Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/events/subscription/EventSubscriptionResource.java#L289
CVE ID: CVE-2024-28848 State: PUBLISHED Published: 2024-03-15T19:55:47.039Z Last Updated: 2024-08-13T17:08:03.539Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: open-metadata Products: OpenMetadata Problem Types: CWE-94 Description: OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `‎CompiledRule::validateExpression` method evaluates an SpEL expression using an `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/polici
reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/policies/validation/condition/<expression>` endpoint passes user-controlled data `CompiledRule::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and therefore any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression langu
ons leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-236`. This issue may lead to Remote Code Execution and has been resolved in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5xv3-fm7g-865r - https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection - https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/
/java/java-spel-expression-injection - https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L51 - https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L57
CVE ID: CVE-2024-28849 State: PUBLISHED Published: 2024-03-14T17:07:27.338Z Last Updated: 2025-02-13T17:47:32.862Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: follow-redirects Products: follow-redirects Problem Types: CWE-200 Description: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgra
o. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp - https://github.com/psf/requests/issues/1885 - https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b - https://hackerone.com/reports/2390009 - https://fetch.spec.whatwg.org/#authentication-entries - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/mess
rg/#authentication-entries - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z/
CVE ID: CVE-2024-28850 State: PUBLISHED Published: 2024-03-25T18:57:15.692Z Last Updated: 2024-08-02T00:56:58.162Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: johnbillion Products: wp-crontrol Problem Types: CWE-494 Description: WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create events in the WP-Cron system that store and execute PHP code subject to the restrictive security permissions documented here. While there is no known vulnerability in this feature on its own, there exists potential for this feature to be vulnerable to RCE if it were specifically targeted via vulnerab
n its own, there exists potential for this feature to be vulnerable to RCE if it were specifically targeted via vulnerability chaining that exploited a separate SQLi (or similar) vulnerability. This is exploitable on a site if one of the below preconditions are met, the site is vulnerable to a writeable SQLi vulnerability in any plugin, theme, or WordPress core, the site's database is compromised at the hosting level, the site is vulnerable to a method of updating arbitrary options in the wp_options table, or the site is vulnerable to a method of triggering an arbitrary action, filter, or function with control of the parameters. As a hardening measure, WP Crontrol version 1.16.2 ships with a
ion, filter, or function with control of the parameters. As a hardening measure, WP Crontrol version 1.16.2 ships with a new feature that prevents tampering of the code stored in a PHP cron event. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/johnbillion/wp-crontrol/security/advisories/GHSA-9xvf-cjvf-ff5q - https://github.com/johnbillion/wp-crontrol/releases/tag/1.16.2
CVE ID: CVE-2024-28851 State: PUBLISHED Published: 2024-03-15T18:59:31.229Z Last Updated: 2024-08-28T17:49:46.975Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: snowflakedb Products: snowflake-hive-metastore-connector Problem Types: CWE-269 Description: The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaStore Connector. A malicious insider without admin privileges could, in theory, use the script to download content from a Microsoft domain to the local system and replace the
vileges could, in theory, use the script to download content from a Microsoft domain to the local system and replace the valid content with malicious code. If the attacker then also had local access to the same system where the maliciously modified script is run, they could attempt to manipulate users into executing the attacker-controlled helper script, potentially gaining elevated privileges to the local system. The vulnerability in the script was patched on February 09, 2024, without a version bump to the Connector. User who use the helper script are strongly advised to use the latest version as soon as possible. Users unable to upgrade should avoid using the helper script. Additional Ana
use the latest version as soon as possible. Users unable to upgrade should avoid using the helper script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/snowflake-hive-metastore-connector/security/advisories/GHSA-r68p-g2x9-mq7x - https://github.com/snowflakedb/snowflake-hive-metastore-connector/commit/dfbf87dff456f6bb62c927711d97316f0c71d8ca - https://github.com/snowflakedb/snowflake-hive-metastore-connector/blob/master/scripts/add_snowflake_hive_metastore_connector_script_action.sh
CVE ID: CVE-2024-28852 State: PUBLISHED Published: 2024-03-27T13:18:10.464Z Last Updated: 2024-08-13T14:11:34.057Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ampache Products: ampache Problem Types: CWE-79 Description: Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means that all forms in the Ampache that use `rule` as a variable are not secure. For example, when querying a song, when querying a podcast, we need to use `$rule` variable. This vulnerability is fixed in 6.3.1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
ity is fixed in 6.3.1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ampache/ampache/security/advisories/GHSA-g7hx-hm68-f639 - https://github.com/ampache/ampache/blob/bcaa9a4624acf8c8cc4c135be77b846731fb1ba2/src/Repository/Model/Search.php#L1732-L1740
CVE ID: CVE-2024-28853 State: PUBLISHED Published: 2024-03-27T13:17:56.679Z Last Updated: 2024-08-29T19:10:15.169Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: ampache Products: ampache Problem Types: CWE-79 Description: Ampache is a web based audio/video streaming application and file manager. Stored Cross Site Scripting (XSS) vulnerability in ampache before v6.3.1 allows a remote attacker to execute code via a crafted payload to serval parameters in the post request of /preferences.php?action=admin_update_preferences. This vulnerability is fixed in 6.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gith
s fixed in 6.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ampache/ampache/security/advisories/GHSA-prw2-7cr3-5mx8
CVE ID: CVE-2024-28854 State: PUBLISHED Published: 2024-03-15T18:54:58.524Z Last Updated: 2024-08-02T00:56:58.073Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: tmccombs Products: tls-listener Problem Types: CWE-400 Description: tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listene
to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7 - https://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4 - https://en.wikipedia.org/wiki/Slowloris_(computer_security)
CVE ID: CVE-2024-28855 State: PUBLISHED Published: 2024-03-18T21:46:47.314Z Last Updated: 2024-08-13T14:19:08.789Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-20 Description: ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was p
ould create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpj - https://github.com/zitadel/zitadel/releases/tag/v2.41.15 - https://github.com/zitadel/zitadel/releases/tag/v2.42.15 - https://github.com/zitadel/zita
tadel/releases/tag/v2.41.15 - https://github.com/zitadel/zitadel/releases/tag/v2.42.15 - https://github.com/zitadel/zitadel/releases/tag/v2.43.9 - https://github.com/zitadel/zitadel/releases/tag/v2.44.3 - https://github.com/zitadel/zitadel/releases/tag/v2.45.1 - https://github.com/zitadel/zitadel/releases/tag/v2.46.1 - https://github.com/zitadel/zitadel/releases/tag/v2.47.3
CVE ID: CVE-2024-28859 State: PUBLISHED Published: 2024-03-15T22:32:56.078Z Last Updated: 2024-08-15T19:42:39.282Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: FriendsOfSymfony1 Products: symfony1 Problem Types: CWE-502 Description: Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project. This vulnerability present no direct threat but is a vector that will enable remote code executi
r input in his project. This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. Symfony 1 depends on Swift Mailer which is bundled by default in vendor directory in the default installation since 1.3.0. Swift Mailer classes implement some `__destruct()` methods. These methods are called when php destroys the object in memory. However, it is possible to include any object type in `$this->_keys` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on foreach($this->_keys ...) for any class impleme
rticular, it is possible to abuse the array access which is triggered on foreach($this->_keys ...) for any class implementing ArrayAccess interface. This may allow an attacker to execute any PHP command which leads to remote code execution. This issue has been addressed in version 1.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r - https://github.com/FriendsOfSymfony1/symfony1/commit/edb850f94fb4de18ca53d0d1824910d6e8130166
CVE ID: CVE-2024-28860 State: PUBLISHED Published: 2024-03-27T18:34:23.105Z Last Updated: 2025-04-10T18:25:55.223Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: cilium Products: cilium Problem Types: CWE-326 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key recovery, replay attacks by a man-in-the-middle attacker. These attacks are possible due to an ESP sequence number collision when multiple nodes are con
n-in-the-middle attacker. These attacks are possible due to an ESP sequence number collision when multiple nodes are configured with the same key. Fixed versions of Cilium use unique keys for each IPsec tunnel established between nodes, resolving all of the above attacks. This vulnerability is fixed in 1.13.13, 1.14.9, and 1.15.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cilium/cilium/security/advisories/GHSA-pwqm-x5x6-5586 - https://github.com/cilium/cilium/commit/311fbce5280491cddceab178d83b06fa23688c72 - https://github.com/cilium/cilium/commit/a1742b478306fa256cd27df1039dfae0537b4149 - https://github.com/cilium/cilium/com
https://github.com/cilium/cilium/commit/a1742b478306fa256cd27df1039dfae0537b4149 - https://github.com/cilium/cilium/commit/a652c123331852cca90c74202f993d4170fd37fa - https://docs.cilium.io/en/stable/security/network/encryption-ipsec
CVE ID: CVE-2024-28861 State: PUBLISHED Published: 2024-03-22T16:43:18.453Z Last Updated: 2024-08-20T20:33:11.104Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FriendsOfSymfony1 Products: symfony1 Problem Types: CWE-502 Description: Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue. Addition
ecution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-pv9j-c53q-h433 - https://github.com/FriendsOfSymfony1/symfony1/commit/0bd9d59c69221f49bfc8be8b871b79e12d7d171a
CVE ID: CVE-2024-28862 State: PUBLISHED Published: 2024-03-15T23:44:06.416Z Last Updated: 2024-08-21T20:41:33.924Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: mdp Products: rotp Problem Types: CWE-276 Description: The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f
CVE ID: CVE-2024-28863 State: PUBLISHED Published: 2024-03-21T22:10:23.603Z Last Updated: 2025-02-13T17:47:34.618Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: isaacs Products: node-tar Problem Types: CWE-400, CWE-770 Description: node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessiv
ng it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36 - https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7 - https://security.netapp.com/advisory/ntap-20240524-0005/
CVE ID: CVE-2024-28864 State: PUBLISHED Published: 2024-03-18T21:49:06.762Z Last Updated: 2024-08-02T00:56:58.208Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: IlicMiljan Products: Secure-Props Problem Types: CWE-1333 Description: SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipp
d passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding s
rypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8 - https://github.com/IlicMiljan/Secure-Props/issues/20 - https://github.com/IlicMiljan/Secure-Props/pull/21 - https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627
CVE ID: CVE-2024-28865 State: PUBLISHED Published: 2024-03-18T21:53:59.877Z Last Updated: 2024-08-21T14:59:23.794Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: django-wiki Products: django-wiki Problem Types: CWE-1333 Description: django-wiki is a wiki system for Django. Installations of django-wiki prior to version 0.10.1 are vulnerable to maliciously crafted article content that can cause severe use of server CPU through a regular expression loop. Version 0.10.1 fixes this issue. As a workaround, close off access to create and edit articles by anonymous users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
les by anonymous users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/django-wiki/django-wiki/security/advisories/GHSA-wj85-w4f4-xh8h - https://github.com/django-wiki/django-wiki/commit/8e280fd6c0bd27ce847c67b2d216c6cbf920f88c
CVE ID: CVE-2024-28866 State: PUBLISHED Published: 2024-05-13T13:53:30.719Z Last Updated: 2024-08-02T00:56:58.190Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: gocd Products: gocd Problem Types: CWE-79 Description: GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 (inclusive) are potentially vulnerable to a reflected cross-site scripting vulnerability on the loading page displayed while GoCD is starting, via abuse of a `redirect_to` query parameter with inadequate validation. Attackers could theoretically abuse the query parameter to steal session tokens or other values from the user's browser. In practice exploiting this to perform p
uery parameter to steal session tokens or other values from the user's browser. In practice exploiting this to perform privileged actions is likely rather difficult to exploit because the target user would need to be triggered to open an attacker-crafted link in the period where the server is starting up (but not completely started), requiring chaining with a separate denial-of-service vulnerability. Additionally, GoCD server restarts invalidate earlier session tokens (i.e GoCD does not support persistent sessions), so a stolen session token would be unusable once the server has completed restart, and executed XSS would be done within a logged-out context. The issue is fixed in GoCD 24.1.0.