Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-34241 State: PUBLISHED Published: 2024-05-17T15:17:39.506Z Last Updated: 2025-02-13T15:53:19.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course notifications. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://grumpz.net/cve-2024-34241-a-step-by-step-discovery-guide
CVE ID: CVE-2024-34243 State: PUBLISHED Published: 2024-05-14T15:19:34.311Z Last Updated: 2025-03-28T18:49:58.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/JByteL/CVE/tree/main/CVE-2024-34243
CVE ID: CVE-2024-34244 State: PUBLISHED Published: 2024-05-08T00:00:00 Last Updated: 2024-08-02T02:51:10.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus_write_bits function. This issue can be triggered when the function is fed with specially crafted input, which leads to out-of-bounds read and can potentially cause a crash or other unintended behaviors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/stephane/libmodbus/issues/743
CVE ID: CVE-2024-34245 State: PUBLISHED Published: 2024-05-10T16:19:45.844Z Last Updated: 2025-02-13T15:53:20.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file read vulnerability in DedeCMS v5.7.114 allows authenticated attackers to read arbitrary files by specifying any path in makehtml_js_action.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Stoocea/Vulnerability-analysis-Notes/blob/main/cms/DedeCMS-V5.7.114%20%20Arbitrary%20file%20read%20vulnerability.md
CVE ID: CVE-2024-34246 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:51:09.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platforms/app/main.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wasm3/wasm3/issues/484
CVE ID: CVE-2024-34249 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:51:10.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: wasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function "DeallocateSlot" in wasm3/source/m3_compile.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wasm3/wasm3/issues/485
CVE ID: CVE-2024-34250 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:51:10.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the "wasm_loader_check_br" function in core/iwasm/interpreter/wasm_loader.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bytecodealliance/wasm-micro-runtime/issues/3346
CVE ID: CVE-2024-34251 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:51:10.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the "block_type_get_arity" function in core/iwasm/interpreter/wasm.h. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bytecodealliance/wasm-micro-runtime/issues/3347
CVE ID: CVE-2024-34252 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-05T20:05:17.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: wasm3 v0.5.0 was discovered to contain a global buffer overflow which leads to segmentation fault via the function "PreserveRegisterIfOccupied" in wasm3/source/m3_compile.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wasm3/wasm3/issues/483
CVE ID: CVE-2024-34255 State: PUBLISHED Published: 2024-05-08T00:00:00 Last Updated: 2024-08-02T02:51:10.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cherry-toto/jizhicms/issues/93
CVE ID: CVE-2024-34256 State: PUBLISHED Published: 2024-05-14T14:45:37.270Z Last Updated: 2025-02-13T15:53:21.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ZackSecurity/VulnerReport/blob/cve/ofcms/1.md
CVE ID: CVE-2024-34257 State: PUBLISHED Published: 2024-05-08T00:00:00 Last Updated: 2024-08-02T02:51:09.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://immense-mirror-b42.notion.site/TOTOLINK-EX1800T-has-an-unauthorized-arbitrary-command-execution-vulnerability-2f3e308f5e1d45a2b8a64f198cacc350 - https://github.com/ZackSecurity/VulnerReport/blob/cve/totolink/EX1800T/1
ulnerability-2f3e308f5e1d45a2b8a64f198cacc350 - https://github.com/ZackSecurity/VulnerReport/blob/cve/totolink/EX1800T/1.md
CVE ID: CVE-2024-34273 State: PUBLISHED Published: 2024-05-16T15:16:37.853Z Last Updated: 2025-02-13T15:53:21.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/chrisandoryan/vuln-advisory/blob/main/nJwt/CVE-2024-34273.md
CVE ID: CVE-2024-34274 State: PUBLISHED Published: 2024-05-21T19:36:43.177Z Last Updated: 2025-02-13T15:53:22.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data. The cookies bdglobals and bdclient_spot of the OpenBD software uses serialized data, which can be used to execute arbitrary code on the system. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OpenBD/openbd-core/issues/89
CVE ID: CVE-2024-34308 State: PUBLISHED Published: 2024-05-08T20:14:46.663Z Last Updated: 2025-02-13T15:53:23.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the function urldecode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20LR350/README.md
CVE ID: CVE-2024-34310 State: PUBLISHED Published: 2024-05-10T17:22:05.356Z Last Updated: 2025-02-13T15:53:23.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/3309899621/CVE-2024-34310
CVE ID: CVE-2024-34312 State: PUBLISHED Published: 2024-06-24T00:00:00.000Z Last Updated: 2025-03-25T16:41:29.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vincentscode/CVE-2024-34312
CVE ID: CVE-2024-34313 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T02:51:11.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vincentscode/CVE-2024-34313
CVE ID: CVE-2024-34314 State: PUBLISHED Published: 2024-05-07T00:00:00.000Z Last Updated: 2025-03-14T00:43:44.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/H3rmesk1t/vulnerability-paper/blob/main/CmsEasy-7.7.7.9-File%20Inclusion.md
CVE ID: CVE-2024-34315 State: PUBLISHED Published: 2024-05-07T00:00:00 Last Updated: 2024-08-02T02:51:10.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/H3rmesk1t/vulnerability-paper/blob/main/CmsEasy-7.7.7.9-File%20Inclusion2.md
CVE ID: CVE-2024-34327 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T20:02:13.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sielox.com - https://github.com/0xsu3ks/CVE-2024-34327
CVE ID: CVE-2024-34328 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T19:46:31.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sielox.com - https://github.com/0xsu3ks/CVE-2024-34328
CVE ID: CVE-2024-34329 State: PUBLISHED Published: 2024-07-22T00:00:00.000Z Last Updated: 2025-03-14T15:55:58.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execute arbitrary code as SYSTEM via a crafted DLL payload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.entrust.com/ja/contact/services/downloads/drivers - https://github.com/pamoutaf/CVE-2024-34329/blob/main/README.md - https://www.entrust.com/support/instant-id-card-issuance-systems/ds3-direct-to-card-printer-s
4329/blob/main/README.md - https://www.entrust.com/support/instant-id-card-issuance-systems/ds3-direct-to-card-printer-support - https://www.entrust.com/sites/default/files/documentation/productsupport/entrust-security-bulletin-e24-004.pdf
CVE ID: CVE-2024-34331 State: PUBLISHED Published: 2024-09-23T00:00:00 Last Updated: 2024-09-23T16:15:56.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, because Parallels Service is setuid root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.parallels.com/129860 - https://khronokernel.com/macos/2024/05/30/CVE-2024-34331.html
CVE ID: CVE-2024-34332 State: PUBLISHED Published: 2024-06-10T00:00:00 Last Updated: 2024-08-02T02:51:10.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a crafted buffer sent to the Kernel Driver using the DeviceIoControl Windows API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://belong2yourself.github.io/vulnerabilities/docs/SANDRA/Elevation-of-Privileges/readme/
CVE ID: CVE-2024-34334 State: PUBLISHED Published: 2024-09-12T00:00:00 Last Updated: 2024-09-12T20:14:31.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: ORDAT FOSS-Online before v2.24.01 was discovered to contain a SQL injection vulnerability via the forgot password function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://foss-online.com - http://ordat.com - https://mind-bytes.de/sql-injection-in-foss-online-cve-2024-34334/
CVE ID: CVE-2024-34335 State: PUBLISHED Published: 2024-09-12T00:00:00 Last Updated: 2024-09-12T20:12:19.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://foss-online.com - http://ordat.com - https://mind-bytes.de/cross-site-scripting-in-foss-online-cve-2024-34335/
CVE ID: CVE-2024-34336 State: PUBLISHED Published: 2024-09-12T00:00:00 Last Updated: 2024-09-12T20:10:08.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://foss-online.com - http://ordat.com - https://mind-bytes.de/offenlegung-existierender-benutzerkonten-in-foss-online-cve-2024-34336/
CVE ID: CVE-2024-34338 State: PUBLISHED Published: 2024-05-09T17:51:16.015Z Last Updated: 2025-02-13T15:53:24.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest parameter in /goform/getTraceroute. This vulnerability allows attackers to execute arbitrary commands with root privileges. Authentication is required to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://exzettabyte.me/blind-command-injection-in-tenda-o3v2
CVE ID: CVE-2024-34340 State: PUBLISHED Published: 2024-05-13T15:26:32.364Z Last Updated: 2025-11-04T16:12:18.537Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Cacti Products: cacti Problem Types: CWE-287, CWE-697 Description: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supp
word_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-37x7-mfjv-mm7m - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL7
m7m - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2024-34341 State: PUBLISHED Published: 2024-05-07T15:13:03.137Z Last Updated: 2024-08-02T02:51:09.811Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: basecamp Products: trix Problem Types: CWE-79 Description: Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, wh
which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99 - https://github.com/basecamp/trix/pull/1147 - https://github.com/basecamp/trix/pull/1149 - https://github.com/basecamp/trix/commit/1a5c68a14d48421fc368e30026f4a7918028b7ad - https://github.com/basecamp/trix/commit/841ff19b53f349915100bca8fcb488214ff93554 - https://github.com/basecamp/trix/releases/tag/v2.1.1
CVE ID: CVE-2024-34342 State: PUBLISHED Published: 2024-05-07T14:29:06.599Z Last Updated: 2024-08-02T02:51:10.948Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: wojtekmaj Products: react-pdf Problem Types: CWE-79 Description: react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wojtekmaj/
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wojtekmaj/react-pdf/security/advisories/GHSA-87hq-q4gp-9wr4 - https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq - https://github.com/mozilla/pdf.js/pull/18015 - https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6 - https://github.com/wojtekmaj/react-pdf/commit/208f28dd47fe38c33ce4bac4205b2b0a0bb207fe - https://github.com/wojtekmaj/react-pdf/commit/671e6eaa2e373e404040c13cc6b668fe39839cad
CVE ID: CVE-2024-34343 State: PUBLISHED Published: 2024-08-05T20:35:13.258Z Last Updated: 2024-08-08T15:51:24.069Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: nuxt Products: nuxt Problem Types: CWE-79 Description: Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The `navigateTo` function attempts to blockthe `javascript:` protocol, but does not correctly use API's provided by `unjs/ufo`. This library also contains parsing discrepancies. The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and returns tru
ied URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and returns true for a javascript: protocol. After this, the URL is parsed using the parseURL function. This function will refuse to parse poorly formatted URLs. Parsing javascript:alert(1) returns null/"" for all values. Next, the protocol of the URL is then checked using the isScriptProtocol function. This function simply checks the input against a list of protocols, and does not perform any parsing. The combination of refusing to parse poorly formatted URLs, and not performing additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identifie
erforming additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identified, whitespace is not stripped in the parseURL implementation, bypassing the isScriptProtocol checks. Certain special protocols are identified at the top of parseURL. Inserting a newline or tab into this sequence will block the special protocol check, and bypass the latter checks. This ONLY has impact after SSR has occured, the `javascript:` protocol within a location header does not trigger XSS. This issue has been addressed in release version 3.12.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA
ll users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nuxt/nuxt/security/advisories/GHSA-vf6r-87q4-2vjf
CVE ID: CVE-2024-34344 State: PUBLISHED Published: 2024-08-05T20:36:20.878Z Last Updated: 2024-08-12T19:50:45.928Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: nuxt Products: nuxt Problem Types: CWE-94 Description: Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands. Users who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the
licious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page. Since web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nuxt/nuxt/security/advisories/GHSA-v784-fjjh-f8r4
CVE ID: CVE-2024-34345 State: PUBLISHED Published: 2024-05-09T14:56:07.494Z Last Updated: 2024-08-02T02:51:09.775Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CycloneDX Products: cyclonedx-javascript-library Problem Types: CWE-611 Description: The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisori
ment: - CVE Program Container: References: - https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7 - https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063 - https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203