Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-43750 State: PUBLISHED Published: 2024-12-10T22:04:29.707Z Last Updated: 2024-12-11T14:44:52.638Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/secur
CVE ID: CVE-2024-43751 State: PUBLISHED Published: 2024-12-10T22:04:04.550Z Last Updated: 2024-12-11T17:05:14.446Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/secur
CVE ID: CVE-2024-43752 State: PUBLISHED Published: 2024-12-10T22:04:42.977Z Last Updated: 2024-12-11T16:12:28.251Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/secur
CVE ID: CVE-2024-43754 State: PUBLISHED Published: 2024-12-10T22:04:11.885Z Last Updated: 2024-12-11T14:46:27.362Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web application's client-side scripts to update the DOM. Exploitation of this issue requires user interaction, such as convincing a victim t
CVE ID: CVE-2024-43755 State: PUBLISHED Published: 2024-12-10T22:04:07.567Z Last Updated: 2025-01-07T17:37:01.858Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-20 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect the integrity of the page. Exploitation of this issue requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/s
ue requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE ID: CVE-2024-43756 State: PUBLISHED Published: 2024-09-13T09:37:04.036Z Last Updated: 2024-09-18T14:14:06.039Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Desktop Problem Types: CWE-122 Description: Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/photoshop/apsb24-72.html
CVE ID: CVE-2024-43758 State: PUBLISHED Published: 2024-09-13T08:37:30.674Z Last Updated: 2024-09-13T14:28:51.053Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-416 Description: Illustrator versions 28.6, 27.9.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb24-66.html
CVE ID: CVE-2024-43759 State: PUBLISHED Published: 2024-09-13T08:37:32.180Z Last Updated: 2024-09-13T14:05:49.131Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-476 Description: Illustrator versions 28.6, 27.9.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a DoS condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx
that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb24-66.html
CVE ID: CVE-2024-43760 State: PUBLISHED Published: 2024-09-13T09:37:05.597Z Last Updated: 2024-09-18T14:12:49.038Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Desktop Problem Types: CWE-787 Description: Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/photoshop/apsb24-72.html
CVE ID: CVE-2024-43762 State: PUBLISHED Published: 2025-01-02T23:58:26.886Z Last Updated: 2025-01-03T21:25:32.529Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible way to avoid unbinding of a service from the system due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/ae43ac7f3d3d5112b0f54b5315a15b08208acf9c - https://source.android.com/security/bulletin/2024-12-01
CVE ID: CVE-2024-43763 State: PUBLISHED Published: 2025-01-21T23:04:42.904Z Last Updated: 2025-03-17T16:54:20.011Z Vendors: Google Products: Android Problem Types: Denial of service Description: In build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error in the code. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-01-01
CVE ID: CVE-2024-43764 State: PUBLISHED Published: 2025-01-02T23:58:27.018Z Last Updated: 2025-01-03T21:45:43.752Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/70eb75df7d342429c3ee225feb7c011df727442f - https://source.android.com/security/bulletin/2024-12-01
CVE ID: CVE-2024-43765 State: PUBLISHED Published: 2025-01-21T23:04:42.989Z Last Updated: 2025-03-18T13:42:08.106Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-01-01
CVE ID: CVE-2024-43767 State: PUBLISHED Published: 2025-01-02T23:58:27.162Z Last Updated: 2025-03-19T18:15:30.811Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/external/skia/+/796c2040f641bb287dba66c9823ce45e9f8b5807 - https://source.android.com/security/bulletin/2024-12-01
CVE ID: CVE-2024-43768 State: PUBLISHED Published: 2025-01-02T23:58:27.245Z Last Updated: 2025-01-07T04:56:25.509Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/external/skia/+/b5543cb8c6b95623743016055220378efe73eb93 - https://source.android.com/security/bulletin/2024-12-01
CVE ID: CVE-2024-43769 State: PUBLISHED Published: 2025-01-02T23:58:27.333Z Last Updated: 2025-03-13T14:59:56.409Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/619ffc299bf33566ba6daee8301ee0fc96e015f4 - https://source.a
https://android.googlesource.com/platform/frameworks/base/+/619ffc299bf33566ba6daee8301ee0fc96e015f4 - https://source.android.com/security/bulletin/2024-12-01
CVE ID: CVE-2024-43770 State: PUBLISHED Published: 2025-01-21T23:04:43.090Z Last Updated: 2025-03-18T14:06:52.920Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-01-01
CVE ID: CVE-2024-43771 State: PUBLISHED Published: 2025-01-21T23:04:43.179Z Last Updated: 2025-03-18T13:38:44.680Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-01-01
CVE ID: CVE-2024-43772 State: PUBLISHED Published: 2024-09-02T04:01:03.389Z Last Updated: 2024-09-03T14:22:18.337Z Vendors: Huachu Digital Technology Ltd. Products: Easytest Online Test Platform Problem Types: CWE-89 Description: SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2024-05
CVE ID: CVE-2024-43773 State: PUBLISHED Published: 2024-09-02T04:01:43.939Z Last Updated: 2024-09-03T14:21:34.214Z Vendors: Huachu Digital Technology Ltd. Products: Easytest Online Test Platform Problem Types: CWE-89 Description: SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2024-06
CVE ID: CVE-2024-43774 State: PUBLISHED Published: 2024-09-02T04:02:47.465Z Last Updated: 2024-09-03T14:20:34.228Z Vendors: Huachu Digital Technology Ltd. Products: Easytest Online Test Platform Problem Types: CWE-89 Description: SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2024-07
CVE ID: CVE-2024-43775 State: PUBLISHED Published: 2024-09-02T04:03:26.336Z Last Updated: 2024-09-03T14:19:21.591Z Vendors: Huachu Digital Technology Ltd. Products: Easytest Online Test Platform Problem Types: CWE-89 Description: SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2024-08
CVE ID: CVE-2024-43776 State: PUBLISHED Published: 2024-09-02T04:04:00.285Z Last Updated: 2024-09-03T14:18:17.460Z Vendors: Huachu Digital Technology Ltd. Products: Easytest Online Test Platform Problem Types: CWE-89 Description: SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2024-09
CVE ID: CVE-2024-43778 State: PUBLISHED Published: 2024-09-18T06:14:02.040Z Last Updated: 2024-09-18T14:57:29.697Z Vendors: TAKENAKA ENGINEERING CO., LTD. Products: HDVR-400, HDVR-800, HDVR-1600, AHD04T-A, AHD08T-A, AHD16T-A, NVR04T-A, NVR08T-A, NVR16T-A Problem Types: OS command injection Description: OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.takex-eng.co.jp/ja/news/news.php?s=68 - https://jvn.jp/en/vu/JVNVU90142679/
CVE ID: CVE-2024-43779 State: PUBLISHED Published: 2025-02-06T16:47:28.385Z Last Updated: 2025-02-12T19:51:09.384Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: ClearML Products: ClearML Problem Types: CWE-200 Description: An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to reading vaults that have been previously disabled, possibly leaking sensitive credentials. An attacker can send a series of HTTP requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintell
erability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2112
CVE ID: CVE-2024-43780 State: PUBLISHED Published: 2024-08-22T15:17:11.947Z Last Updated: 2024-08-22T16:06:25.703Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-43781 State: PUBLISHED Published: 2024-09-10T09:36:51.143Z Last Updated: 2024-09-10T14:38:36.778Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SINUMERIK 828D V4, SINUMERIK 840D sl V4, SINUMERIK ONE Problem Types: CWE-532 Description: A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in connection with using Create MyConfig (CMC) <= V4.8 SP1 HF6), SINUMERIK ONE (All versions < V6.23 in connection with using Create MyConfig (CMC) <= V6.6), SINUMERIK ONE (All versions < V6.15 SP4 in connection with using Create MyConfig (CMC) <=
eate MyConfig (CMC) <= V6.6), SINUMERIK ONE (All versions < V6.15 SP4 in connection with using Create MyConfig (CMC) <= V6.6). Affected systems, that have been provisioned with Create MyConfig (CMC), contain a Insertion of Sensitive Information into Log File vulnerability. This could allow a local authenticated user with low privileges to read sensitive information and thus circumvent access restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-097786.html
CVE ID: CVE-2024-43782 State: PUBLISHED Published: 2024-08-23T14:35:08.787Z Last Updated: 2024-08-27T19:46:53.938Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: openedx Products: openedx-translations Problem Types: CWE-74 Description: This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform repository were validated using edx-i18n-tools. This validation included protection against malformed translations and translations-based script injections. Prior to this pat
alidation included protection against malformed translations and translations-based script injections. Prior to this patch, the validation implemented in the openedx-translations repository did not include the same protections. The maintainer inspected the translations in the edx-platform directory of both the main and open-release/redwood.master branches of the openedx-translations repository and found no evidence of exploited translation strings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openedx/openedx-translations/security/advisories/GHSA-fg8c-2pvj-wx3j - https://github.com/openedx/openedx-translations/commit/3c4093705dec99590577c4d8270ce263f7fff
ories/GHSA-fg8c-2pvj-wx3j - https://github.com/openedx/openedx-translations/commit/3c4093705dec99590577c4d8270ce263f7fffc5a - https://github.com/openedx/openedx-translations/commit/b2444340e8702c7955310331c1db5fd85b25b92b
CVE ID: CVE-2024-43783 State: PUBLISHED Published: 2024-08-27T17:16:28.571Z Last Updated: 2024-08-27T18:06:45.142Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: apollographql Products: router Problem Types: CWE-770 Description: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances of the Apollo Router running versions >=1.21.0 and < 1.52.1 are impacted by a denial of service vulnerability if _all_ of the following are true: 1. The Apollo Router has been configured to support [External Coprocessing](https://www.apollographql.com/docs/router/customizations/
Router has been configured to support [External Coprocessing](https://www.apollographql.com/docs/router/customizations/coprocessor). 2. The Apollo Router has been configured to send request bodies to coprocessors. This is a non-default configuration and must be configured intentionally by administrators. Instances of the Apollo Router running versions >=1.7.0 and <1.52.1 are impacted by a denial-of-service vulnerability if all of the following are true: 1. Router has been configured to use a custom-developed Native Rust Plugin. 2. The plugin accesses Request.router_request in the RouterService layer. 3. You are accumulating the body from Request.router_request into memory. If using an impac
in the RouterService layer. 3. You are accumulating the body from Request.router_request into memory. If using an impacted configuration, the Router will load entire HTTP request bodies into memory without respect to other HTTP request size-limiting configurations like limits.http_max_request_bytes. This can cause the Router to be out-of-memory (OOM) terminated if a sufficiently large request is sent to the Router. By default, the Router sets limits.http_max_request_bytes to 2 MB. If you have an impacted configuration as defined above, please upgrade to at least Apollo Router 1.52.1. If you cannot upgrade, you can mitigate the denial-of-service opportunity impacting External Coprocessors by
ter 1.52.1. If you cannot upgrade, you can mitigate the denial-of-service opportunity impacting External Coprocessors by setting the coprocessor.router.request.body configuration option to false. Please note that changing this configuration option will change the information sent to any coprocessors you have configured and may impact functionality implemented by those coprocessors. If you have developed a Native Rust Plugin and cannot upgrade, you can update your plugin to either not accumulate the request body or enforce a maximum body size limit. You can also mitigate this issue by limiting HTTP body payload sizes prior to the Router (e.g., in a proxy or web application firewall appliance)
s issue by limiting HTTP body payload sizes prior to the Router (e.g., in a proxy or web application firewall appliance). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/router/security/advisories/GHSA-x6xq-whh3-gg32 - https://github.com/apollographql/router/commit/7a9c020608a62dcaa306b72ed0f6980f15923b14 - https://github.com/apollographql/router/releases/tag/v1.52.1 - https://www.apollographql.com/docs/router/configuration/overview/#request-limits - https://www.apollographql.com/docs/router/customizations/coprocessor - https://www.apollographql.com/docs/router/customizations/native
CVE ID: CVE-2024-43784 State: PUBLISHED Published: 2024-11-26T20:17:56.482Z Last Updated: 2024-11-26T21:37:39.411Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L) Vendors: treeverse Products: lakeFS Problem Types: CWE-281 Description: lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user's credentials. This issue has been addressed in release version 1.33.0 and all users are advised to upgrade. The only k