Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-24720 State: PUBLISHED Published: 2024-02-27T00:00:00.000Z Last Updated: 2025-05-30T16:02:58.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Forgot password function in Innovaphone PBX before 14r1 devices. It provides information about whether a user exists on a system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2024-24720 - https://wiki.innovaphone.com/index.php?title=Reference14r1:Release_Notes_Security#156999_-_App_Users:_Prevent_account_enumerate - https://cds.thalesgroup.com/en/tcs-cert/CVE-2024-24720
CVE ID: CVE-2024-24721 State: PUBLISHED Published: 2024-02-26T00:00:00.000Z Last Updated: 2025-05-30T16:02:59.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2024-24721 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2024-24721
CVE ID: CVE-2024-24722 State: PUBLISHED Published: 2024-02-19T00:00:00.000Z Last Updated: 2025-03-25T15:51:57.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevated privileges via the 12d Synergy Server and/or 12d Synergy File Replication Server executable service path. This is fixed in 4.3.10.192, 5.1.5.221, and 5.1.6.235. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.12dsynergy.com/security-statement/ - https://files.12dsynergy.com/downloads/download.aspx - https://help.12dsynergy.com/
12dsynergy.com/security-statement/ - https://files.12dsynergy.com/downloads/download.aspx - https://help.12dsynergy.com/v1/docs/cve-2024-24722
CVE ID: CVE-2024-24724 State: PUBLISHED Published: 2024-04-03T00:00:00 Last Updated: 2024-08-16T15:15:46.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gibbonedu.org/download/ - https://packetstormsecurity.com/files/177857
CVE ID: CVE-2024-24725 State: PUBLISHED Published: 2024-03-23T00:00:00 Last Updated: 2024-08-27T17:18:28.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gibbonedu.org/download/ - https://www.exploit-db.com/exploits/51903
CVE ID: CVE-2024-24731 State: PUBLISHED Published: 2025-01-30T23:25:00.944Z Last Updated: 2025-08-27T15:37:51.986Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Silicon Labs Products: Gecko OS Problem Types: CWE-120 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the http_download command. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this
alidation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-870/ - https://community.silabs.com/a45Vm0000000Atp
CVE ID: CVE-2024-24736 State: PUBLISHED Published: 2024-01-29T00:00:00.000Z Last Updated: 2025-06-20T19:48:38.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related issue to CVE-2004-1558. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/176784/YahooPOPs-1.6-Denial-Of-Service.html
CVE ID: CVE-2024-24739 State: PUBLISHED Published: 2024-02-13T02:34:17.247Z Last Updated: 2025-05-09T18:29:09.737Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP BAM (Bank Account Management) Problem Types: CWE-862 Description: SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result in escalation of privileges with low impact on confidentiality, integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/2637727 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca
nrichment: References: - https://me.sap.com/notes/2637727 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-24740 State: PUBLISHED Published: 2024-02-13T02:35:21.224Z Last Updated: 2025-05-09T18:29:28.460Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP (SAP Kernel) Problem Types: CWE-732 Description: SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain conditions, allows an attacker to access information which could otherwise be restricted with low impact on confidentiality of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
confidentiality of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3360827 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-24741 State: PUBLISHED Published: 2024-02-13T03:43:14.238Z Last Updated: 2024-08-01T23:28:12.084Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Master Data Governance Material Problem Types: CWE-862 Description: SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read some sensitive information but no impact to integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References
ct to integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/2897391 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-24742 State: PUBLISHED Published: 2024-02-13T02:42:56.483Z Last Updated: 2024-08-01T23:28:12.196Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP CRM (WebClient UI) Problem Types: CWE-79 Description: SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to integrity of the application data after successful exploitation. There is no impact
ivileges can cause limited impact to integrity of the application data after successful exploitation. There is no impact on confidentiality and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3158455 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-24743 State: PUBLISHED Published: 2024-02-13T02:43:40.755Z Last Updated: 2024-11-07T19:10:20.078Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS Java (Guided Procedures) Problem Types: CWE-611 Description: SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
place so that availability is not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3426111 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-24746 State: PUBLISHED Published: 2024-04-06T11:56:07.232Z Last Updated: 2025-02-13T17:40:20.471Z Vendors: Apache Software Foundation Products: Apache NimBLE Problem Types: CWE-835 Description: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device. This issue affects Apache NimBLE: through 1.6.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/bptkzc0o2ymjk8qqzqdmy39kcm
CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/bptkzc0o2ymjk8qqzqdmy39kcmh27078 - https://github.com/apache/mynewt-nimble/commit/d42a0ebe6632bd0c318560e4293a522634f60594 - http://www.openwall.com/lists/oss-security/2024/04/05/2
CVE ID: CVE-2024-24747 State: PUBLISHED Published: 2024-01-31T22:10:23.375Z Last Updated: 2024-08-01T23:28:11.919Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: minio Products: minio Problem Types: CWE-269 Description: MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z. Additio
r own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4 - https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776 - https://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33Z
CVE ID: CVE-2024-24748 State: PUBLISHED Published: 2024-03-15T19:15:17.121Z Last Updated: 2024-08-27T19:43:50.659Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
ere are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-3qh8-xw23-cq4x - https://github.com/discourse/discourse/commit/819361ba28f86a1347059af300bb5cca690f9193
CVE ID: CVE-2024-24749 State: PUBLISHED Published: 2024-07-01T14:07:33.314Z Last Updated: 2025-11-04T18:29:12.335Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: geoserver Products: geoserver Problem Types: CWE-22 Description: GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCache ByteStreamController class and read arbitrary classpath resources with specific file name extensions. If GeoServer is also deployed as a web
class and read arbitrary classpath resources with specific file name extensions. If GeoServer is also deployed as a web archive using the data directory embedded in the `geoserver.war` file (rather than an external data directory), it will likely be possible to read specific resources to gain administrator privileges. However, it is very unlikely that production environments will be using the embedded data directory since, depending on how GeoServer is deployed, it will be erased and re-installed (which would also reset to the default password) either every time the server restarts or every time a new GeoServer WAR is installed and is therefore difficult to maintain. An external data directo
restarts or every time a new GeoServer WAR is installed and is therefore difficult to maintain. An external data directory will always be used if GeoServer is running in standalone mode (via an installer or a binary). Versions 2.23.5 and 2.24.3 contain a patch for the issue. Some workarounds are available. One may change from a Windows environment to a Linux environment; or change from Apache Tomcat to Jetty application server. One may also disable anonymous access to the embeded GeoWebCache administration and status pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-jhqx-5v5g-mpf3 -
- CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-jhqx-5v5g-mpf3 - https://github.com/GeoWebCache/geowebcache/pull/1211 - https://github.com/GeoWebCache/geowebcache/commit/c7f76bd8a1d67c3b986146e7a5e0b14dd64a8fef
CVE ID: CVE-2024-24750 State: PUBLISHED Published: 2024-02-16T21:42:29.999Z Last Updated: 2025-02-13T17:40:21.089Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: nodejs Products: undici Problem Types: CWE-400 Description: Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Reference
always consume the incoming body. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nodejs/undici/security/advisories/GHSA-9f24-jqhm-jfcw - https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663 - https://security.netapp.com/advisory/ntap-20240419-0006/
CVE ID: CVE-2024-24751 State: PUBLISHED Published: 2024-02-13T18:30:38.670Z Last Updated: 2024-08-01T23:28:12.712Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: derhansen Products: sf_event_mgt Problem Types: CWE-284, CWE-863 Description: sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. T
>redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/derhansen/sf_event_mgt/security/advisories/GHSA-4576-pgh2-g34j - https://github.com/derhansen/sf_event_mgt/commit/a08c2cd48695c07e462d15eeb70434ddc0206e4c
CVE ID: CVE-2024-24752 State: PUBLISHED Published: 2024-02-01T16:10:07.976Z Last Updated: 2024-10-17T16:09:09.368Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: brefphp Products: bref Problem Types: CWE-400 Description: Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in `/tmp` with a random filename starting with `bref_upload_`. The flow mimics what plain PHP does b
extracted and saved in `/tmp` with a random filename starting with `bref_upload_`. The flow mimics what plain PHP does but it does not delete the temporary files when the request has been processed. An attacker could fill the Lambda instance disk by performing multiple MultiPart requests containing files. This vulnerability is patched in 2.1.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/brefphp/bref/security/advisories/GHSA-x4hh-frx8-98r5 - https://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840e
CVE ID: CVE-2024-24753 State: PUBLISHED Published: 2024-02-01T16:09:55.328Z Last Updated: 2025-06-17T14:36:33.763Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: brefphp Products: bref Problem Types: CWE-436 Description: Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an applicat
the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r - https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc
CVE ID: CVE-2024-24754 State: PUBLISHED Published: 2024-02-01T16:10:30.539Z Last Updated: 2025-05-15T19:51:37.651Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: brefphp Products: bref Problem Types: CWE-436 Description: Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the `$files` or `$parsedBody` arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending w
rsedBody` arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with and open square bracket ([) are used. Based on the application logic the difference in the body parsing might lead to vulnerabilities and/or undefined behaviors. This vulnerability is patched in 2.1.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8w - https://github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092
CVE ID: CVE-2024-24755 State: PUBLISHED Published: 2024-02-01T22:14:23.064Z Last Updated: 2024-08-01T23:28:11.849Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse-group-membership-ip-block Problem Types: CWE-200 Description: discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom fields to remain secret. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
stom fields to remain secret. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse-group-membership-ip-block/security/advisories/GHSA-r38c-cp8w-664m - https://github.com/discourse/discourse-group-membership-ip-block/commit/b394d61b0bdfd18a2d8310aa5cf26cccf8bd31c1
CVE ID: CVE-2024-24756 State: PUBLISHED Published: 2024-02-01T22:38:20.120Z Last Updated: 2025-05-15T19:51:16.229Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: crafatar Products: crafatar Problem Types: CWE-22 Description: Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be requested from the server. Instances running behind Cloudflare (including crafatar.com) are not affected. Instances using the Docker container as shown in the README are affected, but only files within the container can be read. By default, all of the files within the container can also be found in this
only files within the container can be read. By default, all of the files within the container can also be found in this repository and are not confidential. This vulnerability is patched in 2.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/crafatar/crafatar/security/advisories/GHSA-5cxq-25mp-q5f2 - https://github.com/crafatar/crafatar/commit/bba004acc725b362a5d2d5dfe30cf60e7365a373 - https://github.com/crafatar/crafatar/blob/e0233f2899a3206a817d2dd3b80da83d51c7a726/lib/server.js#L64-L67
CVE ID: CVE-2024-24757 State: PUBLISHED Published: 2024-02-02T15:37:27.364Z Last Updated: 2024-08-01T23:28:11.867Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Degamisu Products: open-irs Problem Types: CWE-200 Description: open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when working with git actions. This problem is fixed in 1.0.1. Discontinuing all sensitive keys and turning into secrets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Degamisu/open-irs/security/advisories/GHSA-7r69-3vwh-wcfr