Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7744 State: PUBLISHED Published: 2024-08-28T16:30:14.787Z Last Updated: 2024-08-28T17:50:10.933Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Progress Software Corporation Products: WS_FTP Server Problem Types: CWE-22, CWE-73 Description: In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal. An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary fol
ad flaw has been identified where a user can craft an API call that allows them to download a file from an arbitrary folder on the drive where that user host's root folder is located (by default this is C:) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024 - https://www.progress.com/ftp-server
CVE ID: CVE-2024-7745 State: PUBLISHED Published: 2024-08-28T16:31:03.604Z Last Updated: 2024-08-28T17:43:13.099Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Progress Software Corporation Products: WS_FTP Server Problem Types: CWE-304, CWE-290 Description: In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024 - https://www.progress.com/ftp-
ences: - https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024 - https://www.progress.com/ftp-server
CVE ID: CVE-2024-7746 State: PUBLISHED Published: 2024-08-13T15:14:31.171Z Last Updated: 2025-10-12T12:59:18.959Z Vendors: Traccar Products: Server Problem Types: CWE-1392 Description: Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by the authentication mechanism. These transactions could have an impact on any sensitive aspect of the platform, including Confidentiality, Integrity and Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://asrg.io/security-a
Integrity and Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://asrg.io/security-advisories/cve-2024-7746/
CVE ID: CVE-2024-7747 State: PUBLISHED Published: 2024-11-28T12:54:10.225Z Last Updated: 2024-11-29T16:36:15.279Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: subratamal Products: Wallet for WooCommerce Problem Types: CWE-681 Description: The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when transferring funds to another user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create funds during a transfer and distribute these funds to any number of other users or their o
l access and above, to create funds during a transfer and distribute these funds to any number of other users or their own account, rendering products free. Attackers could also request to withdraw funds if the Wallet Withdrawal extension is used and the request is approved by an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd8f3eb7-ac60-46c4-b41f-5d89e3133042?source=cve - https://plugins.trac.wordpress.org/browser/woo-wallet/trunk/includes/class-woo-wallet-frontend.php#L407 - https://plugins.trac.wordpress.org/changeset/3145131/
CVE ID: CVE-2024-7748 State: PUBLISHED Published: 2024-08-13T21:31:03.881Z Last Updated: 2024-08-14T20:17:35.781Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Accounts Manager App Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Accounts Manager App 1.0. This issue affects some unknown processing of the file /endpoint/delete-account.php. The manipulation of the argument account leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274367 - https://vuldb.com/?ctiid.274367 - https://vuldb.com/?submit.389358 - https://github.com/joinia/webray.com.cn/blob/main/Accounts-Manager-App/Accounts-Manager-Appsql.md
CVE ID: CVE-2024-7749 State: PUBLISHED Published: 2024-08-13T22:00:05.975Z Last Updated: 2024-08-14T13:40:47.761Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Accounts Manager App Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Accounts Manager App 1.0. Affected is an unknown function of the file /endpoint/add-account.php. The manipulation of the argument account_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274368 - https://vuldb.com/?ctiid.274368 - https://vuldb.com/?submit.389359 - https://github.com/joinia/webray.com.cn/blob/main/Accounts-Manager-App/Accounts-Manager-Appxss.md
CVE ID: CVE-2024-7750 State: PUBLISHED Published: 2024-08-13T22:31:03.908Z Last Updated: 2024-08-14T13:33:10.155Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /medicines.php. The manipulation of the argument medicine_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274369 - https://vuldb.com/?ctiid.274369 - https://vuldb.com/?submit.389293 - https://github.com/Wsstiger/cve/blob/main/Clinic's_sql.md
CVE ID: CVE-2024-7751 State: PUBLISHED Published: 2024-08-13T23:00:05.009Z Last Updated: 2024-08-15T14:16:29.797Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /update_medicine.php. The manipulation of the argument hidden_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
t has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274370 - https://vuldb.com/?ctiid.274370 - https://vuldb.com/?submit.389295 - https://github.com/Wsstiger/cve/blob/main/Clinic's_sql2.md
CVE ID: CVE-2024-7752 State: PUBLISHED Published: 2024-08-13T23:31:04.364Z Last Updated: 2024-08-14T13:37:18.924Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /update_medicine.php. The manipulation of the argument medicine_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274371 - https://vuldb.com/?ctiid.274371 - https://vuldb.com/?submit.389305 - https://github.com/Wsstiger/cve/blob/main/Clinic's_xss.md
CVE ID: CVE-2024-7753 State: PUBLISHED Published: 2024-08-14T00:00:05.562Z Last Updated: 2024-08-14T13:55:21.437Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-425 Description: A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user_images/. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274372 - https://vuldb.com/?ctiid.274372 - https://vuldb.com/?submit.389361 - https://github.com/Wsstiger/cve/blob/main/Clinic's_Directory.md
CVE ID: CVE-2024-7754 State: PUBLISHED Published: 2024-08-14T00:00:07.200Z Last Updated: 2024-08-16T14:37:22.074Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/check_medicine_name.php. The manipulation of the argument user_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274373 - https://vuldb.com/?ctiid.274373 - https://vuldb.com/?submit.389367 - https://github.com/Wsstiger/cve/blob/main/Clinic's_sql3.md
CVE ID: CVE-2024-7755 State: PUBLISHED Published: 2024-10-17T18:13:52.552Z Last Updated: 2024-10-17T19:22:56.932Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: HMS Networks Products: EWON FLEXY 202 Problem Types: CWE-522 Description: The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-04
CVE ID: CVE-2024-7756 State: PUBLISHED Published: 2024-09-13T17:26:58.798Z Last Updated: 2024-09-16T17:51:12.837Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: 10w (Type 82ST, 82SU) Laptop (Lenovo) BIOS, L390 (type 20NR, 20NS) Laptops (ThinkPad) BIOS, L390 Yoga (type 20NT, 20NU) Laptops (ThinkPad) BIOS Problem Types: CWE-489 Description: A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges by accessing an embedded UEFI shell. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-165524
CVE ID: CVE-2024-7757 State: REJECTED Published: N/A Last Updated: 2024-08-21T08:42:20.225Z Description: No description available.
CVE ID: CVE-2024-7758 State: PUBLISHED Published: 2025-05-15T20:07:11.190Z Last Updated: 2025-05-17T03:36:57.874Z Vendors: Unknown Products: Stylish Price List Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0bf39a29-a605-407b-9ab0-a82437d16153/
CVE ID: CVE-2024-7759 State: PUBLISHED Published: 2025-05-15T20:07:11.389Z Last Updated: 2025-05-17T03:35:35.915Z Vendors: Unknown Products: PWA for WP Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6e495b39-f9ef-45dd-b839-65c71a082f2b/
CVE ID: CVE-2024-7760 State: PUBLISHED Published: 2025-03-20T10:09:04.131Z Last Updated: 2025-03-20T18:58:57.731Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-352 Description: aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write. Additional A
r existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/2038df5f-4829-4040-8573-67bf9bb89229
CVE ID: CVE-2024-7761 State: PUBLISHED Published: 2025-05-15T20:07:11.580Z Last Updated: 2025-05-17T03:33:50.132Z Vendors: Unknown Products: Simple Job Board Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ae8c1c91-3574-4da5-b5dc-d4e3feccac7e/
CVE ID: CVE-2024-7762 State: PUBLISHED Published: 2025-05-15T20:07:11.769Z Last Updated: 2025-08-29T14:56:24.764Z Vendors: Unknown Products: Simple Job Board Problem Types: CWE-548 Exposure of Information Through Directory Listing Description: The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/26403e72-c927-4649-b789-694a10ad0492/
CVE ID: CVE-2024-7763 State: PUBLISHED Published: 2024-10-24T20:11:50.614Z Last Updated: 2024-10-29T03:55:09.900Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-287 Description: In WhatsUp Gold versions released before 2024.0.0, an Authentication Bypass issue exists which allows an attacker to obtain encrypted user credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024
CVE ID: CVE-2024-7764 State: PUBLISHED Published: 2025-03-20T10:11:35.662Z Last Updated: 2025-03-20T13:43:43.656Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: vanna-ai Products: vanna-ai/vanna Problem Types: CWE-89 Description: Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection against injecting additional SQL commands from user requests. The vulnerability occurs when the `generate_sql` function calls `extract_sql` with the LLM response. An attacker can include a semi-colon between a search data field and their own command, causing the `extract_sql` function to remove all LLM generated SQL and execute the attacker's command if it
wn command, causing the `extract_sql` function to remove all LLM generated SQL and execute the attacker's command if it passes the `is_sql_valid` function. This allows the execution of user-defined SQL beyond the expected boundaries, notably the trained schema. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/85d403b1-fbed-42e9-9ec1-2f79abf6eb0f
CVE ID: CVE-2024-7765 State: PUBLISHED Published: 2025-03-20T10:08:46.654Z Last Updated: 2025-03-20T14:29:59.997Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-409 Description: In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://h
a, leading to significant data amplification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0e58b1a5-bdca-4e60-af92-09de9c76a9ff
CVE ID: CVE-2024-7766 State: PUBLISHED Published: 2024-09-12T06:00:04.494Z Last Updated: 2024-09-12T18:37:19.831Z Vendors: Unknown Products: Adicon Server Problem Types: CWE-89 SQL Injection Description: The Adicon Server WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ca4d629e-ab55-4e5d-80c9-fddbc9c97259/
CVE ID: CVE-2024-7767 State: PUBLISHED Published: 2025-03-20T10:11:20.256Z Last Updated: 2025-10-15T12:49:51.871Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-862 Description: An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1425dad
mpliance violations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1425dada-72d8-4bd9-a3e7-2863bb3e1a6c
CVE ID: CVE-2024-7768 State: PUBLISHED Published: 2025-03-20T10:10:48.544Z Last Updated: 2025-10-15T12:49:52.281Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-770 Description: A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
queue and leaving the server unable to handle other requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6
CVE ID: CVE-2024-7769 State: PUBLISHED Published: 2025-05-15T20:07:11.967Z Last Updated: 2025-05-17T03:27:32.204Z Vendors: Unknown Products: ClickSold IDX Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/198252c2-834b-401b-98a5-2f59910d67bc/
CVE ID: CVE-2024-7770 State: PUBLISHED Published: 2024-09-10T10:59:05.034Z Last Updated: 2024-09-10T13:25:39.611Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: bitpressadmin Products: Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress Problem Types: CWE-434 Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 6.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted
ncluding, 6.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted upload permissions by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9cae7702-e531-45b9-9131-42edbc073a07?source=cve - https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Http/Controllers/FileManagerController.php#L26 - https://plugins.trac.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinderConnector.class.php#L160 - https://plugins.trac.word
.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinderConnector.class.php#L160 - https://plugins.trac.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinder.class.php#L1210 - https://plugins.trac.wordpress.org/browser/file-manager/trunk/libs/elFinder/php/elFinder.class.php#L3257 - https://plugins.trac.wordpress.org/changeset/3138710/
CVE ID: CVE-2024-7771 State: PUBLISHED Published: 2025-03-20T10:08:49.536Z Last Updated: 2025-03-20T19:02:21.737Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-400 Description: A vulnerability in the Dockerized version of mintplex-labs/anything-llm (latest, digest 1d9452da2b92) allows for a denial of service. Uploading an audio file with a very low sample rate causes the functionality responsible for transcribing it to crash the entire site instance. The issue arises from the localWhisper implementation, where resampling the audio file from 1 Hz to 16000 Hz quickly exceeds available memo
om the localWhisper implementation, where resampling the audio file from 1 Hz to 16000 Hz quickly exceeds available memory, leading to the Docker instance being killed by the instance manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a31a9834-e9c4-4b50-a1ec-ecb69f2a6142 - https://github.com/mintplex-labs/anything-llm/commit/dd017c6cbbf42abdef7861a66558c53b66424d07