Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7540 State: PUBLISHED Published: 2024-08-05T23:53:48.276Z Last Updated: 2024-08-08T13:46:03.210Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: oFono Products: oFono Problem Types: CWE-457 Description: oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization
w exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1080/
CVE ID: CVE-2024-7541 State: PUBLISHED Published: 2024-08-05T23:53:52.688Z Last Updated: 2024-08-06T13:24:10.805Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: oFono Products: oFono Problem Types: CWE-457 Description: oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization o
exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23308. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1081/
CVE ID: CVE-2024-7542 State: PUBLISHED Published: 2024-08-05T23:53:56.783Z Last Updated: 2024-08-08T15:46:06.141Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: oFono Products: oFono Problem Types: CWE-457 Description: oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization
w exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23309. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1082/
CVE ID: CVE-2024-7543 State: PUBLISHED Published: 2024-08-05T23:54:00.537Z Last Updated: 2024-08-06T15:16:20.581Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: oFono Products: oFono Problem Types: CWE-122 Description: oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-suppli
ithin the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23456. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1083/
CVE ID: CVE-2024-7544 State: PUBLISHED Published: 2024-08-05T23:54:04.685Z Last Updated: 2024-08-06T13:56:09.146Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: oFono Products: oFono Problem Types: CWE-122 Description: oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-suppli
ithin the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23457. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1084/
CVE ID: CVE-2024-7545 State: PUBLISHED Published: 2024-08-05T23:54:08.175Z Last Updated: 2024-08-06T19:49:17.011Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: oFono Products: oFono Problem Types: CWE-122 Description: oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-suppli
ithin the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23458. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1085/
CVE ID: CVE-2024-7546 State: PUBLISHED Published: 2024-08-05T23:54:11.442Z Last Updated: 2024-08-06T13:45:57.935Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: oFono Products: oFono Problem Types: CWE-122 Description: oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-suppli
ithin the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23459. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1086/
CVE ID: CVE-2024-7547 State: PUBLISHED Published: 2024-08-05T23:54:15.115Z Last Updated: 2024-08-08T13:47:26.078Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: oFono Products: oFono Problem Types: CWE-121 Description: oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data
ithin the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1087/
CVE ID: CVE-2024-7548 State: PUBLISHED Published: 2024-08-08T05:31:45.510Z Last Updated: 2024-08-08T14:11:18.196Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-89 Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 4.2.6.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL qu
This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/702715a9-b180-4d31-a1df-37b732ae8226?source=cve - https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/curds/class-lp-course-curd.php#L828 - https://wordpress.org/plugins/learnpress/#developers - https://plugins.svn.wordpress.org/learnpress/tags/4.2.6.9.3/inc/curds/class-lp-course-curd.php - https://plugins.trac.wordpress.org/changeset/313
ress.org/learnpress/tags/4.2.6.9.3/inc/curds/class-lp-course-curd.php - https://plugins.trac.wordpress.org/changeset/3132019/ - https://plugins.trac.wordpress.org/changeset/3132002/
CVE ID: CVE-2024-7550 State: PUBLISHED Published: 2024-08-06T20:22:07.338Z Last Updated: 2024-08-07T19:29:52.918Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/355256380
CVE ID: CVE-2024-7551 State: PUBLISHED Published: 2024-08-06T12:31:04.358Z Last Updated: 2024-08-06T13:20:08.825Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:P/I:N/A:N) Vendors: juzaweb Products: CMS Problem Types: CWE-22 Description: A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as problematic. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273696. NOTE: The vendor was contacted early about this disclosure but did
The identifier of this vulnerability is VDB-273696. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273696 - https://vuldb.com/?ctiid.273696 - https://vuldb.com/?submit.381444 - https://github.com/DeepMountains/Mirage/blob/main/CVE9-1.md
CVE ID: CVE-2024-7552 State: PUBLISHED Published: 2024-08-06T14:31:09.110Z Last Updated: 2024-08-06T19:30:34.911Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DataGear Problem Types: CWE-917 Description: A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression of the file ConversionSqlParamValueMapper.java of the component Data Schema Page. The manipulation leads to improper neutralization of special elements used in an expression language statement. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier
ement. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273697 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273697 - https://vuldb.com/?ctiid.273697 - https://vuldb.com/?submit.386413 - https://gitee.com/datagear/datagear/issues/IAF3H7
CVE ID: CVE-2024-7553 State: PUBLISHED Published: 2024-08-07T09:57:49.818Z Last Updated: 2024-08-07T15:27:46.258Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: MongoDB Inc Products: MongoDB Server, MongoDB C Driver, MongoDB PHP Driver Problem Types: CWE-284 Description: Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7
ue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/PHPC-2369 - https://jira.mongodb.org/browse/SERVER-93211 - https://jira.mongodb.org/browse/CDRIVER-5650
CVE ID: CVE-2024-7554 State: PUBLISHED Published: 2024-08-08T10:30:47.869Z Last Updated: 2024-08-29T15:05:01.135Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-200 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versions starting from 17.2 before 17.2.2. Under certain conditions, access tokens may have been logged when an API request was made in a specific manner. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/471555
CVE ID: CVE-2024-7556 State: PUBLISHED Published: 2025-05-15T20:07:10.783Z Last Updated: 2025-05-17T03:38:28.356Z Vendors: Unknown Products: Simple Share Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/89ccbe24-be15-4b13-883a-48d6da9c8ffa/
CVE ID: CVE-2024-7557 State: PUBLISHED Published: 2024-08-08T21:33:14.505Z Last Updated: 2025-11-20T07:33:14.445Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Data Science (RHODS) Problem Types: CWE-284 Description: A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, vis
one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-7557 - https://bugzilla.redhat.com/show_bug.cgi?id=2303094
CVE ID: CVE-2024-7558 State: PUBLISHED Published: 2024-10-02T10:06:31.098Z Last Updated: 2024-10-02T13:59:04.171Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: Canonical Ltd. Products: Juju Problem Types: CWE-337, CWE-340, CWE-1391 Description: JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
to the same information and tools as the Juju charm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4 - https://www.cve.org/CVERecord?id=CVE-2024-7558
CVE ID: CVE-2024-7559 State: PUBLISHED Published: 2024-08-23T02:31:46.637Z Last Updated: 2024-08-23T14:09:01.521Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: File Manager Products: File Manager Pro Problem Types: CWE-94 Description: The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions up to, and including, 8.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additiona
above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b45791-4b85-4a2d-8019-1d438bd694cb?source=cve - https://filemanagerpro.io/file-manager-pro/
CVE ID: CVE-2024-7560 State: PUBLISHED Published: 2024-08-08T01:50:33.721Z Last Updated: 2024-08-08T14:29:16.445Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: codename065 Products: News Flash Problem Types: CWE-502 Description: The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the newsflash_post_meta meta value. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed
POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5631826-6975-41e9-a896-f2aa0581334f?source=cve - https://themes.trac.wordpress.org/browser/news-flash/1.1.0/page.php#L8
CVE ID: CVE-2024-7561 State: PUBLISHED Published: 2024-08-08T01:50:32.784Z Last Updated: 2024-08-08T15:31:54.978Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: shahriar0822 Products: The Next Problem Types: CWE-502 Description: The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the wpeden_post_meta post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme instal
nown POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a76dcb33-4c6b-44dc-9b27-6daf4f0a1376?source=cve - https://themes.trac.wordpress.org/browser/the-next/1.1.0/libs/util-functions.php#L365
CVE ID: CVE-2024-7562 State: PUBLISHED Published: 2025-06-12T16:05:31.562Z Last Updated: 2025-06-17T18:17:28.748Z Vendors: Revenera Products: InstallShield Problem Types: CWE-379 Description: A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions (InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2) are affected by this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.revenera.com/s/article/cve-2024-7562-privilege-escalation-vulnerability-in-created-msi-packages
CVE ID: CVE-2024-7564 State: PUBLISHED Published: 2024-08-06T15:47:49.467Z Last Updated: 2024-08-07T13:34:22.057Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-22 Description: Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the get_response_json_result endpoint. The issue results from the lack of proper validation of a user-suppli
ists within the get_response_json_result endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-24680. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1021/
CVE ID: CVE-2024-7565 State: PUBLISHED Published: 2024-11-22T21:32:27.245Z Last Updated: 2024-11-26T15:40:08.661Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SMARTBEAR Products: SoapUI Problem Types: CWE-22 Description: SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of SMARTBEAR SoapUI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the unpackageAll function. The issue results from the lack of proper validati
ious file. The specific flaw exists within the unpackageAll function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19060. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1100/ - https://www.soapui.org/downloads/latest-release/release-notes/
CVE ID: CVE-2024-7566 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:43.936Z Description: No description available.