deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-37244
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ninja Team Ninja Beaver Add-ons for Beaver Builder allows Stored XSS.This issue affects Ninja Beaver Add-ons for Beaver Builder: from n/a through 2.4.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ninja-beaver-lite-addons-for-beaver-builder/wordpress-ninja-beaver-add-ons-for-beaver-builder-plugin-2-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ninja-beaver-lite-addons-for-beaver-builder/wordpress-ninja-beaver-add-ons-for-beaver-builder-plugin-2-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-38503
Published: 2024-07-22
Description: When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits.
The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.

Users are recommended to upgrade to version 3.0.8, which fixes this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser; https://www.openwall.com/lists/oss-security/2024/07/22/3; http://www.openwall.com/lists/oss-security/2024/07/22/3
CVE: CVE-2024-6542
Published: 2024-07-22
Description: Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk <= 2.0.0p39, < 2.1.0p47, < 2.2.0p32 and < 2.3.0p11 allows arbitrary livestatus command execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-140
References: https://checkmk.com/werk/17013; https://checkmk.com/werk/17013
CVE: CVE-2024-37942
Published: 2024-07-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Berqier Ltd BerqWP.This issue affects BerqWP: from n/a through 1.7.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/searchpro/wordpress-berqwp-plugin-1-7-5-unauthenticated-non-blind-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/searchpro/wordpress-berqwp-plugin-1-7-5-unauthenticated-non-blind-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-38692
Published: 2024-07-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-11-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-11-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-38701
Published: 2024-07-22
Description: Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/academy/wordpress-academy-lms-plugin-2-0-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/academy/wordpress-academy-lms-plugin-2-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-38708
Published: 2024-07-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-and-inventory-manager-plugin-1-6-1-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/wordpress-barcode-scanner-and-inventory-manager-plugin-1-6-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-38723
Published: 2024-07-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Bernhard Kux JSON Content Importer.This issue affects JSON Content Importer: from n/a through 1.5.6.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/json-content-importer/wordpress-get-use-apis-json-content-importer-plugin-1-5-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/json-content-importer/wordpress-get-use-apis-json-content-importer-plugin-1-5-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-38728
Published: 2024-07-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source.This issue affects Seraphinite Post .DOCX Source: from n/a through 2.16.9.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/seraphinite-post-docx-source/wordpress-seraphinite-post-docx-source-plugin-2-16-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seraphinite-post-docx-source/wordpress-seraphinite-post-docx-source-plugin-2-16-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-38730
Published: 2024-07-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Noor alam Magical Addons For Elementor.This issue affects Magical Addons For Elementor: from n/a through 1.1.41.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/magical-addons-for-elementor/wordpress-magical-addons-for-elementor-plugin-1-1-40-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/magical-addons-for-elementor/wordpress-magical-addons-for-elementor-plugin-1-1-40-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-38755
Published: 2024-07-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Designinvento DirectoryPress allows SQL Injection.This issue affects DirectoryPress: from n/a through 3.6.10.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/directorypress/wordpress-directorypress-plugin-3-6-10-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/directorypress/wordpress-directorypress-plugin-3-6-10-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-38759
Published: 2024-07-22
Description: Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/search-and-replace/wordpress-search-replace-plugin-3-2-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/search-and-replace/wordpress-search-replace-plugin-3-2-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2024-38773
Published: 2024-07-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/formlift/wordpress-formlift-plugin-7-5-17-unauthenticated-blind-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/formlift/wordpress-formlift-plugin-7-5-17-unauthenticated-blind-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-38788
Published: 2024-07-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bởi Admin 2020 UiPress lite allows SQL Injection.This issue affects UiPress lite: from n/a through 3.4.06.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-25638
Published: 2024-07-22
Description: dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
CVSS Score: 8.9 (HIGH)
CWE: CWE-345, CWE-349
References: https://github.com/dnsjava/dnsjava/commit/2073a0cdea2c560465f7ac0cc56f202e6fc39705; https://github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fw; https://github.com/dnsjava/dnsjava/commit/bc51df1c455e6c9fb7cbd42fcb6d62d16047818d
CVE: CVE-2024-37998
Published: 2024-07-22
Description: A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). The password of administrative accounts of the affected applications can be reset without requiring the knowledge of the current password, given the auto login is enabled. This could allow an unauthorized attacker to obtain administrative access of the affected applications.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-620
References: https://cert-portal.siemens.com/productcert/html/ssa-071402.html; https://cert-portal.siemens.com/productcert/html/ssa-071402.html
CVE: CVE-2024-39601
Published: 2024-07-22
Description: A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). Affected devices allow a remote authenticated user or an unauthenticated user with physical access to downgrade the firmware of the device. This could allow an attacker to downgrade the device to older versions with known vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://cert-portal.siemens.com/productcert/html/ssa-071402.html; http://seclists.org/fulldisclosure/2025/Feb/19; https://cert-portal.siemens.com/productcert/html/ssa-071402.html
CVE: CVE-2024-39902
Published: 2024-07-22
Description: Tuleap is an open source suite to improve management of software developments and collaboration. Prior to Tuleap Community Edition 15.10.99.128 and Tuleap Enterprise Edition 15.10-6 and 15.9-8, the checkbox "Apply same permissions to all sub-items of this folder" in the document manager permissions modal is not taken into account and always considered as unchecked. In situations where the permissions are being restricted some users might still keep, incorrectly, the possibility to edit or manage items. Only change made via the web UI are affected, changes directly made via the REST API are not impacted. This vulnerability is fixed in Tuleap Community Edition 15.10.99.128 and Tuleap Enterprise Edition 15.10-6 and 15.9-8.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://github.com/Enalean/tuleap/commit/580161e8a065fba30ca5ca1f6f1bdb4f4b1424bb; https://github.com/Enalean/tuleap/security/advisories/GHSA-5jq5-vxmq-xrj7; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=580161e8a065fba30ca5ca1f6f1bdb4f4b1424bb
CVE: CVE-2024-41314
Published: 2024-07-22
Description: TOTOLINK A6000R V1.0.1-B20[PII_REDACTED] was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://gist.github.com/yanggao017/8593748d4e2de1582344b4035b2456c6; https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_1_vif_disable/README.md; https://gist.github.com/yanggao017/8593748d4e2de1582344b4035b2456c6
CVE: CVE-2024-41315
Published: 2024-07-22
Description: TOTOLINK A6000R V1.0.1-B20[PII_REDACTED] was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://gist.github.com/yanggao017/add8d85589614d09e3e8ccb1fb335f64; https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_4_apcli_do_enr_pin_wps/README.md; https://gist.github.com/yanggao017/add8d85589614d09e3e8ccb1fb335f64
CVE: CVE-2024-41316
Published: 2024-07-22
Description: TOTOLINK A6000R V1.0.1-B20[PII_REDACTED] was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://gist.github.com/yanggao017/690f3e4b5045bbdf1209baa30fb53065; https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_2_apcli_cancel_wps/README.md; https://gist.github.com/yanggao017/690f3e4b5045bbdf1209baa30fb53065
CVE: CVE-2024-41317
Published: 2024-07-22
Description: TOTOLINK A6000R V1.0.1-B20[PII_REDACTED] was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://gist.github.com/yanggao017/8b7a567996f1986ac9fb3ab427c59227; https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_3_apcli_do_enr_pbc_wps/README.md; https://gist.github.com/yanggao017/8b7a567996f1986ac9fb3ab427c59227
CVE: CVE-2024-41318
Published: 2024-07-22
Description: TOTOLINK A6000R V1.0.1-B20[PII_REDACTED] was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://gist.github.com/yanggao017/dc88fb2e29291503addf1e7aa3775578; https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_5_apcli_wps_gen_pincode/README.md; https://gist.github.com/yanggao017/dc88fb2e29291503addf1e7aa3775578
CVE: CVE-2024-41320
Published: 2024-07-22
Description: TOTOLINK A6000R V1.0.1-B20[PII_REDACTED] was discovered to contain a command injection vulnerability via the ifname parameter in the get_apcli_conn_info function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://gist.github.com/yanggao017/081d8638c117e708a4d36783b9230ce5; https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_6_get_apcli_conn_info/README.md; https://gist.github.com/yanggao017/081d8638c117e708a4d36783b9230ce5
CVE: CVE-2024-21552
Published: 2024-07-22
Description: All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/TransformerOptimus/SuperAGI/blob/9361f0491716e56bd0c0ae2f3b49da201a18c58c/superagi/agent/output_handler.py#L149; https://github.com/TransformerOptimus/SuperAGI/blob/9361f0491716e56bd0c0ae2f3b49da201a18c58c/superagi/agent/output_handler.py#L180; https://github.com/TransformerOptimus/SuperAGI/blob/9361f0491716e56bd0c0ae2f3b49da201a18c58c/superagi/agent/output_handler.py#L149
CVE: CVE-2024-26020
Published: 2024-07-22
Description: An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-74
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1993; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1993; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1993
CVE: CVE-2024-29073
Published: 2024-07-22
Description: An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-829, CWE-829
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1992
CVE: CVE-2024-32152
Published: 2024-07-22
Description: A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-184
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1994; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1994; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1994
CVE: CVE-2024-32484
Published: 2024-07-22
Description: An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-80, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1995; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1995; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1995
CVE: CVE-2024-41129
Published: 2024-07-22
Description: The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing `subprocess.CalledProcessError`. This vulnerability is fixed in 2.15.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://github.com/canonical/operator/commit/fea6d2072435a62170d4c01272572f1a7e916e61; https://github.com/canonical/operator/security/advisories/GHSA-hcmv-jmqh-fjgm; https://github.com/canonical/operator/commit/fea6d2072435a62170d4c01272572f1a7e916e61
CVE: CVE-2024-41131
Published: 2024-07-22
Description: ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693; https://github.com/SixLabors/ImageSharp/commit/a1f[PII_REDACTED]09a987065643b8172c748abdadb; https://github.com/SixLabors/ImageSharp/pull/2754
CVE: CVE-2024-41132
Published: 2024-07-22
Description: ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789, CWE-770
References: https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands; https://docs.sixlabors.com/articles/imagesharp/security.html; https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515
CVE: CVE-2024-41824
Published: 2024-07-22
Description: In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-41825
Published: 2024-07-22
Description: In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-41826
Published: 2024-07-22
Description: In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-41827
Published: 2024-07-22
Description: In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
CVSS Score: 7.4 (HIGH)
CWE: CWE-613, CWE-613
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-41828
Published: 2024-07-22
Description: In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
CVSS Score: 2.6 (LOW)
CWE: CWE-208
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-41829
Published: 2024-07-22
Description: In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection
CVSS Score: 3.5 (LOW)
CWE: CWE-303, CWE-287
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-39685
Published: 2024-07-22
Description: Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.run(cmd, shell=True) in the resample function, which leads to arbitrary command execution. This affects fishaudio/Bert-VITS2 2.3 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/fishaudio/Bert-VITS2/blob/3f8c537f4aeb281df3fb3c455eed9a1b64871a81/webui_preprocess.py#L46-L52; https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L130-L133; https://securitylab.github.com/advisories/GHSL-2024-045_GHSL-2024-047_fishaudio_Bert-VITS2/
CVE: CVE-2024-39686
Published: 2024-07-22
Description: Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.run(cmd, shell=True) in the bert_gen function, which leads to arbitrary command execution. This affects fishaudio/Bert-VITS2 2.3 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/fishaudio/Bert-VITS2/blob/3f8c537f4aeb281df3fb3c455eed9a1b64871a81/webui_preprocess.py#L82C9-L82C57; https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L130-L133; https://securitylab.github.com/advisories/GHSL-2024-045_GHSL-2024-047_fishaudio_Bert-VITS2/
CVE: CVE-2024-39688
Published: 2024-07-22
Description: Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is concatenated with other folders and used to open a new file in the generate_config function, which leads to a limited file write. The issue allows for writing /config/config.json file in arbitrary directory on the server. If a given directory path doesn’t exist, the application will return an error, so this vulnerability could also be used to gain information about existing directories on the server. This affects fishaudio/Bert-VITS2 2.3 and earlier.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L130-L133; https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L34; https://securitylab.github.com/advisories/GHSL-2024-045_GHSL-2024-047_fishaudio_Bert-VITS2/