Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272079. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272079 - https://vuldb.com/?ctiid.272079 - https://vuldb.com/?submit.377755 - https://github.com/DeepMountains/Mirage/blob/main/CVE6-3.md
CVE ID: CVE-2024-6958 State: PUBLISHED Published: 2024-07-21T15:00:04.983Z Last Updated: 2024-08-01T21:45:38.431Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: University Management System Problem Types: CWE-434 Description: A vulnerability classified as critical was found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /st_update.php of the component Avatar File Handler. The manipulation of the argument personal_image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272080. Add
y. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272080. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272080 - https://vuldb.com/?ctiid.272080 - https://vuldb.com/?submit.377756 - https://github.com/DeepMountains/Mirage/blob/main/CVE6-4.md
CVE ID: CVE-2024-6959 State: PUBLISHED Published: 2024-10-13T12:28:19.491Z Last Updated: 2024-11-03T18:27:25.639Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-352 Description: A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each character, rendering lollms-webui inaccessible. This issue is exacerbated by the lack of Cross-Site Request Forgery (CSRF) protection, enabling remote exploitation. The vul
issue is exacerbated by the lack of Cross-Site Request Forgery (CSRF) protection, enabling remote exploitation. The vulnerability leads to service disruption, resource exhaustion, and extended downtime. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6394d32e-f35c-418a-95b8-e7254ed0bc8e
CVE ID: CVE-2024-6960 State: PUBLISHED Published: 2024-07-21T09:55:20.625Z Last Updated: 2024-11-25T12:47:17.311Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Problem Types: CWE-502 Description: The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized (no class whitelist). An attacker can construct a crafted Iced model that uses Java gadgets and leads to arbitrary code execution when imported to the H2O platform. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
itrary code execution when imported to the H2O platform. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/h2o-model-deserialization-rce-jfsa-2024-001035518/
CVE ID: CVE-2024-6961 State: PUBLISHED Published: 2024-07-21T10:49:54.782Z Last Updated: 2024-11-25T12:48:07.911Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Problem Types: CWE-611 Description: RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/guardrails-rail-xxe-jfsa-2024-001035519/
CVE ID: CVE-2024-6962 State: PUBLISHED Published: 2024-07-21T23:31:04.452Z Last Updated: 2024-08-01T21:45:38.401Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: O3 Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda O3 1.0.0.10. This vulnerability affects the function formQosSet. The manipulation of the argument remark/ipRange/upSpeed/downSpeed/enable leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272116. NOTE: The vendor was contacted early about this disclosure but did not respond in any
this vulnerability is VDB-272116. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272116 - https://vuldb.com/?ctiid.272116 - https://vuldb.com/?submit.374583 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/formQosSet.md
CVE ID: CVE-2024-6963 State: PUBLISHED Published: 2024-07-22T00:00:07.045Z Last Updated: 2024-08-01T21:45:38.332Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: O3 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. This issue affects the function formexeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272117 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Add
ed to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272117 - https://vuldb.com/?ctiid.272117 - https://vuldb.com/?submit.374584 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/formexeCommand.md
CVE ID: CVE-2024-6964 State: PUBLISHED Published: 2024-07-22T01:00:06.939Z Last Updated: 2024-08-01T21:45:38.426Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: O3 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Affected is the function fromDhcpSetSer. The manipulation of the argument dhcpEn/startIP/endIP/preDNS/altDNS/mask/gateway leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272118 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure b
DB-272118 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272118 - https://vuldb.com/?ctiid.272118 - https://vuldb.com/?submit.374585 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/fromDhcpSetSer.md
CVE ID: CVE-2024-6965 State: PUBLISHED Published: 2024-07-22T01:31:04.351Z Last Updated: 2024-08-01T21:45:38.398Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: O3 Problem Types: CWE-121 Description: A vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Affected by this vulnerability is the function fromVirtualSet. The manipulation of the argument ip/localPort/publicPort/app leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272119. NOTE: The vendor was contacted early about this disclosure but did n
ted identifier of this vulnerability is VDB-272119. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272119 - https://vuldb.com/?ctiid.272119 - https://vuldb.com/?submit.374586 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/fromVirtualSet.md
CVE ID: CVE-2024-6966 State: PUBLISHED Published: 2024-07-22T02:00:05.784Z Last Updated: 2024-08-01T21:45:38.432Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Blood Bank Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file login.php of the component Login. The manipulation of the argument user/pass leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272120. Addi
. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272120. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272120 - https://vuldb.com/?ctiid.272120 - https://vuldb.com/?submit.378097 - https://github.com/HermesCui/CVE/issues/1
CVE ID: CVE-2024-6967 State: PUBLISHED Published: 2024-07-22T02:31:04.286Z Last Updated: 2024-08-01T21:45:38.442Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee and Visitor Gate Pass Logging System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been classified as critical. This affects an unknown part of the file /employee_gatepass/admin/?page=employee/manage_employee. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-2
ible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272121 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272121 - https://vuldb.com/?ctiid.272121 - https://vuldb.com/?submit.378101 - https://github.com/rtsjx-cve/cve/blob/main/sql.md
CVE ID: CVE-2024-6968 State: PUBLISHED Published: 2024-07-22T03:00:04.942Z Last Updated: 2024-08-01T21:45:38.402Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /print_patients_visits.php. The manipulation of the argument from/to leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272122 is the identifier assigned to this vulnerability. Addition
has been disclosed to the public and may be used. VDB-272122 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272122 - https://vuldb.com/?ctiid.272122 - https://vuldb.com/?submit.378107 - https://github.com/Xu-Mingming/cve/blob/main/sql3.md
CVE ID: CVE-2024-6969 State: PUBLISHED Published: 2024-07-22T03:31:04.086Z Last Updated: 2024-08-01T21:45:38.373Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/get_patient_history.php. The manipulation of the argument patient_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272123.
xploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272123. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272123 - https://vuldb.com/?ctiid.272123 - https://vuldb.com/?submit.378108 - https://github.com/Xu-Mingming/cve/blob/main/sql4.md
CVE ID: CVE-2024-6970 State: PUBLISHED Published: 2024-07-22T04:00:05.170Z Last Updated: 2024-08-01T21:45:38.403Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /staffcatadd.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272124. Additional Analyst Notes: - CISA ADP Vulnrichment:
and may be used. The identifier of this vulnerability is VDB-272124. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272124 - https://vuldb.com/?ctiid.272124 - https://vuldb.com/?submit.378239 - https://github.com/nosaltsea/cve/issues/1
CVE ID: CVE-2024-6971 State: PUBLISHED Published: 2024-10-11T12:14:13.156Z Last Updated: 2024-10-11T14:34:23.637Z Severity: LOW (CVSS 3.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-22 Description: A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_database`, `toggle_mount_rag_database`, and `vectorize_folder` do not implement security measures such as `sanitize_path_from_endpoint` or `sanitize_path`. This allows an attacker to perform vectorize operations on `.sqlite` files in any directory on the victim's computer, potentially
ws an attacker to perform vectorize operations on `.sqlite` files in any directory on the victim's computer, potentially installing multiple packages and causing a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/fbfe7cd0-99fb-4305-bd07-8b573364109e
CVE ID: CVE-2024-6972 State: PUBLISHED Published: 2024-07-25T05:16:49.256Z Last Updated: 2024-11-26T15:37:28.586Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Octopus Deploy Products: Octopus Server Problem Types: Sensitive Variables exposed in TaskLogs Description: In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.octopus.com/post/2024/sa2024-06/
CVE ID: CVE-2024-6973 State: PUBLISHED Published: 2024-07-31T16:55:20.505Z Last Updated: 2024-08-06T19:09:57.379Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cato Networks Products: SDP Client Problem Types: CWE-20 Description: Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.catonetworks.com/hc/en-us/articles/19756987454237-CVE-2024-6973-Windows-SDP-Client-Remote-Code-Execution-via-crafted-URLs
CVE ID: CVE-2024-6974 State: PUBLISHED Published: 2024-07-31T16:55:40.104Z Last Updated: 2024-07-31T19:53:51.141Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Cato Networks Products: SDP Client Problem Types: CWE-426, CWE-276 Description: Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.catonetworks.com/hc/en-us/articles/19762641007133-CVE-2024-6974-Windows-SDP-Client-Local-Privilege-Escalation-via-self-upgrade
CVE ID: CVE-2024-6975 State: PUBLISHED Published: 2024-07-31T16:55:55.599Z Last Updated: 2024-08-01T08:56:42.944Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Cato Networks Products: SDP Client Problem Types: CWE-426 Description: Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.catonetworks.com/hc/en-us/articles/19758025406621-CVE-2024-6975-Windows-SDP-Client-Local-Privilege-Escalation-via-openssl-configuration-file
CVE ID: CVE-2024-6977 State: PUBLISHED Published: 2024-07-31T16:56:06.000Z Last Updated: 2024-07-31T17:08:09.827Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Cato Networks Products: SDP Client Problem Types: CWE-532 Description: A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover. However, the attack requires bypassing protections on modifying the tunnel token on a the attacker's system.This issue affects SDP Client: before 5.10.34. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.catonetworks.com/hc/en-us/articles/197
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.catonetworks.com/hc/en-us/articles/19766795729437-CVE-2024-6977-Windows-SDP-Client-Sensitive-data-in-trace-logs-can-lead-to-account-takeover
CVE ID: CVE-2024-6978 State: PUBLISHED Published: 2024-07-31T16:56:16.063Z Last Updated: 2024-07-31T19:55:16.797Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Cato Networks Products: SDP Client Problem Types: CWE-20 Description: Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users.This issue affects SDP Client: before 5.10.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.catonetworks.com/hc/en-us/articles/19767051500957-CVE-2024-6978-Windows-SDP-Client-Local-root-certificates-can-be-installed-with-low-privileged-users
CVE ID: CVE-2024-6979 State: PUBLISHED Published: 2024-09-10T05:07:42.554Z Last Updated: 2025-03-28T07:24:34.043Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-863 Description: Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of account passwords and social engineering attacks in tricking the administrator to perform specific configurations on operator- an
asswords and social engineering attacks in tricking the administrator to perform specific configurations on operator- and/or viewer-privileged accounts. Axis has released patched AXIS OS a version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/c3/44/5b/cve-2024-6979-en-US-448997.pdf
CVE ID: CVE-2024-6980 State: PUBLISHED Published: 2024-07-31T06:58:44.781Z Last Updated: 2024-07-31T14:25:18.592Z Vendors: Bitdefender Products: GravityZone Update Server Problem Types: CWE-209 Description: A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/consumer/support/support/security-advisories/verbose-error-handling-issue-in-gravityzone-update-server-proxy-service/
CVE ID: CVE-2024-6981 State: PUBLISHED Published: 2024-09-27T16:11:26.742Z Last Updated: 2024-09-27T16:37:39.401Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OMNTEC Products: Proteus Tank Monitoring Problem Types: CWE-306 Description: OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without proper authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-06
CVE ID: CVE-2024-6982 State: PUBLISHED Published: 2025-03-20T10:10:31.983Z Last Updated: 2025-03-20T18:20:14.175Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-94 Description: A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's `eval()` function to evaluate mathematical expressions within a Python sandbox that disables `__builtins__` and only allows functions from the `math` module. This sandbox can be bypassed by loading the `os` module using the `_frozen_importlib.BuiltinImporter` class, allowing an atta
sandbox can be bypassed by loading the `os` module using the `_frozen_importlib.BuiltinImporter` class, allowing an attacker to execute arbitrary commands on the server. The issue is fixed in version 9.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4f8e73ac-aaaf-4d5c-a6dd-58215b5a7fea - https://github.com/parisneo/lollms/commit/30e7eaba2ccfb751a81e7cb29fdef2ae8ffa6832
CVE ID: CVE-2024-6983 State: PUBLISHED Published: 2024-09-27T15:43:51.011Z Last Updated: 2024-09-27T17:48:42.450Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mudler Products: mudler/localai Problem Types: CWE-94 Description: mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the attacker gaining full control over the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f9
control over the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f91fb287-412e-4c89-87df-9e4b6e609647 - https://github.com/mudler/localai/commit/d02a0f6f01d5c4a926a2d67190cb55d7aca23b66
CVE ID: CVE-2024-6984 State: PUBLISHED Published: 2024-07-29T14:04:05.925Z Last Updated: 2024-08-01T21:45:38.419Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Canonical Ltd. Products: Juju Problem Types: CWE-209 Description: An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2 - https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxh
ju/commit/da929676853092a29ddf8d589468cf85ba3efaf2 - https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx - https://www.cve.org/CVERecord?id=CVE-2024-6984