Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37828 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-21T14:42:38.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) in Vermeg Agile Reporter v23.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field under the Set Broadcast Message module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vermeg.com/agile-reporter/ - https://crashpark.weebly.com/blog/2-stored-xss-in-agilereporter-213-by-vermeg
CVE ID: CVE-2024-37829 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T03:57:39.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-37829
CVE ID: CVE-2024-37830 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T03:57:39.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Outline <= v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-37830
CVE ID: CVE-2024-37831 State: PUBLISHED Published: 2024-06-14T00:00:00 Last Updated: 2024-08-02T03:57:39.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ganzhi-qcy/cve/issues/5
CVE ID: CVE-2024-37840 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:57:39.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remote attackers to execute arbitrary SQL commands via the LessonID parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ganzhi-qcy/cve/issues/4
CVE ID: CVE-2024-37843 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-08-02T03:57:39.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphql
CVE ID: CVE-2024-37844 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-28T13:56:31.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in MangoOS before 5.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/herombey/Disclosures/tree/main - https://github.com/herombey/Disclosures/blob/main/CVE-2024-37844%20XSS.pdf
CVE ID: CVE-2024-37845 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T17:22:20.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: MangoOS before 5.2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Process Command feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/herombey/Disclosures/tree/main - https://github.com/herombey/Disclosures/blob/main/CVE-2024-37845%20RCE.pdf
CVE ID: CVE-2024-37846 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T17:32:23.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: MangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection (CSTI) vulnerability via the Platform Management Edit page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/herombey/Disclosures/tree/main - https://github.com/herombey/Disclosures/blob/main/CVE-2024-37846-CSTI.pdf
CVE ID: CVE-2024-37847 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T17:42:38.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in MangoOS before 5.1.4 and Mango API before 4.5.5 allows attackers to execute arbitrary code via a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/herombey/Disclosures/tree/main - https://github.com/herombey/Disclosures/blob/main/CVE-2024-37847%20File%20Upload%20Path%20Traversal.pdf
CVE ID: CVE-2024-37848 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:57:39.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Online-Bookstore-Project-In-PHP v1.0 allows a local attacker to execute arbitrary code via the admin_delete.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Lanxiy7th/lx_CVE_report-/issues/13
CVE ID: CVE-2024-37849 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-15T15:09:07.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability in itsourcecode Billing System 1.0 allows a local attacker to execute arbitrary code in process.php via the username parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ganzhi-qcy/cve/issues/3
CVE ID: CVE-2024-37855 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-08-02T03:57:39.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute arbitrary code via the router's Telnet port 2345 without requiring authentication credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sudo-subho/nepstech-xpon-router-rce
CVE ID: CVE-2024-37856 State: PUBLISHED Published: 2024-07-29T00:00:00 Last Updated: 2024-10-30T19:32:48.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, middle name fields in the User Profile page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sourcecodester.com/ - http://lost.com - https://packetstormsecurity.com/files/179078/Lost-And-Found-Information-System-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2024-37857 State: PUBLISHED Published: 2024-07-29T00:00:00 Last Updated: 2024-08-02T03:57:39.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via id parameter to php-lfis/admin/categories/view_category.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sourcecodester.com/ - http://lost.com - https://packetstormsecurity.com/files/179080/Lost-And-Found-Information-System-1.0-SQL-Injection.html
CVE ID: CVE-2024-37858 State: PUBLISHED Published: 2024-07-29T00:00:00 Last Updated: 2024-08-02T03:57:39.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sourcecodester.com/ - http://lost.com - https://packetstormsecurity.com/files/179079/Lost-And-Found-Information-System-1.0-SQL-Injection.html
CVE ID: CVE-2024-37859 State: PUBLISHED Published: 2024-07-29T00:00:00 Last Updated: 2024-08-02T03:57:39.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parameter to php-lfis/admin/index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sourcecodester.com/ - http://lost.com - https://packetstormsecurity.com/files/179081/Lost-And-Found-Information-System-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2024-37860 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-06T19:54:23.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Open Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute arbitrary code via a crafted .yaml file to the nav2_amcl process Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4336 - https://github.com/ros-navigation/navigation2/issues/4339 - https://github.com/ros-navigation/navigation2/issues/4005 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-37861 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-06T19:46:42.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. This vulnerability is triggered via sending a crafted .yaml file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4005 - https://github.com/ros-navigation/navigation2/issues/4335 - https://github.com/ros-navigation/navigation2/issues/4338 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-37862 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-06T19:28:06.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Open Robotic Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute arbitrary code via a crafted .yaml file to the nav2_planner process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4005 - https://github.com/ros-navigation/navigation2/issues/4062 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-37863 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-06T19:42:57.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. This vulnerability is triggered via sending a crafted .yaml file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4005 - https://github.com/ros-navigation/navigation2/issues/4337 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-37865 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-10-28T20:49:47.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in S3Browser v.11.4.5 and v.10.9.9 and fixed in v.11.5.7 allows a remote attacker to obtain sensitive information via the S3 compatible storage component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/iTrooz/629bd30cfa09cc527a0859e8cca83a4b
CVE ID: CVE-2024-37868 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T22:16:36.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "sendreply.php" file, and the uploaded file was received using the "$- FILES" variable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TERRENCE-REX/CVE/issues/1 - https://gist.github.com/TERRENCE-REX/bfca92171143e28899bb8511f311f9ed
CVE ID: CVE-2024-37869 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T22:16:26.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "poster.php" file, and the uploaded file was received using the "$- FILES" variable Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TERRENCE-REX/CVE/issues/2 - https://gist.github.com/TERRENCE-REX/7e5dfdd3583bf9fd81196f557a8b8879
CVE ID: CVE-2024-37870 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T03:57:40.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in processscore.php in Learning Management System Project In PHP With Source Code 1.0 allows attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TThuyyy/cve1/issues/3
CVE ID: CVE-2024-37871 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T03:57:39.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in login.php in Itsourcecode Online Discussion Forum Project in PHP with Source Code 1.0 allows remote attackers to execute arbitrary SQL commands via the email parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TThuyyy/cve1/issues/1
CVE ID: CVE-2024-37872 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T03:57:39.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in process.php in Itsourcecode Billing System in PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the username parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TThuyyy/cve1/issues/4
CVE ID: CVE-2024-37873 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T03:57:40.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in view_payslip.php in Itsourcecode Payroll Management System Project In PHP With Source Code 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TThuyyy/cve1/issues/2
CVE ID: CVE-2024-37877 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-02T03:57:40.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: UERANSIM before 3.2.6 allows out-of-bounds read when a RLS packet is sent to gNodeB with malformed PDU length. This occurs in function readOctetString in src/utils/octet_view.cpp and in function DecodeRlsMessage in src/lib/rls/rls_pdu.cpp Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/f4rs1ght/vuln-research/tree/main/CVE-2024-37877
CVE ID: CVE-2024-37878 State: PUBLISHED Published: 2024-06-12T00:00:00.000Z Last Updated: 2025-03-13T13:27:18.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary code via the /TWCMS-gh-pages/twcms/runtime/twcms_view/default,index.htm.php" PHP directly echoes parameters input from external sources Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/sylvieverykawaii/243f1756151bee027725c6961d8c1ba9
CVE ID: CVE-2024-37879 State: PUBLISHED Published: 2024-09-20T00:00:00 Last Updated: 2024-11-01T20:47:08.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitrary code via the fields "siteTitle", "siteIco" and "siteLogo". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usvn.info/news.html - https://github.com/usvn/usvn/commit/6b4678954fca9635154743b95ff9c8947cf5f46f - https://github.com/usvn/usvn/releases/tag/1.0.12 - https://www.usvn.info/2024/06/09/usvn-1.0.12
CVE ID: CVE-2024-37880 State: PUBLISHED Published: 2024-06-10T00:00:00 Last Updated: 2024-08-02T03:57:39.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a timing side channel that allows attackers to recover an ML-KEM 512 secret key in minutes. This occurs because poly_frommsg in poly.c does not prevent Clang from emitting a vulnerable secret-dependent branch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pqshield.com/pqshield-plugs-timing-leaks-in-kyber-ml-kem-to-improve-pqc-implementation-m
ontainer: References: - https://pqshield.com/pqshield-plugs-timing-leaks-in-kyber-ml-kem-to-improve-pqc-implementation-maturity/ - https://github.com/antoonpurnal/clangover - https://github.com/pq-crystals/kyber/commit/9b8d30698a3e7449aeb34e62339d4176f11e3c6c - https://news.ycombinator.com/item?id=40577486 - https://twitter.com/purnaltoon/status/1797644696568959476
CVE ID: CVE-2024-37881 State: PUBLISHED Published: 2024-06-19T06:29:52.146Z Last Updated: 2024-08-02T03:57:39.870Z Vendors: EG Secure Solutions Inc. Products: SiteGuard WP Plugin Problem Types: Insertion of Sensitive Information Into Sent Data Description: SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a measure to avoid redirection from wp-register.php. As a result, the customized path to the login page may be exposed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
the login page may be exposed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jp-secure.com/siteguard_wp_plugin_en/vuls/WPV2024001_en.html - https://plugins.trac.wordpress.org/changeset/3094238/siteguard/trunk/classes/siteguard-rename-login.php?old=2888160&old_path=siteguard%2Ftrunk%2Fclasses%2Fsiteguard-rename-login.php - https://jvn.jp/en/jp/JVN60331535/
CVE ID: CVE-2024-37882 State: PUBLISHED Published: 2024-06-14T15:28:00.462Z Last Updated: 2024-08-02T03:57:39.988Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://githu
7.1.8 or 28.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmq - https://github.com/nextcloud/server/pull/44339 - https://hackerone.com/reports/2289425
CVE ID: CVE-2024-37883 State: PUBLISHED Published: 2024-06-14T15:33:18.525Z Last Updated: 2024-08-02T03:57:39.902Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Co
.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8 - https://github.com/nextcloud/deck/pull/5423 - https://hackerone.com/reports/2289333
CVE ID: CVE-2024-37884 State: PUBLISHED Published: 2024-06-14T15:36:16.181Z Last Updated: 2024-09-03T16:01:08.371Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
graded to 26.0.12 or 27.1.7 or 28.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8c - https://github.com/nextcloud/server/pull/43727 - https://hackerone.com/reports/2290680
CVE ID: CVE-2024-37885 State: PUBLISHED Published: 2024-06-14T15:42:42.132Z Last Updated: 2024-08-02T03:57:39.894Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-94 Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - htt
ent is upgraded to 3.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mf7-v63m-99p7 - https://github.com/nextcloud/desktop/pull/6378 - https://hackerone.com/reports/2307625
CVE ID: CVE-2024-37886 State: PUBLISHED Published: 2024-06-14T15:45:12.913Z Last Updated: 2024-08-02T03:57:40.025Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-347 Description: user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/ad
SA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw5h-29xf-g55g - https://github.com/nextcloud/user_oidc/pull/715 - https://hackerone.com/reports/1878391