Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
-DB9/RJ45-DIN, ICDM-RX/PN-ST/RJ45-DIN, ICDM-RX/PN-4DB9/2RJ45-DIN, ICDM-RX/PN-DB9/RJ45-PM, ICDM-RX/PN-2DB9/RJ45-DIN, ICDM-RX/PN-2ST/RJ45-DIN, ICDM-RX/PN1-DB9/RJ45-PM, ICDM-RX/PN1-DB9/RJ45-DIN, ICDM-RX/PN1-ST/RJ45-DIN, ICDM-RX/PN1-2DB9/RJ45-DIN, ICDM-RX/PN1-4DB9/2RJ45-DIN, ICDM-RX/PN1-2ST/RJ45-DIN, ICDM-RX/EN-DB9/RJ45-DIN, ICDM-RX/EN-ST/RJ45-DIN, ICDM-RX/EN-4DB9/2RJ45-DIN, ICDM-RX/EN-DB9/RJ45-PM, ICDM-RX/EN-2DB9/RJ45-DIN, ICDM-RX/EN-2ST/RJ45-DIN, ICDM-RX/EN1-DB9/RJ45-PM, ICDM-RX/EN1-DB9/RJ45-DIN, ICDM-RX/EN1-ST/RJ45-DIN, ICDM-RX/EN1-2DB9/RJ45-DIN, ICDM-RX/EN1-4DB9/2RJ45-DIN, ICDM-RX/EN1-2ST/RJ45-DIN, ICDM-RX/MOD-DB9/RJ45-DIN, ICDM-RX/MOD-ST/RJ45-DIN, ICDM-RX/MOD-4DB9/2RJ45-DIN, ICDM-RX/MOD-DB9
ICDM-RX/EN1-2ST/RJ45-DIN, ICDM-RX/MOD-DB9/RJ45-DIN, ICDM-RX/MOD-ST/RJ45-DIN, ICDM-RX/MOD-4DB9/2RJ45-DIN, ICDM-RX/MOD-DB9/RJ45-PM, ICDM-RX/MOD-2DB9/RJ45-DIN, ICDM-RX/MOD-2ST/RJ45-DIN, ICDM-RX/MOD-16RJ45/2RJ45-PM Problem Types: CWE-79 Description: An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-033
CVE ID: CVE-2024-38502 State: PUBLISHED Published: 2024-08-13T12:33:30.908Z Last Updated: 2024-08-13T13:28:24.550Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Pepperl+Fuchs Products: ICDM-RX/TCP-DB9/RJ45-DIN, ICDM-RX/TCP-ST/RJ45-DIN, ICDM-RX/TCP-4DB9/2RJ45-DIN, ICDM-RX/TCP-DB9/RJ45-PM, ICDM-RX/TCP-2DB9/RJ45-DIN, ICDM-RX/TCP-2ST/RJ45-DIN, ICDM-RX/TCP-4DB9/2RJ45-PM, ICDM-RX/TCP-8DB9/2RJ45-PM, ICDM-RX/TCP-16RJ45/RJ45-RM, ICDM-RX/TCP-16DB9/RJ45-RM, ICDM-RX/TCP-32RJ45/RJ45-RM, ICDM-RX/TCP-DB9/RJ45-PM2, ICDM-RX/TCP-16RJ45/2RJ45-PM, ICDM-RX/PN-DB9/RJ45-DIN, ICDM-RX/PN-ST/RJ45-DIN, ICDM-RX/PN-4DB9/2RJ45-DIN, ICDM-RX/PN-DB9/RJ45-PM, ICDM-RX/PN-2DB9/RJ45-DIN, ICDM-R
B9/RJ45-DIN, ICDM-RX/PN-ST/RJ45-DIN, ICDM-RX/PN-4DB9/2RJ45-DIN, ICDM-RX/PN-DB9/RJ45-PM, ICDM-RX/PN-2DB9/RJ45-DIN, ICDM-RX/PN-2ST/RJ45-DIN, ICDM-RX/PN1-DB9/RJ45-PM, ICDM-RX/PN1-DB9/RJ45-DIN, ICDM-RX/PN1-ST/RJ45-DIN, ICDM-RX/PN1-2DB9/RJ45-DIN, ICDM-RX/PN1-4DB9/2RJ45-DIN, ICDM-RX/PN1-2ST/RJ45-DIN, ICDM-RX/EN-DB9/RJ45-DIN, ICDM-RX/EN-ST/RJ45-DIN, ICDM-RX/EN-4DB9/2RJ45-DIN, ICDM-RX/EN-DB9/RJ45-PM, ICDM-RX/EN-2DB9/RJ45-DIN, ICDM-RX/EN-2ST/RJ45-DIN, ICDM-RX/EN1-DB9/RJ45-PM, ICDM-RX/EN1-DB9/RJ45-DIN, ICDM-RX/EN1-ST/RJ45-DIN, ICDM-RX/EN1-2DB9/RJ45-DIN, ICDM-RX/EN1-4DB9/2RJ45-DIN, ICDM-RX/EN1-2ST/RJ45-DIN, ICDM-RX/MOD-DB9/RJ45-DIN, ICDM-RX/MOD-ST/RJ45-DIN, ICDM-RX/MOD-4DB9/2RJ45-DIN, ICDM-RX/MOD-DB9/R
DM-RX/EN1-2ST/RJ45-DIN, ICDM-RX/MOD-DB9/RJ45-DIN, ICDM-RX/MOD-ST/RJ45-DIN, ICDM-RX/MOD-4DB9/2RJ45-DIN, ICDM-RX/MOD-DB9/RJ45-PM, ICDM-RX/MOD-2DB9/RJ45-DIN, ICDM-RX/MOD-2ST/RJ45-DIN, ICDM-RX/MOD-16RJ45/2RJ45-PM Problem Types: CWE-79 Description: An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-033
CVE ID: CVE-2024-38503 State: PUBLISHED Published: 2024-07-22T09:46:39.285Z Last Updated: 2024-12-06T21:48:36.234Z Vendors: Apache Software Foundation Products: Apache Syncope Problem Types: CWE-79 Description: When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to version 3.0.8, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://syncope.apache.org/security#cve-2024-38503-html-tags-can-
P Vulnrichment: - CVE Program Container: References: - https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser - https://www.openwall.com/lists/oss-security/2024/07/22/3
CVE ID: CVE-2024-38504 State: PUBLISHED Published: 2024-06-18T10:42:06.643Z Last Updated: 2024-08-02T04:12:25.213Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-862 Description: In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-38505 State: PUBLISHED Published: 2024-06-18T10:42:07.098Z Last Updated: 2024-08-02T04:12:24.797Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-522 Description: In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-38506 State: PUBLISHED Published: 2024-06-18T10:42:07.422Z Last Updated: 2024-08-02T04:12:24.728Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: JetBrains Products: YouTrack Problem Types: CWE-862 Description: In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-38507 State: PUBLISHED Published: 2024-06-18T10:42:07.784Z Last Updated: 2024-08-02T04:12:24.742Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: Hub Problem Types: CWE-79 Description: In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-38508 State: PUBLISHED Published: 2024-07-26T19:44:50.100Z Last Updated: 2024-08-02T04:12:25.569Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-78 Description: A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-156781
CVE ID: CVE-2024-38509 State: PUBLISHED Published: 2024-07-26T19:45:01.471Z Last Updated: 2024-08-02T04:12:24.979Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-121 Description: A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-156781
CVE ID: CVE-2024-38510 State: PUBLISHED Published: 2024-07-26T19:45:12.150Z Last Updated: 2024-08-02T04:12:24.688Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-78 Description: A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-156781
CVE ID: CVE-2024-38511 State: PUBLISHED Published: 2024-07-26T19:45:21.293Z Last Updated: 2024-08-02T04:12:25.141Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-78 Description: A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-156781
CVE ID: CVE-2024-38512 State: PUBLISHED Published: 2024-07-26T19:45:31.829Z Last Updated: 2024-08-02T04:12:25.173Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: XClarity Controller Problem Types: CWE-78 Description: A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-156781
CVE ID: CVE-2024-38513 State: PUBLISHED Published: 2024-07-01T18:31:13.028Z Last Updated: 2024-08-02T04:12:25.224Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: gofiber Products: fiber Problem Types: CWE-384 Description: Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized a
mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability. Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk: Either implement additional validation to ensure session IDs are not supplied by the user and are securely generated by the server, or regularly rotate session IDs and enforce strict session expiration polic
er and are securely generated by the server, or regularly rotate session IDs and enforce strict session expiration policies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gofiber/fiber/security/advisories/GHSA-98j2-3j3p-fw2v - https://github.com/gofiber/fiber/commit/66a881441b27322a331f1b526cf1eb6b3358a4d8
CVE ID: CVE-2024-38514 State: PUBLISHED Published: 2024-06-28T18:11:02.964Z Last Updated: 2024-08-02T04:12:25.158Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ChatGPTNextWeb Products: ChatGPT-Next-Web Problem Types: CWE-918 Description: NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance (MKCOL, PUT and GET methods supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulner
ds supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulnerability has been patched in version 2.12.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/security/advisories/GHSA-gph5-rx77-3pjg - https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/commit/dad122199a85c2f12277593973e1784b212adf5e
CVE ID: CVE-2024-38515 State: REJECTED Published: N/A Last Updated: 2024-06-27T12:29:31.947Z Description: No description available.
CVE ID: CVE-2024-38516 State: PUBLISHED Published: 2024-06-25T20:08:50.779Z Last Updated: 2024-08-02T04:12:25.172Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: aimeos Products: ai-client-html Problem Types: CWE-1295 Description: ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/ai-client-html/security/advisories/GHSA-ppm5-jv84-2xg2 - https://github.com/ai
: References: - https://github.com/aimeos/ai-client-html/security/advisories/GHSA-ppm5-jv84-2xg2 - https://github.com/aimeos/ai-client-html/commit/bb389620ffc3cf4a2f29c11a1e5f512049e0c132
CVE ID: CVE-2024-38517 State: PUBLISHED Published: 2024-07-09T18:51:50.563Z Last Updated: 2024-09-05T08:03:35.926Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Tencent Products: RapidJSON Problem Types: CWE-191 Description: Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege. Additional Analyst Notes: - CISA A
underflow vulnerability (when the file is parsed), leading to elevation of privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38517 - https://github.com/Tencent/rapidjson/pull/1261/commits/8269bc2bc289e9d343bae51cdf6d23ef0950e001 - https://github.com/fmalita/rapidjson/commit/8269bc2bc289e9d343bae51cdf6d23ef0950e001
CVE ID: CVE-2024-38518 State: PUBLISHED Published: 2024-06-28T20:25:40.743Z Last Updated: 2024-08-02T04:12:25.127Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-284 Description: BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an attacker to join a meeting as moderator using a join link that was originally created for viewer access. This vulnerability has bee
join a meeting as moderator using a join link that was originally created for viewer access. This vulnerability has been patched in version(s) 2.6.18, 2.7.8 and 3.0.0-alpha.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4 - https://github.com/bigbluebutton/bigbluebutton/pull/20279 - https://github.com/bigbluebutton/bigbluebutton/commit/a9d436accdcd26ea66bed9f391488ac128cd62d1 - https://github.com/bigbluebutton/bigbluebutton/commit/ea6e9461dceae8fa593543d8c686f77bb8677e72
CVE ID: CVE-2024-38519 State: PUBLISHED Published: 2024-07-02T13:47:36.399Z Last Updated: 2024-08-02T04:12:25.618Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: yt-dlp, ytdl-org Products: yt-dlp, youtube-dl Problem Types: CWE-669 Description: `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since `yt-dlp` and `youtube-dl` also read config from the working directory (and on Windows executables will be executed from the `yt-dlp` or
outube-dl` also read config from the working directory (and on Windows executables will be executed from the `yt-dlp` or `youtube-dl` directory), this could lead to arbitrary code being executed. `yt-dlp` version 2024.07.01 fixes this issue by whitelisting the allowed extensions. `youtube-dl` fixes this issue in commit `d42a222` on the `master` branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have `.%(ext)s` at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make
at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one's user directory, `system32`, or other binaries locations. For users who are not able to upgrade, keep the default output template (`-o "%(title)s [%(id)s].%(ext)s`); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use `--ignore-config --config-location ...` to not load config from common locations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/y
ocations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j - https://github.com/yt-dlp/yt-dlp/commit/5ce582448ececb8d9c30c8c31f58330090ced03a - https://github.com/yt-dlp/yt-dlp/releases/tag/2024.07.01 - https://securitylab.github.com/advisories/GHSL-2024-090_yt-dlp - https://github.com/dirkf/youtube-dl/security/advisories/GHSA-22fp-mf44-f2mq - https://securitylab.github.com/advisories/GHSL-2024-089_youtube-dl/ - https://github.com/ytdl-org/youtube-dl/pull/32830 - https://github.com/ytdl-org/youtube-dl/commit/d42a222ed541b96649396ef00e19552aef0f09ec
CVE ID: CVE-2024-38520 State: PUBLISHED Published: 2024-06-26T18:59:25.088Z Last Updated: 2024-08-02T04:12:25.267Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SoftEtherVPN Products: SoftEtherVPN Problem Types: CWE-400 Description: SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it introduces the possibility of the host being used for amplification/reflection traffic generation because it will respond to every packet with two response packets that are larger than the request packet size. These sorts of techniques are used by external actors who generate spoofed source
e larger than the request packet size. These sorts of techniques are used by external actors who generate spoofed source IPs to target a destination on the internet. This vulnerability has been patched in version 5.02.5185. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SoftEtherVPN/SoftEtherVPN/security/advisories/GHSA-j35p-p8pj-vqxq - https://github.com/SoftEtherVPN/SoftEtherVPN/commit/c2a7aa548137dc80c6aafdc645cf4dc34e0dc764 - https://github.com/SoftEtherVPN/SoftEtherVPN/releases/tag/5.02.5185
CVE ID: CVE-2024-38521 State: PUBLISHED Published: 2024-06-28T15:33:21.032Z Last Updated: 2024-08-02T04:12:25.140Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: scidsg Products: hushline Problem Types: CWE-79 Description: Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the `safe` Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/scidsg/hushline/security/advisories/GHSA-4v8c-r6h2-fhh3
CVE ID: CVE-2024-38522 State: PUBLISHED Published: 2024-06-28T17:03:19.661Z Last Updated: 2024-08-02T04:12:25.177Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: scidsg Products: hushline Problem Types: CWE-183 Description: Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/scidsg/hushline/security/advisories/GHSA-r85c-95x7-4h
ichment: - CVE Program Container: References: - https://github.com/scidsg/hushline/security/advisories/GHSA-r85c-95x7-4h7q - https://github.com/scidsg/hushline/commit/2bbeae78a24ca2cd893f32a1812f5f6634cb21b6
CVE ID: CVE-2024-38523 State: PUBLISHED Published: 2024-06-27T19:23:19.488Z Last Updated: 2024-08-02T04:12:25.147Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: scidsg Products: hushline Problem Types: CWE-287 Description: Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10. Additional Analyst N
user interaction and credentials are required. This vulnerability has been patched in version 0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx - https://github.com/scidsg/hushline/pull/376
CVE ID: CVE-2024-38524 State: PUBLISHED Published: 2025-06-10T14:43:04.590Z Last Updated: 2025-06-10T14:56:58.139Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: geoserver Products: geoserver Problem Types: CWE-200 Description: GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations. This vulnerability is fixed in 2.26.2 and 2.25.6. Additional Analyst Notes: - CISA
at defaults to showing the locations. This vulnerability is fixed in 2.26.2 and 2.25.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-jm79-7xhw-6f6f - https://github.com/GeoWebCache/geowebcache/issues/1344 - https://github.com/GeoWebCache/geowebcache/pull/1345 - https://github.com/geoserver/geoserver/pull/8189 - https://osgeo-org.atlassian.net/browse/GEOS-11677
CVE ID: CVE-2024-38525 State: PUBLISHED Published: 2024-06-28T21:10:57.138Z Last Updated: 2024-08-02T04:12:25.118Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: DataDog Products: dd-trace-cpp Problem Types: CWE-20, CWE-248 Description: dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the `nlohmann` JSON library. However, due to the way the JSON library is invoked, it throws an uncaught exception, which results in a crash. This vulnerability has been patched in version 0.2.2. Additional Analyst Notes: - CISA ADP Vulnrich
results in a crash. This vulnerability has been patched in version 0.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-rf3p-mg22-qv6w - https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.2