deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-33060
Published: 2024-02-06
Description: Transient DOS in Core when DDR memory check is called while DDR is not initialized.
CVSS Score: 7.1 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33064
Published: 2024-02-06
Description: Transient DOS in Audio when invoking callback function of ASM driver.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33065
Published: 2024-02-06
Description: Information disclosure in Audio while accessing AVCS services from ADSP payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33067
Published: 2024-02-06
Description: Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-823, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33068
Published: 2024-02-06
Description: Memory corruption in Audio while processing IIR config data from AFE calibration block.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33069
Published: 2024-02-06
Description: Memory corruption in Audio while processing the calibration data returned from ACDB loader.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33072
Published: 2024-02-06
Description: Memory corruption in Core while processing control functions.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33076
Published: 2024-02-06
Description: Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-16, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-33077
Published: 2024-02-06
Description: Memory corruption in HLOS while converting from authorization token to HIDL vector.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43513
Published: 2024-02-06
Description: Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
CVSS Score: 7.8 (HIGH)
CWE: CWE-823, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43516
Published: 2024-02-06
Description: Memory corruption when malformed message payload is received from firmware.
CVSS Score: 7.8 (HIGH)
CWE: CWE-823, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43517
Published: 2024-02-06
Description: Memory corruption in Automotive Multimedia due to improper access control in HAB.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43518
Published: 2024-02-06
Description: Memory corruption in video while parsing invalid mp2 clip.
CVSS Score: 7.3 (HIGH)
CWE: CWE-822, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43519
Published: 2024-02-06
Description: Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
CVSS Score: 7.3 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43520
Published: 2024-02-06
Description: Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
CVSS Score: 8.6 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43522
Published: 2024-02-06
Description: Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43523
Published: 2024-02-06
Description: Transient DOS while processing 11AZ RTT management action frame received through OTA.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43532
Published: 2024-02-06
Description: Memory corruption while reading ACPI config through the user mode app.
CVSS Score: 8.4 (HIGH)
CWE: CWE-822, CWE-763
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43533
Published: 2024-02-06
Description: Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43534
Published: 2024-02-06
Description: Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
CVSS Score: 8.6 (HIGH)
CWE: CWE-823, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43535
Published: 2024-02-06
Description: Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.
CVSS Score: 8.4 (HIGH)
CWE: CWE-129, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-43536
Published: 2024-02-06
Description: Transient DOS while parse fils IE with length equal to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2024-bulletin
CVE: CVE-2023-25543
Published: 2024-02-06
Description: 
Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious user could potentially exploit this vulnerability in order to elevate privileges on the system. 


CVSS Score: 7.8 (HIGH)
CWE: CWE-280, CWE-755
References: https://www.dell.com/support/kbdoc/en-us/000209464/dsa-2023-075; https://www.dell.com/support/kbdoc/en-us/000209464/dsa-2023-075
CVE: CVE-2023-28049
Published: 2024-02-06
Description: 
Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authenticated malicious user may exploit this vulnerability in order to perform a privileged arbitrary file delete.


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-267, CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000211748/dsa-2023-125-dell-command-monitor-dcm; https://www.dell.com/support/kbdoc/en-us/000211748/dsa-2023-125-dell-command-monitor-dcm
CVE: CVE-2023-52239
Published: 2024-02-06
Description: The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://ds-security.com/post/xml_external_entity_injection_magic_xpi/; https://www2.magicsoftware.com/ver/docs/Downloads/Magicxpi/4.14/Windows/ReleaseNotes4.14.pdf; https://ds-security.com/post/xml_external_entity_injection_magic_xpi/
CVE: CVE-2024-22433
Published: 2024-02-06
Description: 
Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remote unauthorized unauthenticated attacker could potentially exploit this vulnerability leading to a loss of Confidentiality, Integrity, Protection, and remote takeover of the system. This is a high-severity vulnerability as it allows an attacker to take complete control of DP Search to affect downstream protected devices.


CVSS Score: 8.8 (HIGH)
CWE: CWE-538
References: https://www.dell.com/support/kbdoc/en-us/000221720/dsa-2024-063-security-update-for-dell-data-protection-search-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000221720/dsa-2024-063-security-update-for-dell-data-protection-search-multiple-security-vulnerabilities
CVE: CVE-2023-28063
Published: 2024-02-06
Description: 
Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-195, CWE-681
References: https://www.dell.com/support/kbdoc/en-us/000214780/dsa-2023-176-dell-client-bios-security-update-for-a-signed-to-unsigned-conversion-error-vulnerability; https://www.dell.com/support/kbdoc/en-us/000214780/dsa-2023-176-dell-client-bios-security-update-for-a-signed-to-unsigned-conversion-error-vulnerability
CVE: CVE-2023-32451
Published: 2024-02-06
Description: 
Dell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malicious code during installation and uninstallation


CVSS Score: 7.3 (HIGH)
CWE: CWE-272, CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000215216/dsa-2023-182-dell; https://www.dell.com/support/kbdoc/en-us/000215216/dsa-2023-182-dell
CVE: CVE-2023-32454
Published: 2024-02-06
Description: 
DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A local malicious standard user could exploit the vulnerability to create arbitrary files, leading to denial of service


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1386, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000216236/dsa-2023-192; https://www.dell.com/support/kbdoc/en-us/000216236/dsa-2023-192
CVE: CVE-2023-32474
Published: 2024-02-06
Description: 
Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount point. A local malicious user could potentially exploit this vulnerability during installation leading to arbitrary folder or file deletion


CVSS Score: 6.6 (MEDIUM)
CWE: CWE-1386, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000215216/dsa-2023-182-dell; https://www.dell.com/support/kbdoc/en-us/000215216/dsa-2023-182-dell
CVE: CVE-2023-32479
Published: 2024-02-06
Description: 
Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by replacing binaries in installed directory and taking reverse shell of the system leading to Privilege Escalation.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000215881/dsa-2023-260; https://www.dell.com/support/kbdoc/en-us/000215881/dsa-2023-260
CVE: CVE-2024-22365
Published: 2024-02-06
Description: linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-664
References: http://www.openwall.com/lists/oss-security/2024/01/18/3; https://github.com/linux-pam/linux-pam; https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb
CVE: CVE-2023-4503
Published: 2024-02-06
Description: An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-665
References: https://access.redhat.com/errata/RHSA-2023:7637; https://access.redhat.com/errata/RHSA-2023:7638; https://access.redhat.com/errata/RHSA-2023:7639
CVE: CVE-2024-0684
Published: 2024-02-06
Description: A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/security/cve/CVE-2024-0684; https://bugzilla.redhat.com/show_bug.cgi?id=2258948; https://www.openwall.com/lists/oss-security/2024/01/18/2
CVE: CVE-2024-25140
Published: 2024-02-06
Description: A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were to be compromised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Trusted Root Certification Authorities was the originally intended behavior, and the UI ensured that the certificate installation step (checked by default) was visible to the user before proceeding with the product installation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295, CWE-295
References: https://github.com/rustdesk/rustdesk/discussions/6444; https://news.ycombinator.com/item?id=39256493; https://serverfault.com/questions/837994
CVE: CVE-2024-23673
Published: 2024-02-06
Description: Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system.
If the system is vulnerable, a user with write access to the repository might be able to trick the Sling Servlet Resolver to load a previously uploaded script. 

Users are recommended to upgrade to version 2.11.0, which fixes this issue. It is recommended to upgrade, regardless of whether your system configuration currently allows this attack or not.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2024/02/06/1; https://lists.apache.org/thread/5zzx8ztwc6tmbwlw80m2pbrp3913l2kl; http://www.openwall.com/lists/oss-security/2024/02/06/1
CVE: CVE-2024-23917
Published: 2024-02-06
Description: In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-24936
Published: 2024-02-06
Description: In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-24937
Published: 2024-02-06
Description: In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-24938
Published: 2024-02-06
Description: In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-24939
Published: 2024-02-06
Description: In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible
CVSS Score: 3.3 (LOW)
CWE: CWE-532, CWE-532
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-24940
Published: 2024-02-06
Description: In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives
CVSS Score: 2.8 (LOW)
CWE: CWE-23, CWE-22, CWE-23
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-24941
Published: 2024-02-06
Description: In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-24942
Published: 2024-02-06
Description: In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-24943
Published: 2024-02-06
Description: In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-0690
Published: 2024-02-06
Description: An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-117, CWE-116
References: https://access.redhat.com/errata/RHSA-2024:0733; https://access.redhat.com/errata/RHSA-2024:2246; https://access.redhat.com/errata/RHSA-2024:3043
CVE: CVE-2023-5584
Published: 2024-02-06
Description: Rejected reason: We have rejected this CVE as it was determined a non-security issue by the vendor.
CVE: CVE-2024-0911
Published: 2024-02-06
Description: A flaw was found in indent, a program for formatting C code. This issue may allow an attacker to trick a user into processing a specially crafted file to trigger a heap-based buffer overflow, causing the application to crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/security/cve/CVE-2024-0911; https://bugzilla.redhat.com/show_bug.cgi?id=2260399; https://lists.gnu.org/archive/html/bug-indent/2024-01/msg00000.html
CVE: CVE-2024-24590
Published: 2024-02-06
Description: Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.

CVSS Score: 8.0 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/; https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE: CVE-2024-24591
Published: 2024-02-06
Description: A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with.

CVSS Score: 8.0 (HIGH)
CWE: CWE-22, CWE-22
References: https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/; https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE: CVE-2024-24592
Published: 2024-02-06
Description: Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files. 

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-425, CWE-287
References: https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/; https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE: CVE-2024-24593
Published: 2024-02-06
Description: A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks.

CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352, CWE-352
References: https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/; https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
CVE: CVE-2024-24594
Published: 2024-02-06
Description: A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views the Debug Samples tab in the web UI.

CVSS Score: 9.9 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/; https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/