Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-53822 State: PUBLISHED Published: 2024-12-09T12:24:36.085Z Last Updated: 2024-12-09T17:00:30.352Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Genetech Products: Pie Register Premium Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pie-register-premium/vulnerability/wordpress-pie-register-premium-plugin-3-8-3-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-53823 State: PUBLISHED Published: 2024-12-06T13:07:30.849Z Last Updated: 2024-12-06T17:29:04.701Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: POSIMYTH Products: The Plus Addons for Elementor Page Builder Lite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows DOM-Based XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.6.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-plus-addon
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-plugin-5-6-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-53824 State: PUBLISHED Published: 2024-12-06T13:05:56.133Z Last Updated: 2024-12-06T15:52:10.039Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AREOI Products: All Bootstrap Blocks Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AREOI All Bootstrap Blocks allows PHP Local File Inclusion.This issue affects All Bootstrap Blocks: from n/a through 1.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/all-bootstrap-blocks/vulnerability/wordpress-all-bootstrap-blocks-plugin-
tps://patchstack.com/database/wordpress/plugin/all-bootstrap-blocks/vulnerability/wordpress-all-bootstrap-blocks-plugin-1-3-20-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-53825 State: PUBLISHED Published: 2024-12-06T13:07:36.465Z Last Updated: 2024-12-06T15:41:17.110Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Ninja Team Products: Filebird Problem Types: CWE-862 Description: Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through 6.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/filebird/vulnerability/wordpress-filebird-lite-plugin-6-3-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-53826 State: PUBLISHED Published: 2024-12-06T13:18:31.922Z Last Updated: 2024-12-06T16:02:24.914Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WPSight Products: WPCasa Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPSight WPCasa allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPCasa: from n/a through 1.2.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpcasa/vulnerability/wordpress-wpcasa-plugin-1-2-13-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2024-53827 State: PUBLISHED Published: 2025-05-16T07:11:00.367Z Last Updated: 2025-05-16T15:29:55.177Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ericsson Products: Packet Core Controller Problem Types: CWE-20 Description: Ericsson Packet Core Controller (PCC) contains a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degradation Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/CVE-2024-53827
CVE ID: CVE-2024-53829 State: PUBLISHED Published: 2025-01-21T15:07:02.103Z Last Updated: 2025-02-12T20:41:21.042Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: Ericsson Products: CodeChecker Problem Types: CWE-352 Description: CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions, including but not limited to adding, removing or editing products. The attacker needs to know the ID of the available products to modify or delete them. The att
oving or editing products. The attacker needs to know the ID of the available products to modify or delete them. The attacker cannot directly exfiltrate data (view) from CodeChecker, due to being limited to form-based CSRF. This issue affects CodeChecker: through 6.24.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Ericsson/codechecker/security/advisories/GHSA-f8c8-4pm7-w885
CVE ID: CVE-2024-53832 State: PUBLISHED Published: 2024-12-10T13:54:14.682Z Last Updated: 2025-11-03T20:48:25.060Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: CPCI85 Central Processing/Communication Problem Types: CWE-522 Description: A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is connected via an unencrypted SPI bus. This could allow an attacker with physical access to the SPI bus to observe the password used for the secure element authentication, and then use the secure element as an oracle to decrypt all encrypted update fi
d for the secure element authentication, and then use the secure element as an oracle to decrypt all encrypted update files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-128393.html
CVE ID: CVE-2024-53833 State: PUBLISHED Published: 2025-01-03T03:28:24.450Z Last Updated: 2025-01-06T16:33:12.696Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In prepare_response_locked of lwis_transaction.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53834 State: PUBLISHED Published: 2025-01-03T03:28:24.594Z Last Updated: 2025-01-03T22:41:51.215Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In sms_DisplayHexDumpOfPrivacyBuffer of sms_Utilities.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53835 State: PUBLISHED Published: 2025-01-03T03:28:24.746Z Last Updated: 2025-01-03T22:39:38.161Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53836 State: PUBLISHED Published: 2025-01-03T03:28:24.888Z Last Updated: 2025-01-03T22:37:29.679Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In wbrc_bt_dev_write of wb_regon_coordinator.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53837 State: PUBLISHED Published: 2025-01-03T03:28:25.049Z Last Updated: 2025-01-03T22:35:43.155Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53838 State: PUBLISHED Published: 2025-01-03T03:28:25.254Z Last Updated: 2025-01-03T22:33:24.578Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53839 State: PUBLISHED Published: 2025-01-03T03:28:25.427Z Last Updated: 2025-01-03T22:29:16.422Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In GetCellInfoList() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53840 State: PUBLISHED Published: 2025-01-03T03:28:25.595Z Last Updated: 2025-01-03T22:27:18.102Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53841 State: PUBLISHED Published: 2025-01-03T03:28:25.756Z Last Updated: 2025-01-03T22:18:13.140Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53842 State: PUBLISHED Published: 2025-01-03T03:28:25.914Z Last Updated: 2025-01-03T22:11:10.157Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-53843 State: PUBLISHED Published: 2024-11-25T23:18:59.029Z Last Updated: 2024-11-26T15:41:58.741Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: DapperDuckling Products: keycloak-connector Problem Types: CWE-79 Description: @dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the authentication flow of the application. This issue arises due to improper sanitization of the URL parameters, allowing the URL bar's contents to be injected and reflected into the HTML page. An att
itization of the URL parameters, allowing the URL bar's contents to be injected and reflected into the HTML page. An attacker could craft a malicious URL to execute arbitrary JavaScript in the browser of a victim who visits the link. Any application utilizing this authentication library is vulnerable. Users of the application are at risk if they can be lured into clicking on a crafted malicious link. The vulnerability has been patched in version 2.5.5 by ensuring proper sanitization and escaping of user input in the affected URL parameters. Users are strongly encouraged to upgrade. If upgrading is not immediately possible, users can implement the following workarounds: 1. Employ a Web Applic
upgrade. If upgrading is not immediately possible, users can implement the following workarounds: 1. Employ a Web Application Firewall (WAF) to block malicious requests containing suspicious URL parameters. or 2. Apply input validation and escaping directly within the application’s middleware or reverse proxy layer, specifically targeting the affected parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DapperDuckling/keycloak-connector/security/advisories/GHSA-w5rq-g9r6-vrcg
CVE ID: CVE-2024-53844 State: PUBLISHED Published: 2024-11-26T18:37:51.909Z Last Updated: 2024-11-26T21:03:48.160Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: labsai Products: EDDI Problem Types: CWE-22 Description: E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. A path traversal vulnerability exists in the backup export functionality of EDDI, as implemented in `RestExportService.java`. This vulnerability allows an attacker to access sensitive files on the server by manipulating the `botFilename` parameter in requests. The application fails to sanitize user input, enabling malicious inputs such as `..%2f..%2
ename` parameter in requests. The application fails to sanitize user input, enabling malicious inputs such as `..%2f..%2fetc%2fpasswd` to access arbitrary files. However, the **severity of this vulnerability is significantly limited** because EDDI typically runs within a **Docker container**, which provides additional layers of isolation and restricted permissions. As a result, while this vulnerability exposes files within the container, it does not inherently threaten the underlying host system or other containers. A patch is required to sanitize and validate the botFilename input parameter. Users should ensure they are using version 5.4 which contains this patdch. For temporary mitigation,
me input parameter. Users should ensure they are using version 5.4 which contains this patdch. For temporary mitigation, access to the vulnerable endpoint should be restricted through firewall rules or authentication mechanisms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/labsai/EDDI/security/advisories/GHSA-49qh-39wc-4p8j - https://github.com/labsai/EDDI/blob/release/5.3.3/src/main/java/ai/labs/eddi/backup/impl/RestExportService.java#L95
CVE ID: CVE-2024-53845 State: PUBLISHED Published: 2024-12-11T22:35:48.528Z Last Updated: 2024-12-12T16:35:00.685Z Vendors: espressif Products: esp-idf Problem Types: CWE-327, CWE-909 Description: ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product's lifetime. In AES/CBC mode, if the IV is not properly initialized, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, t
, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, the application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. This IV is then transmitted along with the provision data to the provision device. The provision device has also been equipped with a parser for the AES IV. The upgrade is applicable for all applications and users of ESPTouch v2 component from ESP-IDF. As it is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
he application layer without upgrading the underlying firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/esp-idf/security/advisories/GHSA-wm57-466g-mhrr - https://github.com/espressif/esp-idf/commit/4f85a2726e04b737c8646d865b44ddd837b703db - https://github.com/espressif/esp-idf/commit/8fb28dcedcc49916a5206456a3a61022d4302cd8 - https://github.com/espressif/esp-idf/commit/d47ed7d6f814e21c5bc8997ab0bc68e2360e5cb2 - https://github.com/espressif/esp-idf/commit/de69895f38d563e22228f5ba23fffa02feabc3a9 - https://github.com/espressif/esp-idf/commit/fd224e83bbf133833638b277c767be7f7cdd97c7 - https://github.com/EspressifApp/EsptouchForAndroid/tree/m
ssif/esp-idf/commit/fd224e83bbf133833638b277c767be7f7cdd97c7 - https://github.com/EspressifApp/EsptouchForAndroid/tree/master/esptouch-v2 - https://github.com/EspressifApp/EsptouchForIOS/tree/master/EspTouchDemo/ESPTouchV2 - https://github.com/espressif/esp-idf/tree/master/components/esp_wifi
CVE ID: CVE-2024-53846 State: PUBLISHED Published: 2024-12-05T17:02:59.370Z Last Updated: 2024-12-06T16:26:57.528Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: erlang Products: otp Problem Types: CWE-295 Description: OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they
r client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-qw6r-qh9v-638v
CVE ID: CVE-2024-53847 State: PUBLISHED Published: 2024-12-09T18:49:37.339Z Last Updated: 2024-12-10T16:15:40.972Z Vendors: basecamp Products: trix Problem Types: CWE-79 Description: The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.9 or 1.3.3, which uses DOMPurify to sanitize the pasted co
ng disclosed. Users should upgrade to Trix editor version 2.1.9 or 1.3.3, which uses DOMPurify to sanitize the pasted content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/basecamp/trix/security/advisories/GHSA-6vx4-v2jw-qwqh - https://github.com/basecamp/trix/commit/272c7e27e722608732a67108ad3fe7870e233ac8
CVE ID: CVE-2024-53848 State: PUBLISHED Published: 2024-11-29T18:39:11.195Z Last Updated: 2024-12-02T22:20:06.647Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: python-jsonschema Products: check-jsonschema Problem Types: CWE-349 Description: check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, t
can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, they can insert their own schema into the cache and it will be picked up and used instead of the appropriate schema. Such a cache confusion attack could be used to allow data to pass validation which should have been rejected. This issue has been patched in version 0.30.0. All users are advised to upgrade. A few workarounds exist: 1. Users can use `--no-cache` to disable caching. 2. Users can use `--cache-filename` to select filenames for use in the cache, or to ensure that other usages do not overwrite the cached schema. (Note: this flag is being deprecated as part of the r
or to ensure that other usages do not overwrite the cached schema. (Note: this flag is being deprecated as part of the remediation effort.) 3. Users can explicitly download the schema before use as a local file, as in `curl -LOs https://example.org/schema.json; check-jsonschema --schemafile ./schema.json` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python-jsonschema/check-jsonschema/security/advisories/GHSA-q6mv-284r-mp36 - https://github.com/python-jsonschema/check-jsonschema/commit/c52714b85e6725b1b24516fbdedacb333b939152
CVE ID: CVE-2024-53849 State: PUBLISHED Published: 2024-11-26T23:34:58.784Z Last Updated: 2025-11-03T22:29:45.195Z Vendors: editorconfig Products: editorconfig-core-c Problem Types: CWE-121 Description: editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. T
th exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/editorconfig/editorconfig-core-c/security/advisories/GHSA-475j-wc37-6274 - https://github.com/editorconfig/editorconfig-core-c/pull/103 - https://github.com/editorconfig/editorconfig-core-c/commit/4d5518a0a4e4910c37281ab13a048d0d86999782 - https://github.com/editorconfig/editorconfig-core-c/commit/a8dd5312e08abeab95ff5656d32ed3cb85fba70b - http://editorconfig.org