deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-27132
Published: 2024-02-23
Description: Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.

This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook.

The vulnerability stems from lack of sanitization over template variables.


CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/mlflow/mlflow/pull/10873; https://research.jfrog.com/vulnerabilities/mlflow-untrusted-recipe-xss-jfsa-2[PII_REDACTED]30/; https://github.com/mlflow/mlflow/pull/10873
CVE: CVE-2024-27133
Published: 2024-02-23
Description: Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/mlflow/mlflow/pull/10893; https://research.jfrog.com/vulnerabilities/mlflow-untrusted-dataset-xss-jfsa-2[PII_REDACTED]32/; https://github.com/mlflow/mlflow/pull/10893
CVE: CVE-2024-22988
Published: 2024-02-23
Description: ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/whiteman007/b50a9b64007a5d7bcb7a8bee61d2cb47; https://www.vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategies; https://www.zkteco.com/en/Security_Bulletinsibs/12
CVE: CVE-2024-24681
Published: 2024-02-23
Description: An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single hardcoded key (used to encrypt provisioning documents) across customers' installations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/gitaware/CVE/tree/main/CVE-2024-24681; https://seclists.org/fulldisclosure/2024/Feb/22; http://seclists.org/fulldisclosure/2024/Feb/22
CVE: CVE-2024-25469
Published: 2024-02-23
Description: SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude parameters in the api/front/store/list component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/crmeb/crmeb_java/; https://github.com/crmeb/crmeb_java/issues/20; https://github.com/crmeb/crmeb_java/
CVE: CVE-2024-26188
Published: 2024-02-23
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-357
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26188; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26188
CVE: CVE-2024-26192
Published: 2024-02-23
Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 8.2 (HIGH)
CWE: CWE-359
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26192; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26192
CVE: CVE-2024-22395
Published: 2024-02-24
Description: Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0001; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0001
CVE: CVE-2024-1810
Published: 2024-02-24
Description: The Archivist – Custom Archive Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode_attributes' parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040242%40archivist-custom-archive-templates&new=3040242%40archivist-custom-archive-templates&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0e230f9f-5eda-4362-973b-ada9cf425697?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040242%40archivist-custom-archive-templates&new=3040242%40archivist-custom-archive-templates&sfp_email=&sfph_mail=
CVE: CVE-2024-21501
Published: 2024-02-24
Description: Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-538
References: https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c[PII_REDACTED]cf; https://github.com/apostrophecms/apostrophe/discussions/4436; https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
CVE: CVE-2024-21502
Published: 2024-02-24
Description: Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-457, CWE-908
References: https://gist.github.com/keltecc/49da037072276f21b005a8337c15db26; https://github.com/AntonKueltz/fastecdsa/blob/v2.3.1/src/curveMath.c%23L210; https://github.com/AntonKueltz/fastecdsa/commit/57fc5689c95d649dab7ef60cc99ac64589f01e36
CVE: CVE-2021-46904
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: hso: fix null-ptr-deref during tty device unregistration

Multiple ttys try to claim the same the minor number causing a double
unregistration of the same device. The first unregistration succeeds
but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number
but doesn't assign it immediately. The assignment is done by the caller
later. But before this assignment, calls to get_free_serial_index()
would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number
immediately after one is found to be and rename it to obtain_minor()
to better reflect what it does. Similary, rename set_serial_by_index()
to release_minor() and modify it to free up the minor number of the
given hso_serial. Every obtain_minor() should have corresponding
release_minor() call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/145c89c441d[PII_REDACTED]2bf51b323f347601bee; https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152a; https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723
CVE: CVE-2021-46905
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: hso: fix NULL-deref on disconnect regression

Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device
unregistration") fixed the racy minor allocation reported by syzbot, but
introduced an unconditional NULL-pointer dereference on every disconnect
instead.

Specifically, the serial device table must no longer be accessed after
the minor has been released by hso_serial_tty_unregister().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0c71d4c89559f72cec2592d078681a843bce570e; https://git.kernel.org/stable/c/0f000005da31f6947f843ce6b3e3a960540c6e00; https://git.kernel.org/stable/c/24b699bea7553fc0b98dad9d864befb6005ac7f1
CVE: CVE-2022-34357
Published: 2024-02-26
Description: IBM Cognos Analytics Mobile Server 11.1.7, 11.2.4, and 12.0.0 is vulnerable to Denial of Service due to due to weak or absence of rate limiting. By making unlimited http requests, it is possible for a single user to exhaust server resources over a period of time making service unavailable for other legitimate users.  IBM X-Force ID:  230510.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230510; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-48626
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

moxart: fix potential use-after-free on remove path

It was reported that the mmc host structure could be accessed after it
was freed in moxart_remove(), so fix this by saving the base register of
the device and using it instead of the pointer dereference.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/3a0a7ec5574b510b067cfc734b8bdb6564b31d4e; https://git.kernel.org/stable/c/7f901d53f120d1921f84f7b9b118e87e94b403c5; https://git.kernel.org/stable/c/9c25d5ff1856b91bd4365e813f566cb59aaa9552
CVE: CVE-2023-30996
Published: 2024-02-26
Description: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects of different origins.  IBM X-Force ID:  254290.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254290; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-32344
Published: 2024-02-26
Description: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path.  IBM X-Force ID:  255898.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/255898; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-38359
Published: 2024-02-26
Description: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  260744.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260744; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-43051
Published: 2024-02-26
Description: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  267451.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267451; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-49114
Published: 2024-02-26
Description: A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: http://seclists.org/fulldisclosure/2024/Mar/10; https://r.sec-consult.com/qognify; http://seclists.org/fulldisclosure/2024/Mar/10
CVE: CVE-2023-49959
Published: 2024-02-26
Description: In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges via a crafted filename parameter in POST requests to the /api/updater/ctrl/start_update endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://code-white.com/public-vulnerability-list/; https://www.indu-sol.com/en/products/profinet/diagnostics/profinet-inspektorr-nt/; https://code-white.com/public-vulnerability-list/
CVE: CVE-2023-49960
Published: 2024-02-26
Description: In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote attackers to write to arbitrary files via a crafted filename parameter in requests to the /upload endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://code-white.com/public-vulnerability-list/; https://www.indu-sol.com/en/products/profinet/diagnostics/profinet-inspektorr-nt/; https://code-white.com/public-vulnerability-list/
CVE: CVE-2023-52465
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

power: supply: Fix null pointer dereference in smb2_probe

devm_kasprintf and devm_kzalloc return a pointer to dynamically
allocated memory which can be NULL upon failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/88f04bc3e737155e13caddf0ba8ed19db87f0212; https://git.kernel.org/stable/c/bd3d2ec447ede9da822addf3960a5f4275e3ae76; https://git.kernel.org/stable/c/e2717302fbc20f148bcda362facee0444b949a3a
CVE: CVE-2023-52466
Published: 2024-02-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52467
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

mfd: syscon: Fix null pointer dereference in of_syscon_register()

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3ef1130deee[PII_REDACTED]4d9bfc37af75e1e906c; https://git.kernel.org/stable/c/41673c66b3d0c09915698fec5c13b24336f18dd1; https://git.kernel.org/stable/c/527e8c5f3d[PII_REDACTED]2c495d5adf1f8f43c001
CVE: CVE-2023-52468
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

class: fix use-after-free in class_register()

The lock_class_key is still registered and can be found in
lock_keys_hash hlist after subsys_private is freed in error
handler path.A task who iterate over the lock_keys_hash
later may cause use-after-free.So fix that up and unregister
the lock_class_key before kfree(cp).

On our platform, a driver fails to kset_register because of
creating duplicate filename '/class/xxx'.With Kasan enabled,
it prints a invalid-access bug report.

KASAN bug report:

BUG: KASAN: invalid-access in lockdep_register_key+0x19c/0x1bc
Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252
Pointer tag: [15], memory tag: [fe]

CPU: 7 PID: 252 Comm: modprobe Tainted: G        W
 6.6.0-mainline-maybe-dirty #1

Call trace:
dump_backtrace+0x1b0/0x1e4
show_stack+0x2c/0x40
dump_stack_lvl+0xac/0xe0
print_report+0x18c/0x4d8
kasan_report+0xe8/0x148
__hwasan_store8_noabort+0x88/0x98
lockdep_register_key+0x19c/0x1bc
class_register+0x94/0x1ec
init_module+0xbc/0xf48 [rfkill]
do_one_initcall+0x17c/0x72c
do_init_module+0x19c/0x3f8
...
Memory state around the buggy address:
ffffff808b8c0100: 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a
ffffff808b8c0200: 8a 8a 8a 8a 8a 8a 8a 8a fe fe fe fe fe fe fe fe
>ffffff808b8c0300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
                                     ^
ffffff808b8c0400: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03

As CONFIG_KASAN_GENERIC is not set, Kasan reports invalid-access
not use-after-free here.In this case, modprobe is manipulating
the corrupted lock_keys_hash hlish where lock_class_key is already
freed before.

It's worth noting that this only can happen if lockdep is enabled,
which is not true for normal system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0f1486dafca3398c4c46b9f6e6452fa27e73b559; https://git.kernel.org/stable/c/93ec4a3b76404bce01bd5c9032bef5df6feb1d62; https://git.kernel.org/stable/c/b57196a5ec5e4c0ffecde8348b085b778c7dce04
CVE: CVE-2023-52469
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drivers/amd/pm: fix a use-after-free in kv_parse_power_table

When ps allocated by kzalloc equals to NULL, kv_parse_power_table
frees adev->pm.dpm.ps that allocated before. However, after the control
flow goes through the following call chains:

kv_parse_power_table
  |-> kv_dpm_init
        |-> kv_dpm_sw_init
	      |-> kv_dpm_fini

The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its
first free in kv_parse_power_table and causes a use-after-free bug.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/28dd788382c43b330480f57cd34cde[PII_REDACTED]; https://git.kernel.org/stable/c/3426f059eacc33ecc676b0d66539297e1cfafd02; https://git.kernel.org/stable/c/35fa2394d26e919f63600ce631e6aefc95ec2706
CVE: CVE-2023-52470
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()

check the alloc_workqueue return value in radeon_crtc_init()
to avoid null-ptr-deref.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0b813a6a0087451cb702b6eb841f10856f49d088; https://git.kernel.org/stable/c/14bbfaa5df273b26cde6707f6e655585700e6fe1; https://git.kernel.org/stable/c/21b[PII_REDACTED]d6126dd4866c850fcc5c4703a41
CVE: CVE-2023-52471
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ice: Fix some null pointer dereference issues in ice_ptp.c

devm_kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3027e7b15b02d2d37e3f82d6b8404f6d37e3b8cf; https://git.kernel.org/stable/c/3cd9b9bee33f39f6c6d52360fe381b89a7b12695; https://git.kernel.org/stable/c/3027e7b15b02d2d37e3f82d6b8404f6d37e3b8cf
CVE: CVE-2023-52472
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: rsa - add a check for allocation failure

Static checkers insist that the mpi_alloc() allocation can fail so add
a check to prevent a NULL dereference.  Small allocations like this
can't actually fail in current kernels, but adding a check is very
simple and makes the static checkers happy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2831f4d3bfa68e64c5f83e96688be779c87b3511; https://git.kernel.org/stable/c/95ad8b6879e2e49d02e3bfc0e1fb46421633fe2a; https://git.kernel.org/stable/c/d872ca165cb67112f2841ef9c37d51ef7e63d1e4
CVE: CVE-2023-52473
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal: core: Fix NULL pointer dereference in zone registration error path

If device_register() in thermal_zone_device_register_with_trips()
returns an error, the tz variable is set to NULL and subsequently
dereferenced in kfree(tz->tzp).

Commit adc8749b150c ("thermal/drivers/core: Use put_device() if
device_register() fails") added the tz = NULL assignment in question to
avoid a possible double-free after dropping the reference to the zone
device.  However, after commit 4649620d9404 ("thermal: core: Make
thermal_zone_device_unregister() return after freeing the zone"), that
assignment has become redundant, because dropping the reference to the
zone device does not cause the zone object to be freed any more.

Drop it to address the NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/02871710b93058eb1249d5847c0b2d1c2c3c98ae; https://git.kernel.org/stable/c/04e6ccfc93c5a1aa1d75a537cf27e418895e20ea; https://git.kernel.org/stable/c/335176dd8ebaca6493807dceea33c478305667fa
CVE: CVE-2023-5775
Published: 2024-02-26
Description: The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with administrator-level access, to retrieve the password from the password input field in the UI or from the options table where the password is stored.
CVSS Score: 2.2 (LOW)
CWE: CWE-256
References: https://plugins.trac.wordpress.org/changeset/3039678/backwpup; https://www.wordfence.com/threat-intel/vulnerabilities/id/4bce4f04-e622-468a-ac7e-5903ad50cc13?source=cve; https://plugins.trac.wordpress.org/changeset/3039678/backwpup
CVE: CVE-2024-0243
Published: 2024-02-26
Description: With the following crawler configuration:

```python
from bs4 import BeautifulSoup as Soup

url = "https://example.com"
loader = RecursiveUrlLoader(
    url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text
)
docs = loader.load()
```

An attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though `prevent_outside=True`.

https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51

Resolved in https://github.com/langchain-ai/langchain/pull/15559
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://github.com/langchain-ai/langchain/commit/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22; https://github.com/langchain-ai/langchain/pull/15559; https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861
CVE: CVE-2024-0387
Published: 2024-02-26
Description: The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1188
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-237129-eds-4000-g4000-series-ip-forwarding-vulnerability?viewmode=0; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-237129-eds-4000-g4000-series-ip-forwarding-vulnerability?viewmode=0
CVE: CVE-2024-0435
Published: 2024-02-26
Description: User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads.

Given the minimum requirement for a user to send a chat is to be given access to a workspace via an admin the risk is low. Additionally, the location in which the XSS renders is only limited to the user who submits the XSS. 

Ultimately, this attack is limited to the user attacking themselves. There is no anonymous chat submission unless the user does not take the minimum steps required to protect their instance.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mintplex-labs/anything-llm/commit/a4ace56a401ffc8ce0082d7444159dfd5dc28834; https://huntr.com/bounties/53308220-8b2e-492f-b248-0985b7c2db61; https://github.com/mintplex-labs/anything-llm/commit/a4ace56a401ffc8ce0082d7444159dfd5dc28834