISHED Published: 2024-12-05T15:13:53.901Z Last Updated: 2024-12-09T20:30:23.752Z Vendors: nasa-jpl Products: ION-DTN Problem Types: CWE-665 Description: The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vulnerability exists in the version ION-DTN BPv7 implementation version 4.1.3 when receiving a bundle with an improper reference to the imc scheme with valid Service-Specific Part (SSP) in their Previous Node Block. The vulnerability can cause ION to become unresponsive. This vulnerability is fixed in 4.1.3s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/
s vulnerability is fixed in 4.1.3s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-393w-w6jh-pq3j
CVE ID: CVE-2024-54130 State: PUBLISHED Published: 2024-12-05T15:10:37.229Z Last Updated: 2024-12-05T17:24:37.371Z Vendors: nasa-jpl Products: ION-DTN Problem Types: CWE-476 Description: The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A segmentation fault occurs with ION-DTN BPv7 software version 4.1.3 when a bundle with a Destination Endpoint ID (EID) set to dtn:none is received. This causes the node to become unresponsive to incoming bundles, leading to a Denial of Service (DoS) condition. This vulnerability is fixed in 4.1.3s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa-jpl/ION
ity is fixed in 4.1.3s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-7pj7-hfwv-q3v6
CVE ID: CVE-2024-54131 State: PUBLISHED Published: 2024-12-03T20:26:00.413Z Last Updated: 2024-12-03T21:59:03.677Z Vendors: kolide Products: launcher Problem Types: CWE-276, CWE-456 Description: The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started storing upgraded binaries in the ProgramData directory. This move to the new directory meant the launcher root directory inherited default permissions that are not as strict as the previous location. Th
tory meant the launcher root directory inherited default permissions that are not as strict as the previous location. These incorrect default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place an arbitrary DLL into the osqueryd process's search path. Under some circumstances, this DLL will be executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to escalate their privileges to SYSTEM. Impacted versions include versions >= 1.5.3 and the fix has been released in 1.12.3. Additional Analyst Notes: - CISA
M. Impacted versions include versions >= 1.5.3 and the fix has been released in 1.12.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kolide/launcher/security/advisories/GHSA-66q9-2rvx-qfj5 - https://github.com/kolide/launcher/pull/1510
CVE ID: CVE-2024-54132 State: PUBLISHED Published: 2024-12-04T15:29:07.426Z Last Updated: 2024-12-04T21:40:02.517Z Vendors: cli Products: cli Problem Types: CWE-22 Description: The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within
-dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cli/cli/security/advisories/GHSA-2m9h-r57g-45pj - https://github.com/cli/cli/commit/1136764c369aaf0cae4ec2ee09dc35d871076932
CVE ID: CVE-2024-54133 State: PUBLISHED Published: 2024-12-10T22:52:04.633Z Last Updated: 2025-03-07T00:10:45.315Z Vendors: rails Products: rails Problem Types: CWE-79 Description: Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its p
efully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v - https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49 - https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a - https://github.com/r
644f037bbb7c6c49 - https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a - https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542 - https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d
CVE ID: CVE-2024-54134 State: PUBLISHED Published: 2024-12-04T15:20:54.084Z Last Updated: 2024-12-04T21:40:13.670Z Vendors: solana-labs Products: solana-web3.js Problem Types: CWE-200 Description: A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots, that handle private keys directly. This issue should not affect non-custodial wallets, as they generally do not expose private keys during transactions. This is not an issue with the Solana protocol itsel
s, as they generally do not expose private keys during transactions. This is not an issue with the Solana protocol itself, but with a specific JavaScript client library and only appears to affect projects that directly handle private keys and that updated within the window of 3:20pm UTC and 8:25pm UTC on Tuesday, December 3, 2024. These two unauthorized versions (1.95.6 and 1.95.7) were caught within hours and have since been unpublished. All Solana app developers should upgrade to version 1.95.8. Developers that suspect they might be compromised should rotate any suspect authority keys, including multisigs, program authorities, server keypairs, and so on. Additional Analyst Notes: - CISA AD
uthority keys, including multisigs, program authorities, server keypairs, and so on. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5
CVE ID: CVE-2024-54135 State: PUBLISHED Published: 2024-12-06T15:11:04.933Z Last Updated: 2024-12-06T15:46:40.873Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MacWarrior Products: clipbucket-v5 Problem Types: CWE-502 Description: ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/photo_upload.php within the decode_key function. User inputs were supplied to this function without sanitization via collection GET parameter and photoIDS POST parameter respectively. The decode_key function invokes PHP unseria
ation via collection GET parameter and photoIDS POST parameter respectively. The decode_key function invokes PHP unserialize function as defined in upload/includes/classes/photos.class.php. As a result, it is possible for an adversary to inject maliciously crafted PHP serialized object and utilize gadget chains to cause unexpected behaviors of the application. This vulnerability is fixed in 5.5.1 Revision 200. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-4523-mqmv-wrqx - https://github.com/MacWarrior/clipbucket-v5/commit/76a829c088f0813ab3244a3bd0036111017409b0
CVE ID: CVE-2024-54136 State: PUBLISHED Published: 2024-12-06T15:07:42.039Z Last Updated: 2024-12-06T17:09:25.335Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MacWarrior Products: clipbucket-v5 Problem Types: CWE-502 Description: ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to unserialize function. As a result, it is possible for an adversary to inject maliciously crafted PHP serialized object and utilize gadget c
n. As a result, it is possible for an adversary to inject maliciously crafted PHP serialized object and utilize gadget chains to cause unexpected behaviors of the application. This vulnerability is fixed in 5.5.1 Revision 200. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-vxvf-5cmq-5f78 - https://github.com/MacWarrior/clipbucket-v5/commit/76a829c088f0813ab3244a3bd0036111017409b0
CVE ID: CVE-2024-54137 State: PUBLISHED Published: 2024-12-06T16:00:58.061Z Last Updated: 2024-12-10T16:10:59.900Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: open-quantum-safe Products: liboqs Problem Types: CWE-200 Description: liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a m
data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext. This vulnerability is fixed in 0.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7 - https://github.com/open-quantum-safe/liboqs/commit/cce1bfde4e52c524b087b9687020d283fbde0f24
CVE ID: CVE-2024-54138 State: PUBLISHED Published: 2024-12-06T21:56:49.040Z Last Updated: 2024-12-10T14:38:58.829Z Vendors: NuGet Products: NuGetGallery Problem Types: CWE-79 Description: NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. This vulnerability is fixed in 2024.12.06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/
lnerability is fixed in 2024.12.06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-x448-p234-x5p8 - https://github.com/NuGet/NuGetGallery/pull/10296
CVE ID: CVE-2024-54139 State: PUBLISHED Published: 2024-12-13T15:59:24.978Z Last Updated: 2024-12-13T17:34:07.288Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Combodo Products: iTop Problem Types: CWE-79, CWE-352 Description: Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg
CVE ID: CVE-2024-54140 State: PUBLISHED Published: 2024-12-05T22:08:37.195Z Last Updated: 2024-12-10T14:55:08.151Z Vendors: sigstore Products: sigstore-java Problem Types: CWE-20 Description: sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify(). Currently checkpoints are only used to ensure the root hash of an inclusion proof was provided by the log in question. Failing to validate that means a bundle may provide an inclusion proof that doesn't actually correspond to
in question. Failing to validate that means a bundle may provide an inclusion proof that doesn't actually correspond to the log in question. This may eventually lead a monitor/witness being unable to detect when a compromised logs are providing different views of themselves to different clients. There are other mechanisms right now that mitigate this, such as the signed entry timestamp. Sigstore-java currently requires a valid signed entry timestamp. By correctly verifying the signed entry timestamp we can make certain assertions about the log signing the log entry (like the log was aware of the artifact signing event and signed it). Therefore the impact on clients that are not monitors/witn
e log was aware of the artifact signing event and signed it). Therefore the impact on clients that are not monitors/witnesses is very low. This vulnerability is fixed in 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sigstore/sigstore-java/security/advisories/GHSA-jp26-88mw-89qr - https://github.com/sigstore/sigstore-conformance/pull/139 - https://github.com/sigstore/sigstore-java/commit/23fb4885e6704a5df4977f7acf253a745349edf9
CVE ID: CVE-2024-54141 State: PUBLISHED Published: 2024-12-06T15:00:16.407Z Last Updated: 2024-12-06T17:12:03.413Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: thorsten Products: phpMyFAQ Problem Types: CWE-209 Description: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-vrjr-p3xp-xx2x - https://github.com/thorsten/phpMyFAQ/commit/b
s://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-vrjr-p3xp-xx2x - https://github.com/thorsten/phpMyFAQ/commit/b9289a0b2233df864361c131cd177b6715fbb0fe
CVE ID: CVE-2024-54142 State: PUBLISHED Published: 2025-01-14T22:39:49.458Z Last Updated: 2025-01-15T14:54:42.790Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: discourse Products: discourse-ai Problem Types: CWE-79 Description: Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox to said conversation. This issue has been addressed in commit `92f122c`. Users are advised to update. Users unable to update may remove all groups from `ai bot public sharing
commit `92f122c`. Users are advised to update. Users unable to update may remove all groups from `ai bot public sharing allowed groups` site setting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-ai/security/advisories/GHSA-94c2-qr2h-88jv - https://github.com/discourse/discourse-ai/commit/92f122c54d9d7ead9223a056270bff5b4c42c73f
CVE ID: CVE-2024-54143 State: PUBLISHED Published: 2024-12-06T16:14:39.169Z Last Updated: 2024-12-06T20:54:32.538Z Vendors: openwrt Products: asu Problem Types: CWE-328 Description: openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious image can be served in place of a legitimate one, allowing the attacker to "poison" the artifact cache and deliver compromised images to unsuspecting users. This can be combined with other attacks, such as a command inject
and deliver compromised images to unsuspecting users. This can be combined with other attacks, such as a command injection in Imagebuilder that allows malicious users to inject arbitrary commands into the build process, resulting in the production of malicious firmware images signed with the legitimate build key. This has been patched with 920c8a1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openwrt/asu/security/advisories/GHSA-r3gq-96h6-3v7q - https://github.com/openwrt/asu/commit/920c8a13d97b4d4095f0d939cf0aaae777e0f87e
CVE ID: CVE-2024-54145 State: PUBLISHED Published: 2025-01-27T17:04:31.839Z Last Updated: 2025-11-03T20:48:31.100Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Cacti Products: cacti Problem Types: CWE-89 Description: Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the get_discovery_results function of automation_devices.php using the network parameter. This vulnerability is fixed in 1.2.29. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-fh3x-69rr-qqpp - https://github.com/Cacti/cacti/commit/c7e4e
: - https://github.com/Cacti/cacti/security/advisories/GHSA-fh3x-69rr-qqpp - https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
CVE ID: CVE-2024-54146 State: PUBLISHED Published: 2025-01-27T17:04:16.569Z Last Updated: 2025-01-27T18:47:49.445Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-89 Description: Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. This vulnerability is fixed in 1.2.29. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-vj9g-p7f2-4wqj - https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
CVE ID: CVE-2024-54147 State: PUBLISHED Published: 2024-12-09T18:55:58.277Z Last Updated: 2024-12-10T16:10:09.765Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: altair-graphql Products: altair Problem Types: CWE-295 Description: Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-in-the-middle to intercept all requests. Any Altair users on untrusted networks (eg. public wifi, malicious DNS servers) may have all GraphQL request and response headers and bodies fully compromised including authorization tokens. The attack also allows obtaining full access