Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-21502 State: PUBLISHED Published: 2024-02-24T05:00:01.602Z Last Updated: 2024-11-01T18:49:11.129Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: fastecdsa Problem Types: CWE-457 Description: Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt all
dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PYTHON-FASTECDSA-6262045 - https://gist.github.com/keltecc/49da037072276f21b005a8337c15db26 - https://github.com/AntonKueltz/fastecdsa/blob/v2.3.1/src/curveMath.c%23L210 - https://github.com/AntonKueltz/fastecdsa/commit/57fc5689c95d649dab7ef60cc99ac64589f01e36
CVE ID: CVE-2024-21503 State: PUBLISHED Published: 2024-03-19T05:00:01.474Z Last Updated: 2024-08-01T22:20:40.916Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: black Problem Types: CWE-1333 Description: Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your doc
possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PYTHON-BLACK-6256273 - https://github.com/psf/black/releases/tag/24.3.0 - https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8
CVE ID: CVE-2024-21504 State: PUBLISHED Published: 2024-03-19T05:00:00.698Z Last Updated: 2024-08-27T20:55:55.163Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: livewire/livewire Problem Types: CWE-79 Description: Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-LI
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222 - https://github.com/livewire/livewire/releases/tag/v3.4.9 - https://github.com/livewire/livewire/pull/8117 - https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0
CVE ID: CVE-2024-21505 State: PUBLISHED Published: 2024-03-25T05:00:00.749Z Last Updated: 2024-08-23T19:10:40.905Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: web3-utils Problem Types: CWE-1321 Description: Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pr
otype by passing specially crafted input to these functions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-WEB3UTILS-6229337 - https://github.com/web3/web3.js/commit/8ed041c6635d807b3da8960ad49e125e3d1b0e80
CVE ID: CVE-2024-21506 State: REJECTED Published: 2024-04-06T05:00:00.699Z Last Updated: 2024-06-05T15:02:55.230Z Description: No description available.
CVE ID: CVE-2024-21507 State: PUBLISHED Published: 2024-04-10T05:00:01.727Z Last Updated: 2024-09-18T14:46:37.140Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P) Vendors: n/a Products: mysql2 Problem Types: CWE-20 Description: Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591300 - https://github.com/sidorares/node-mysql2/commit/0d54b0c
rences: - https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591300 - https://github.com/sidorares/node-mysql2/commit/0d54b0ca6498c823098426038162ef10df02c818 - https://blog.slonser.info/posts/mysql2-attacker-configuration/ - https://github.com/sidorares/node-mysql2/pull/2424
CVE ID: CVE-2024-21508 State: PUBLISHED Published: 2024-04-11T05:00:00.748Z Last Updated: 2024-08-01T22:20:40.908Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: mysql2 Problem Types: CWE-94 Description: Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085 - https://blog.slonser.info/posts/mysql2-attacker-configuration/ - https://github.com/sidorares/no
NYK-JS-MYSQL2-6591085 - https://blog.slonser.info/posts/mysql2-attacker-configuration/ - https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21 - https://github.com/sidorares/node-mysql2/pull/2572 - https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805 - https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
CVE ID: CVE-2024-21509 State: PUBLISHED Published: 2024-04-10T05:00:00.795Z Last Updated: 2024-08-22T13:11:18.154Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P) Vendors: n/a Products: mysql2 Problem Types: CWE-1321 Description: Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084 - https://blog.slonser.info/posts/mysql2-attacker-configuration/ - https://
security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084 - https://blog.slonser.info/posts/mysql2-attacker-configuration/ - https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134 - https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691 - https://github.com/sidorares/node-mysql2/pull/2574 - https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
CVE ID: CVE-2024-21510 State: PUBLISHED Published: 2024-11-01T05:00:04.821Z Last Updated: 2024-11-18T12:19:21.911Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: sinatra Problem Types: CWE-807 Description: Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header
r caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-RUBY-SINATRA-6483832 - https://github.com/sinatra/sinatra/blob/b626e2d82c23b4fde0b51782fd32ca27ccde1d1a/lib/sinatra/base.rb%23L319 - https://github.com/sinatra/sinatra/blob/b626e2d82c23b4fde0b51782fd32ca27ccde1d1a/lib/sinatra/base.rb%23L323C1-L343C17 - https://github.com/sinatra/sinatra/pull/2010
CVE ID: CVE-2024-21511 State: PUBLISHED Published: 2024-04-23T05:00:00.602Z Last Updated: 2024-08-01T22:20:40.911Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: mysql2 Problem Types: CWE-94 Description: Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046 - https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7 - https://gi
security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046 - https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7 - https://github.com/sidorares/node-mysql2/pull/2608 - https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713
CVE ID: CVE-2024-21512 State: PUBLISHED Published: 2024-05-29T05:00:01.515Z Last Updated: 2024-08-01T22:20:40.900Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P) Vendors: n/a Products: mysql2, org.webjars.npm:mysql2 Problem Types: CWE-1321 Description: Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010 - https://gist.github.com/domdomi3/e9f0
S-MYSQL2-6861580 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010 - https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a - https://github.com/sidorares/node-mysql2/pull/2702 - https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
CVE ID: CVE-2024-21513 State: PUBLISHED Published: 2024-07-15T05:00:04.083Z Last Updated: 2024-08-01T22:20:40.879Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P) Vendors: n/a Products: langchain-experimental Problem Types: CWE-94 Description: Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if they can control the input prompt and the server is configured with VectorSQLDatabaseChain. **Notes:** Impact on the Confidentiality, I
l the input prompt and the server is configured with VectorSQLDatabaseChain. **Notes:** Impact on the Confidentiality, Integrity and Availability of the vulnerable component: Confidentiality: Code execution happens within the impacted component, in this case langchain-experimental, so all resources are necessarily accessible. Integrity: There is nothing protected by the impacted component inherently. Although anything returned from the component counts as 'information' for which the trustworthiness can be compromised. Availability: The loss of availability isn't caused by the attack itself, but it happens as a result during the attacker's post-exploitation steps. Impact on the Confidentialit
he attack itself, but it happens as a result during the attacker's post-exploitation steps. Impact on the Confidentiality, Integrity and Availability of the subsequent system: As a legitimate low-privileged user of the package (PR:L) the attacker does not have more access to data owned by the package as a result of this vulnerability than they did with normal usage (e.g. can query the DB). The unintended action that one can perform by breaking out of the app environment and exfiltrating files, making remote connections etc. happens during the post exploitation phase in the subsequent system - in this case, the OS. AT:P: An attacker needs to be able to influence the input prompt, whilst the s
subsequent system - in this case, the OS. AT:P: An attacker needs to be able to influence the input prompt, whilst the server is configured with the VectorSQLDatabaseChain plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PYTHON-LANGCHAINEXPERIMENTAL-7278171 - https://github.com/langchain-ai/langchain/blob/672907bbbb7c38bf19787b78e4ffd7c8a9026fe4/libs/experimental/langchain_experimental/sql/vector_sql.py%23L81 - https://github.com/langchain-ai/langchain/commit/7b13292e3544b2f5f2bfb8a27a062ea2b0c34561
CVE ID: CVE-2024-21514 State: PUBLISHED Published: 2024-06-22T05:00:04.158Z Last Updated: 2024-08-01T22:20:41.029Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P) Vendors: n/a Products: opencart/opencart Problem Types: CWE-89 Description: This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed (it does not have to be enabled), it is possible to exploit SQL injection to gain unauthorised access to the backend database. For any site which is vulne
it is possible to exploit SQL injection to gain unauthorised access to the backend database. For any site which is vulnerable, any unauthenticated user could exploit this to dump the entire OpenCart database, including customer PII data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266565 - https://github.com/opencart/opencart/blob/3.0.3.9/upload/catalog/model/extension/payment/divido.php%23L114 - https://github.com/opencart/opencart/commit/46bd5f5a8056ff9aad0aa7d71729c4cf593d67e2
CVE ID: CVE-2024-21515 State: PUBLISHED Published: 2024-06-22T05:00:01.411Z Last Updated: 2025-01-14T16:27:07.135Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: opencart/opencart Problem Types: CWE-79 Description: This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically executing. If the attacked user has admin privileges, this vulne
gain upon authentication with the payload automatically executing. If the attacked user has admin privileges, this vulnerability could be used as the start of a chain of exploits like Zip Slip or arbitrary file write vulnerabilities in the admin functionality. **Notes:** 1) This is only exploitable if the attacker knows the name or path of the admin directory. The name of the directory is "admin" by default but there is a pop-up in the dashboard warning users to rename it. 2) The fix for this vulnerability is incomplete. The redirect is removed so that it is not possible for an attacker to control the redirect post admin login anymore, but it is still possible to exploit this issue in admin
r an attacker to control the redirect post admin login anymore, but it is still possible to exploit this issue in admin if the user is authenticated as an admin already. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266573 - https://github.com/opencart/opencart/commit/c546199e8f100c1f3797a7a9d3cf4db1887399a2
CVE ID: CVE-2024-21516 State: PUBLISHED Published: 2024-06-22T05:00:05.568Z Last Updated: 2025-01-14T16:25:31.112Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: opencart/opencart Problem Types: CWE-79 Description: This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue was identified in the directory parameter of admin common/filemanager.list route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically executing. If the attacked user h
mpted to login and redirected again upon authentication with the payload automatically executing. If the attacked user has admin privileges, this vulnerability could be used as the start of a chain of exploits like Zip Slip or arbitrary file write vulnerabilities in the admin functionality. **Notes:** 1) This is only exploitable if the attacker knows the name or path of the admin directory. The name of the directory is "admin" by default but there is a pop-up in the dashboard warning users to rename it. 2) The fix for this vulnerability is incomplete. The redirect is removed so that it is not possible for an attacker to control the redirect post admin login anymore, but it is still possible
d so that it is not possible for an attacker to control the redirect post admin login anymore, but it is still possible to exploit this issue in admin if the user is authenticated as an admin already. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266576 - https://github.com/opencart/opencart/commit/c546199e8f100c1f3797a7a9d3cf4db1887399a2
CVE ID: CVE-2024-21517 State: PUBLISHED Published: 2024-06-22T05:00:02.595Z Last Updated: 2025-01-14T16:25:06.844Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: opencart/opencart Problem Types: CWE-79 Description: This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login route. An attacker can inject arbitrary HTML and Javascript into the page response. As this vulnerability is present in the account functionality it could be used to target and attack customers of the OpenCart shop. **Notes:** 1) The fix for this vulnerability is incomplete
be used to target and attack customers of the OpenCart shop. **Notes:** 1) The fix for this vulnerability is incomplete Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266577 - https://github.com/opencart/opencart/commit/0fd1ee4b6c94366bf3e5d3831a8336f3275d1860
CVE ID: CVE-2024-21518 State: PUBLISHED Published: 2024-06-22T05:00:03.429Z Last Updated: 2024-08-01T22:20:40.981Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: opencart/opencart Problem Types: CWE-29 Description: This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability. A
rbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266578 - https://github.com/opencart/opencart/blob/04c1724370ab02967d3b4f668c1b67771ecf1ff4/upload/admin/controller/marketplace/installer.php%23L383C1-L383C1
CVE ID: CVE-2024-21519 State: PUBLISHED Published: 2024-06-22T05:00:04.894Z Last Updated: 2024-08-01T22:20:40.947Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: opencart/opencart Problem Types: CWE-20 Description: This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality. By injecting PHP code into the database, an attacker with admin privileges can create a backup file with an arbitrary filename (including the extension), within /system/storage/backup. **Note:** It is less likely for the created file to be available within the web root,
), within /system/storage/backup. **Note:** It is less likely for the created file to be available within the web root, as part of the security recommendations for the application suggest moving the storage path outside of the web root. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266579 - https://github.com/opencart/opencart/blob/4.0.2.3/upload/admin/controller/tool/upload.php%23L353
CVE ID: CVE-2024-21520 State: PUBLISHED Published: 2024-06-26T05:00:02.490Z Last Updated: 2024-12-31T10:10:34.187Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: djangorestframework Problem Types: CWE-79 Description: Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PYTHON-DJANGORESTFRAMEWORK-7252137 - https://github.com/encode/django-rest-fram
es: - https://security.snyk.io/vuln/SNYK-PYTHON-DJANGORESTFRAMEWORK-7252137 - https://github.com/encode/django-rest-framework/pull/9435 - https://github.com/encode/django-rest-framework/commit/3b41f0124194430da957b119712978fa2266b642
CVE ID: CVE-2024-21521 State: PUBLISHED Published: 2024-07-10T05:00:05.872Z Last Updated: 2025-01-26T16:12:38.405Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: @discordjs/opus Problem Types: CWE-400 Description: All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toString to several different functions. Exploiting this vulnerability could lead to a system crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-DISCORDJSOPUS-6370643 - https://github.com/discordjs/opus/blob/814e500c
erences: - https://security.snyk.io/vuln/SNYK-JS-DISCORDJSOPUS-6370643 - https://github.com/discordjs/opus/blob/814e500c2785c5207ace19650192629beba2728b/src/node-opus.cc%23L47 - https://gist.github.com/dellalibera/98c48fd74bb240adbd7841a5c02aba9e