rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-6577 Unclaimed S3 Bucket Usage in pytorch/serve
In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity. The issue may result in data breaches, exposure of proprietary information, or unauthorized modifications to stored data.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: pytorch
product: pytorch/serve
Published: 2025-03-20T10:10:36.761Z
CVE-2024-6578 Stored XSS in aimhubio/aim
A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: aimhubio
product: aimhubio/aim
Published: 2024-07-29T18:37:16.820Z
CVE-2024-6579 Web and WooCommerce Addons for WPBakery Builder <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification
The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress is vulnerable to unauthorized plugin settings modification due to a missing capability check on several plugin functions in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change some of the plugin settings.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: genetechproducts
product: Web and WooCommerce Addons for WPBakery Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-07-16T09:32:12.232Z
CVE-2024-6580 /n software IPWorks SSH insufficient file access verification
The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user access without verifying the SSH public key or certificate (which would most likely be a separate vulnerability in the calling application). IPWorks SSH versions 22.0.8945 and 24.0.8945 were released to address this condition by blocking all filesystem and network path requests for SSH public keys or certificates.
Problem types: cwe_id: CWE-1390
description: CWE-1390 Weak Authentication
Affected products: vendor: /n software
product: IPWorks SSH SFTPServer
default_status: unaffected
Published: 2024-07-08T18:55:10.323Z
CVE-2024-6581 Remote Code Execution due to Stored XSS in parisneo/lollms
A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this can lead to cross-site scripting (XSS) vulnerabilities, which in turn pose a risk of remote code execution. The sanitize_svg function only removes script elements and 'on*' event attributes, but does not account for other potential vectors for XSS within SVG files. This vulnerability can be exploited when authorized users access a malicious URL containing the crafted SVG file.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: parisneo
product: parisneo/lollms
Published: 2024-10-29T12:49:01.555Z
CVE-2024-6582 Broken Access Control in lunary-ai/lunary
A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: lunary-ai
product: lunary-ai/lunary
Published: 2024-09-13T16:11:39.817Z
CVE-2024-6583 Path Traversal in stangirard/quivr
A path traversal vulnerability exists in the latest version of stangirard/quivr. This vulnerability allows an attacker to upload files to arbitrary paths in an S3 bucket by manipulating the file path in the upload request.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: stangirard
product: stangirard/quivr
Published: 2025-03-20T10:10:23.071Z
CVE-2024-6584 Jetpack Boost < 3.4.7 - Admin+ SSRF
The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
Problem types: description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Unknown
product: Jetpack Boost
default_status: unaffected
Credits: lang: en
value: Miguel Xavier Penha Neto
lang: en
value: WPScan
Published: 2025-05-15T20:07:07.826Z
CVE-2024-6585 
Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user’s session with the application.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Lightdash
product: Lightdash
default_status: affected
Credits: lang: en
value: Kenneth Chiong, Mandiant
lang: en
value: Kenneth Chiong, Mandiant
Published: 2024-08-30T22:17:28.565Z
CVE-2024-6586 
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Lightdash
product: Lightdash
default_status: affected
Credits: lang: en
value: Kenneth Chiong, Mandiant
lang: en
value: Kenneth Chiong, Mandiant
Published: 2024-08-30T22:25:48.431Z
CVE-2024-6587 SSRF in berriai/litellm
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: berriai
product: berriai/litellm
Published: 2024-09-13T15:59:53.557Z
CVE-2024-6588 PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_url’ parameter in all versions up to, and including, 11.9.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: blubrry
product: PowerPress Podcasting plugin by Blubrry
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Craig Smith
Published: 2024-07-12T06:50:29.920Z
CVE-2024-6589 LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Problem types: cwe_id: CWE-98
description: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: thimpress
product: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Matthew Rollings
Published: 2024-07-25T10:59:51.542Z
CVE-2024-6590 Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update
The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 3.8.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit post status, edit Google sheet integrations, and create Google sheet integrations.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: javmah
product: WPGSI: Spreadsheet Integration
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-09-25T02:05:24.882Z
CVE-2024-6591 Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation
The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: nitesh_singh
product: Ultimate WordPress Auction Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
baseScore: 5.8
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-07-27T01:51:03.390Z
CVE-2024-6592 WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass
Incorrect Authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows Authentication Bypass.This issue affects the Authentication Gateway: through 12.10.2; Windows Single Sign-On Client: through 12.7; MacOS Single Sign-On Client: through 12.5.4.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: WatchGuard
product: Authentication Gateway
default_status: unaffected
vendor: WatchGuard
product: Single Sign-On Client
default_status: unaffected
vendor: WatchGuard
product: Single Sign-On Client
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-09-25T11:16:01.320Z
CVE-2024-6593 WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass
Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands.
This issue affects Authentication Gateway: through 12.10.2.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: WatchGuard
product: Authentication Gateway
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-09-25T11:16:15.822Z
CVE-2024-6594 WatchGuard Firebox Single Sign-On Client Denial-of-Service
Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by repeatedly issuing malformed commands.

This issue affects Single Sign-On Client: through 12.7.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: WatchGuard
product: Single Sign-On Client
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-09-25T11:22:45.610Z
CVE-2024-6595 Uncontrolled Search Path Element in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.
Problem types: cwe_id: CWE-451
description: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks vulnerability was found internally by a GitLab team member [Ameya Darshan](https://gitlab.com/ameyadarshan). Thanks to [Darcy Clarke](https://x.com/darcy) for their work on [manifest confusion](https://blog.vlt.sh/blog/the-massive-hole-in-the-npm-ecosystem).
Published: 2024-07-17T01:30:43.332Z
CVE-2024-6596 Endress+Hauser: Multiple products are vulnerable to code injection
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Endress+Hauser
product: Echo Curve Viewer
default_status: unaffected
vendor: Endress+Hauser
product: FieldCare SFE500 Package USB
default_status: unaffected
vendor: Endress+Hauser
product: FieldCare SFE500 Package Web-Package
default_status: unaffected
vendor: Endress+Hauser
product: Field Xpert SMT50
default_status: unaffected
vendor: Endress+Hauser
product: Field Xpert SMT70
default_status: unaffected
vendor: Endress+Hauser
product: Field Xpert SMT77
default_status: unaffected
vendor: Endress+Hauser
product: Field Xpert SMT79
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Julian Renz
lang: en
value: Endress+Hauser
Published: 2024-09-10T08:01:26.429Z
CVE-2024-6598 Denial-of-service on KNIME Business Hub when certain jobs are executed
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation.


Updating to KNIME Business Hub 1.10.2 or later solves the problem.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: KNIME
product: KNIME Business Hub
default_status: unaffected
Published: 2024-07-09T13:41:15.786Z
CVE-2024-6599 Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification
The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API keys. 
CVE-2024-38733 may be a duplicate of this issue.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: mekshq
product: Meks Video Importer
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-07-18T02:03:58.808Z
CVE-2024-6600 Memory corruption in WebGL API
Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on macOS. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: pwn2car
Published: 2024-07-09T14:25:56.437Z
CVE-2024-6601 Race condition in permission assignment
A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Andreas Farre
Published: 2024-07-09T14:25:56.733Z
CVE-2024-6602 Memory corruption in NSS
A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Ronald Crane
Published: 2024-07-09T14:25:57.026Z
CVE-2024-6603 Memory corruption in thread creation
In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Irvan Kurniawan
Published: 2024-07-09T14:25:57.402Z
CVE-2024-6604 Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13
Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Randell Jesup
Published: 2024-07-09T14:25:57.691Z
CVE-2024-6605 Firefox Android missed activation delay to prevent tapjacking
Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128.
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Shaheen Fazim
Published: 2024-07-09T14:25:57.930Z
CVE-2024-6606 Out-of-bounds read in clipboard component
Clipboard code failed to check the index on an array access. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: dalmurino
Published: 2024-07-09T14:25:58.357Z
CVE-2024-6607 Leaving pointerlock by pressing the escape key could be prevented
It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `&lt;select&gt;` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Irvan Kurniawan
Published: 2024-07-09T14:25:58.566Z
CVE-2024-6608 Cursor could be moved out of the viewport using pointerlock.
It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Irvan Kurniawan
Published: 2024-07-09T14:25:58.862Z
CVE-2024-6609 Memory corruption in NSS
When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Irvan Kurniawan
Published: 2024-07-09T14:25:59.075Z