diff --git a/2024/10xxx/CVE-2024-10274.json b/2024/10xxx/CVE-2024-10274.json
index b3b8cfb86b6..86d3085480a 100644
--- a/2024/10xxx/CVE-2024-10274.json
+++ b/2024/10xxx/CVE-2024-10274.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10274",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing unauthorized users to access sensitive information about all team members in the current organization. This vulnerability can lead to the disclosure of sensitive information such as names, roles, or emails to users without sufficient privileges, resulting in privacy violations and potential reconnaissance for targeted attacks."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-285 Improper Authorization",
+ "cweId": "CWE-285"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "lunary-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lunary-ai/lunary",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "1.5.7"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/506459c1-da60-45c5-a10d-8bd540a4b4c1",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/506459c1-da60-45c5-a10d-8bd540a4b4c1"
+ },
+ {
+ "url": "https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc",
+ "refsource": "MISC",
+ "name": "https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "506459c1-da60-45c5-a10d-8bd540a4b4c1",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10275.json b/2024/10xxx/CVE-2024-10275.json
index 88d6033751f..33682a9ab3b 100644
--- a/2024/10xxx/CVE-2024-10275.json
+++ b/2024/10xxx/CVE-2024-10275.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10275",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manage billing, effectively bypassing the intended role-based access control. Only users with the 'owner' role should be allowed to invite members with billing permissions. This flaw allows admins to circumvent those restrictions, gaining unauthorized access and control over billing information, posing a risk to the organization\u2019s financial resources."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284 Improper Access Control",
+ "cweId": "CWE-284"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "lunary-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lunary-ai/lunary",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "1.5.7"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/863ee34b-c4c6-4325-bf7a-82a7feebf88f",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/863ee34b-c4c6-4325-bf7a-82a7feebf88f"
+ },
+ {
+ "url": "https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc",
+ "refsource": "MISC",
+ "name": "https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "863ee34b-c4c6-4325-bf7a-82a7feebf88f",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
+ "baseScore": 7.3,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10361.json b/2024/10xxx/CVE-2024-10361.json
index efce3dbd463..1c29854d4b9 100644
--- a/2024/10xxx/CVE-2024-10361.json
+++ b/2024/10xxx/CVE-2024-10361.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10361",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-73 External Control of File Name or Path",
+ "cweId": "CWE-73"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "danny-avila",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "danny-avila/librechat",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "0.7.5"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/e811f7f7-9556-4564-82e2-5b3d17599b2d",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/e811f7f7-9556-4564-82e2-5b3d17599b2d"
+ },
+ {
+ "url": "https://github.com/danny-avila/librechat/commit/0b744db1e2af31a531ffb761584d85540430639c",
+ "refsource": "MISC",
+ "name": "https://github.com/danny-avila/librechat/commit/0b744db1e2af31a531ffb761584d85540430639c"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "e811f7f7-9556-4564-82e2-5b3d17599b2d",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
+ "baseScore": 8.1,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10366.json b/2024/10xxx/CVE-2024-10366.json
index 11b35a31b4d..08ffc1e8fe5 100644
--- a/2024/10xxx/CVE-2024-10366.json
+++ b/2024/10xxx/CVE-2024-10366.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10366",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284 Improper Access Control",
+ "cweId": "CWE-284"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "danny-avila",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "danny-avila/librechat",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "0.7.5"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a981a7e",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a981a7e"
+ },
+ {
+ "url": "https://github.com/danny-avila/librechat/commit/a350443661d001ac55787741969a75d94ca14116",
+ "refsource": "MISC",
+ "name": "https://github.com/danny-avila/librechat/commit/a350443661d001ac55787741969a75d94ca14116"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "cde47cf8-dc81-46ab-b472-f7e44a981a7e",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
+ "baseScore": 7.6,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10481.json b/2024/10xxx/CVE-2024-10481.json
index c8b9657d8b4..64a7545eae2 100644
--- a/2024/10xxx/CVE-2024-10481.json
+++ b/2024/10xxx/CVE-2024-10481.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10481",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as uploading arbitrary files via the `/upload/image` endpoint. The lack of CSRF protections on API endpoints like `/upload/image`, `/prompt`, and `/history` leaves users vulnerable to unauthorized actions, which could be combined with other vulnerabilities such as stored-XSS to further compromise user sessions."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-352 Cross-Site Request Forgery (CSRF)",
+ "cweId": "CWE-352"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "comfyanonymous",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "comfyanonymous/comfyui",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/f4d5bfb5-6ff1-4356-b81f-f8c01d2e6ded",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/f4d5bfb5-6ff1-4356-b81f-f8c01d2e6ded"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "f4d5bfb5-6ff1-4356-b81f-f8c01d2e6ded",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10513.json b/2024/10xxx/CVE-2024-10513.json
index 34f712332cb..558b8580261 100644
--- a/2024/10xxx/CVE-2024-10513.json
+++ b/2024/10xxx/CVE-2024-10513.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10513",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the vulnerable endpoint '/api/document/move-files', an attacker can move the database file to a publicly accessible directory, download it, and subsequently delete it. This can lead to unauthorized access to sensitive data, privilege escalation, and potential data loss."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-23 Relative Path Traversal",
+ "cweId": "CWE-23"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "mintplex-labs",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "mintplex-labs/anything-llm",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "1.2.2"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/ad11cecf-161a-4fb1-986f-6f88272cbb9e",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/ad11cecf-161a-4fb1-986f-6f88272cbb9e"
+ },
+ {
+ "url": "https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7",
+ "refsource": "MISC",
+ "name": "https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "ad11cecf-161a-4fb1-986f-6f88272cbb9e",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "HIGH",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10553.json b/2024/10xxx/CVE-2024-10553.json
index 0dbf553664c..553655ae611 100644
--- a/2024/10xxx/CVE-2024-10553.json
+++ b/2024/10xxx/CVE-2024-10553.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10553",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-502 Deserialization of Untrusted Data",
+ "cweId": "CWE-502"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "h2oai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "h2oai/h2o-3",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "3.47.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b"
+ },
+ {
+ "url": "https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac",
+ "refsource": "MISC",
+ "name": "https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "e6f550dd-eda2-428c-a740-ed8f893a084b",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 9.8,
+ "baseSeverity": "CRITICAL"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10572.json b/2024/10xxx/CVE-2024-10572.json
index 2e4c62b2a36..d9e9188d83a 100644
--- a/2024/10xxx/CVE-2024-10572.json
+++ b/2024/10xxx/CVE-2024-10572.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10572",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400 Uncontrolled Resource Consumption",
+ "cweId": "CWE-400"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "h2oai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "h2oai/h2o-3",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/db8939a0-9be8-4d0f-a8b0-1bd181666da2",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/db8939a0-9be8-4d0f-a8b0-1bd181666da2"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "db8939a0-9be8-4d0f-a8b0-1bd181666da2",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10707.json b/2024/10xxx/CVE-2024-10707.json
index 9d664933336..0717bbfdcba 100644
--- a/2024/10xxx/CVE-2024-10707.json
+++ b/2024/10xxx/CVE-2024-10707.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10707",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially crafted JSON file and exploiting the improper input validation in the handle_dataset_selection function."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-20 Improper Input Validation",
+ "cweId": "CWE-20"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "gaizhenbiao",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "gaizhenbiao/chuanhuchatgpt",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/98fdedea-6ad0-4157-b7d2-ae71c9786ee8",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/98fdedea-6ad0-4157-b7d2-ae71c9786ee8"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "98fdedea-6ad0-4157-b7d2-ae71c9786ee8",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10713.json b/2024/10xxx/CVE-2024-10713.json
index aa52c2ec15c..23f5ea14388 100644
--- a/2024/10xxx/CVE-2024-10713.json
+++ b/2024/10xxx/CVE-2024-10713.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10713",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A vulnerability in szad670401/hyperlpr v3.0 allows for a Denial of Service (DoS) attack. The server fails to handle excessive characters appended to the end of multipart boundaries, regardless of the character used. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary, leading to excessive resource consumption and a complete denial of service for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400 Uncontrolled Resource Consumption",
+ "cweId": "CWE-400"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "szad670401",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "szad670401/hyperlpr",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/d5404069-95b3-40e0-a7a4-c3a183d861b0",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/d5404069-95b3-40e0-a7a4-c3a183d861b0"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "d5404069-95b3-40e0-a7a4-c3a183d861b0",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10723.json b/2024/10xxx/CVE-2024-10723.json
index 29f090d8466..abde4a1abf1 100644
--- a/2024/10xxx/CVE-2024-10723.json
+++ b/2024/10xxx/CVE-2024-10723.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10723",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the destination address field of the NAT tool, which can be executed when a user interacts with the field. The impact of this vulnerability includes the potential theft of user cookies, unauthorized access to user accounts, and redirection to malicious websites. The issue has been fixed in version 1.7.0."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "phpipam",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "phpipam/phpipam",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "1.7.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/9af99057-e4f6-4d07-b3bb-3213b977801d",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/9af99057-e4f6-4d07-b3bb-3213b977801d"
+ },
+ {
+ "url": "https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731",
+ "refsource": "MISC",
+ "name": "https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "9af99057-e4f6-4d07-b3bb-3213b977801d",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
+ "baseScore": 3.5,
+ "baseSeverity": "LOW"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10724.json b/2024/10xxx/CVE-2024-10724.json
index 3d400cd9bf4..6b9a743cac2 100644
--- a/2024/10xxx/CVE-2024-10724.json
+++ b/2024/10xxx/CVE-2024-10724.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10724",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the Destination address. This vulnerability allows an attacker to execute malicious code. The issue is fixed in version 1.7.0."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "phpipam",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "phpipam/phpipam",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "1.7.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/0746e357-fcc7-44db-b8e7-857875c54999",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/0746e357-fcc7-44db-b8e7-857875c54999"
+ },
+ {
+ "url": "https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731",
+ "refsource": "MISC",
+ "name": "https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "0746e357-fcc7-44db-b8e7-857875c54999",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
+ "baseScore": 3.5,
+ "baseSeverity": "LOW"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10725.json b/2024/10xxx/CVE-2024-10725.json
index daa0c0f6186..e24b742b142 100644
--- a/2024/10xxx/CVE-2024-10725.json
+++ b/2024/10xxx/CVE-2024-10725.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10725",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which are then executed in the context of other users who view the affected pages. The issue occurs when editing the NAT destination address, where user input is not properly sanitized. This can lead to data theft, account compromise, and other malicious activities. The vulnerability is fixed in version 1.7.0."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "phpipam",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "phpipam/phpipam",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "1.7.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/343465fa-6dec-40af-a012-7b118e91a771",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/343465fa-6dec-40af-a012-7b118e91a771"
+ },
+ {
+ "url": "https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731",
+ "refsource": "MISC",
+ "name": "https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "343465fa-6dec-40af-a012-7b118e91a771",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
+ "baseScore": 3.5,
+ "baseSeverity": "LOW"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10762.json b/2024/10xxx/CVE-2024-10762.json
index b5a37f2530b..d93fc2e1fd3 100644
--- a/2024/10xxx/CVE-2024-10762.json
+++ b/2024/10xxx/CVE-2024-10762.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10762",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a project by sending a DELETE request. However, the route lacks proper access control, such as middleware to ensure that only users with appropriate roles can delete evaluator data. This vulnerability allows low-privilege users to delete evaluators data, causing permanent data loss and potentially hindering operations."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-862 Missing Authorization",
+ "cweId": "CWE-862"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "lunary-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lunary-ai/lunary",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "1.5.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/23ab508e-d956-4861-b28f-0569d3b404a6",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/23ab508e-d956-4861-b28f-0569d3b404a6"
+ },
+ {
+ "url": "https://github.com/lunary-ai/lunary/commit/91587496673da24cb7ddedfbbd6e602592b20ef6",
+ "refsource": "MISC",
+ "name": "https://github.com/lunary-ai/lunary/commit/91587496673da24cb7ddedfbbd6e602592b20ef6"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "23ab508e-d956-4861-b28f-0569d3b404a6",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
+ "baseScore": 8.1,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10812.json b/2024/10xxx/CVE-2024-10812.json
index cfbc7882e2e..f9d9608be60 100644
--- a/2024/10xxx/CVE-2024-10812.json
+++ b/2024/10xxx/CVE-2024-10812.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10812",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An open redirect vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs when a user is redirected to a URL specified by user-controlled input in the 'file' parameter without proper validation or sanitization. This can be exploited by attackers to conduct phishing attacks, distribute malware, and steal user credentials."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-601 URL Redirection to Untrusted Site",
+ "cweId": "CWE-601"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "binary-husky",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "binary-husky/gpt_academic",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/51408ebd-e0be-489d-8088-f210087dbd6a",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/51408ebd-e0be-489d-8088-f210087dbd6a"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "51408ebd-e0be-489d-8088-f210087dbd6a",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10821.json b/2024/10xxx/CVE-2024-10821.json
index 58423393a5d..23a0d0134fd 100644
--- a/2024/10xxx/CVE-2024-10821.json
+++ b/2024/10xxx/CVE-2024-10821.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10821",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and a complete denial of service for all users. The affected endpoint is `/api/v1/images/upload`."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400 Uncontrolled Resource Consumption",
+ "cweId": "CWE-400"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "invoke-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "invoke-ai/invokeai",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/0ac24835-c4c0-4f11-938a-d5641dfb80b2",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/0ac24835-c4c0-4f11-938a-d5641dfb80b2"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "0ac24835-c4c0-4f11-938a-d5641dfb80b2",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10829.json b/2024/10xxx/CVE-2024-10829.json
index fa8a3eac450..67052a36140 100644
--- a/2024/10xxx/CVE-2024-10829.json
+++ b/2024/10xxx/CVE-2024-10829.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10829",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and complete denial of service for all users. This vulnerability affects all endpoints processing multipart/form-data requests."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400 Uncontrolled Resource Consumption",
+ "cweId": "CWE-400"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "eosphoros-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "eosphoros-ai/db-gpt",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/e3a4a0ad-a2e0-497f-a2e0-e3c0ec7c4de4",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/e3a4a0ad-a2e0-497f-a2e0-e3c0ec7c4de4"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "e3a4a0ad-a2e0-497f-a2e0-e3c0ec7c4de4",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10831.json b/2024/10xxx/CVE-2024-10831.json
index b2f8b5741e7..514edfa692a 100644
--- a/2024/10xxx/CVE-2024-10831.json
+++ b/2024/10xxx/CVE-2024-10831.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10831",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the `file_key` and `doc_file.filename` parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essential system files, such as SSH keys, for further exploitation."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-36 Absolute Path Traversal",
+ "cweId": "CWE-36"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "eosphoros-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "eosphoros-ai/db-gpt",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/5c34c39f-66d4-414c-ab6a-f7888a5d882a",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/5c34c39f-66d4-414c-ab6a-f7888a5d882a"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "5c34c39f-66d4-414c-ab6a-f7888a5d882a",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
+ "baseScore": 9.1,
+ "baseSeverity": "CRITICAL"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10835.json b/2024/10xxx/CVE-2024-10835.json
index 2b5be471774..e427ed9c426 100644
--- a/2024/10xxx/CVE-2024-10835.json
+++ b/2024/10xxx/CVE-2024-10835.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10835",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE)."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "eosphoros-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "eosphoros-ai/db-gpt",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "e32fda74-ca83-431c-8de8-08274ba686c9",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
+ "baseScore": 9.1,
+ "baseSeverity": "CRITICAL"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10901.json b/2024/10xxx/CVE-2024-10901.json
index 690c4ed4b94..f1c5048e55a 100644
--- a/2024/10xxx/CVE-2024-10901.json
+++ b/2024/10xxx/CVE-2024-10901.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10901",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as `__init__.py` in the Python's `/site-packages/` directory."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-434 Unrestricted Upload of File with Dangerous Type",
+ "cweId": "CWE-434"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "eosphoros-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "eosphoros-ai/db-gpt",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/db2c1d59-6e3a-4553-a1f6-94c8df162a18",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/db2c1d59-6e3a-4553-a1f6-94c8df162a18"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "db2c1d59-6e3a-4553-a1f6-94c8df162a18",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
+ "baseScore": 9.1,
+ "baseSeverity": "CRITICAL"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10902.json b/2024/10xxx/CVE-2024-10902.json
index a32c4c31b71..03aab723051 100644
--- a/2024/10xxx/CVE-2024-10902.json
+++ b/2024/10xxx/CVE-2024-10902.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10902",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential for remote code execution (RCE) by writing malicious files, such as a malicious `__init__.py` in the Python's `/site-packages/` directory."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-73 External Control of File Name or Path",
+ "cweId": "CWE-73"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "eosphoros-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "eosphoros-ai/db-gpt",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/f7fbf76e-aa1c-4106-b007-e9579f4f7d5f",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/f7fbf76e-aa1c-4106-b007-e9579f4f7d5f"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "f7fbf76e-aa1c-4106-b007-e9579f4f7d5f",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
+ "baseScore": 9.1,
+ "baseSeverity": "CRITICAL"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10908.json b/2024/10xxx/CVE-2024-10908.json
index e8708265e86..7472df7a5ed 100644
--- a/2024/10xxx/CVE-2024-10908.json
+++ b/2024/10xxx/CVE-2024-10908.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10908",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-601 URL Redirection to Untrusted Site",
+ "cweId": "CWE-601"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "lm-sys",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lm-sys/fastchat",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "61f5e725-5579-4d08-8a88-e4ba04e6d1f2",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10935.json b/2024/10xxx/CVE-2024-10935.json
index a7b98e133c6..eefa8e335aa 100644
--- a/2024/10xxx/CVE-2024-10935.json
+++ b/2024/10xxx/CVE-2024-10935.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10935",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400 Uncontrolled Resource Consumption",
+ "cweId": "CWE-400"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "automatic1111",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "automatic1111/stable-diffusion-webui",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/e6fdc6ed-f38d-4798-b60a-0e47893a81a6",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/e6fdc6ed-f38d-4798-b60a-0e47893a81a6"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "e6fdc6ed-f38d-4798-b60a-0e47893a81a6",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/10xxx/CVE-2024-10940.json b/2024/10xxx/CVE-2024-10940.json
index 4ee95e591df..fe520d7bff1 100644
--- a/2024/10xxx/CVE-2024-10940.json
+++ b/2024/10xxx/CVE-2024-10940.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-10940",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchain_core.prompts.ImagePromptTemplate's (and by extension langchain_core.prompts.ChatPromptTemplate's) with input variables that can read any user-specified path from the server file system. If the outputs of these prompt templates are exposed to the user, either directly or through downstream model outputs, it can lead to the exposure of sensitive information."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere",
+ "cweId": "CWE-497"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "langchain-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "langchain-ai/langchain",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "0.3.15"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27"
+ },
+ {
+ "url": "https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68",
+ "refsource": "MISC",
+ "name": "https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "be1ee1cb-2147-4ff4-a57b-b6045271cf27",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11031.json b/2024/11xxx/CVE-2024-11031.json
index 815d29dc8db..a08d786d773 100644
--- a/2024/11xxx/CVE-2024-11031.json
+++ b/2024/11xxx/CVE-2024-11031.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11031",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() API. This vulnerability is exploited through the HotReload(Markdown\u7ffb\u8bd1\u4e2d) plugin function, which allows downloading arbitrary web hosts by only checking if the link starts with 'http'. Attackers can exploit this vulnerability to abuse the victim GPT Academic's Gradio Web server's credentials to access unauthorized web resources."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "cweId": "CWE-200"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "binary-husky",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "binary-husky/gpt_academic",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/d27d89a7-7d54-45b9-a9eb-66c00bc56e02",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/d27d89a7-7d54-45b9-a9eb-66c00bc56e02"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "d27d89a7-7d54-45b9-a9eb-66c00bc56e02",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
+ "baseScore": 7.7,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11037.json b/2024/11xxx/CVE-2024-11037.json
index 3c20bb6c560..cf7a055286c 100644
--- a/2024/11xxx/CVE-2024-11037.json
+++ b/2024/11xxx/CVE-2024-11037.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11037",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+ "cweId": "CWE-22"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "binary-husky",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "binary-husky/gpt_academic",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/91243fc1-f287-4f4b-8aa6-dfe3efff23e5",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/91243fc1-f287-4f4b-8aa6-dfe3efff23e5"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "91243fc1-f287-4f4b-8aa6-dfe3efff23e5",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11039.json b/2024/11xxx/CVE-2024-11039.json
index ea45c4023b4..60150345c03 100644
--- a/2024/11xxx/CVE-2024-11039.json
+++ b/2024/11xxx/CVE-2024-11039.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11039",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the inclusion of numpy in the deserialization whitelist, which can be exploited by constructing a malicious compressed package containing a merge_result.pkl file and a merge_proofread_en.tex file. The vulnerability is fixed in commit 91f5e6b."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-502 Deserialization of Untrusted Data",
+ "cweId": "CWE-502"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "binary-husky",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "binary-husky/gpt_academic",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "91f5e6b"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/f233a365-522c-44f6-876f-db492fb58ad5",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/f233a365-522c-44f6-876f-db492fb58ad5"
+ },
+ {
+ "url": "https://github.com/binary-husky/gpt_academic/commit/91f5e6b8f754beb47b02f7c1893804c1c9543ccb",
+ "refsource": "MISC",
+ "name": "https://github.com/binary-husky/gpt_academic/commit/91f5e6b8f754beb47b02f7c1893804c1c9543ccb"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "f233a365-522c-44f6-876f-db492fb58ad5",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11042.json b/2024/11xxx/CVE-2024-11042.json
index e54c2e515f4..696caf22fe9 100644
--- a/2024/11xxx/CVE-2024-11042.json
+++ b/2024/11xxx/CVE-2024-11042.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11042",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-20 Improper Input Validation",
+ "cweId": "CWE-20"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "invoke-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "invoke-ai/invokeai",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "5.3.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/635535a7-c804-4789-ac3a-48d951263987",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/635535a7-c804-4789-ac3a-48d951263987"
+ },
+ {
+ "url": "https://github.com/invoke-ai/invokeai/commit/5440c037674882b2ab7acd59087e9bb04b49657a",
+ "refsource": "MISC",
+ "name": "https://github.com/invoke-ai/invokeai/commit/5440c037674882b2ab7acd59087e9bb04b49657a"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "635535a7-c804-4789-ac3a-48d951263987",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
+ "baseScore": 9.1,
+ "baseSeverity": "CRITICAL"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11044.json b/2024/11xxx/CVE-2024-11044.json
index c7e1381e561..8ec9787660e 100644
--- a/2024/11xxx/CVE-2024-11044.json
+++ b/2024/11xxx/CVE-2024-11044.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11044",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This vulnerability can be exploited to conduct phishing attacks, distribute malware, and steal user credentials."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-601 URL Redirection to Untrusted Site",
+ "cweId": "CWE-601"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "automatic1111",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "automatic1111/stable-diffusion-webui",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/ee942e5e-4987-4f81-ba83-014fec6b33b3",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/ee942e5e-4987-4f81-ba83-014fec6b33b3"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "ee942e5e-4987-4f81-ba83-014fec6b33b3",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11137.json b/2024/11xxx/CVE-2024-11137.json
index 23775299194..69ca5bc85c2 100644
--- a/2024/11xxx/CVE-2024-11137.json
+++ b/2024/11xxx/CVE-2024-11137.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11137",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of lunary-ai/lunary version 1.6.0. This vulnerability allows an attacker to update the score data of any run by manipulating the id parameter in the request URL, which corresponds to the `runId_score` in the database. The endpoint does not sufficiently validate whether the authenticated user has permission to modify the specified runId, enabling an attacker with a valid account to modify other users' runId scores by specifying different id values. This issue was fixed in version 1.6.1."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284 Improper Access Control",
+ "cweId": "CWE-284"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "lunary-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lunary-ai/lunary",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "1.6.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/0a399d86-0105-4f48-a77b-9fa7d7054be8",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/0a399d86-0105-4f48-a77b-9fa7d7054be8"
+ },
+ {
+ "url": "https://github.com/lunary-ai/lunary/commit/ded72a95c220904a151d27daf3c67e8644e386c6",
+ "refsource": "MISC",
+ "name": "https://github.com/lunary-ai/lunary/commit/ded72a95c220904a151d27daf3c67e8644e386c6"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "0a399d86-0105-4f48-a77b-9fa7d7054be8",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11167.json b/2024/11xxx/CVE-2024-11167.json
index a823686c93a..dcba035c558 100644
--- a/2024/11xxx/CVE-2024-11167.json
+++ b/2024/11xxx/CVE-2024-11167.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11167",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284 Improper Access Control",
+ "cweId": "CWE-284"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "danny-avila",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "danny-avila/librechat",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "0.7.6"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/298f5760-5797-4432-8b9e-544609d612c0"
+ },
+ {
+ "url": "https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7",
+ "refsource": "MISC",
+ "name": "https://github.com/danny-avila/librechat/commit/5071bdbf9ac621165f0e8d009818851f3951eee7"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "298f5760-5797-4432-8b9e-544609d612c0",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
+ "baseScore": 9.4,
+ "baseSeverity": "CRITICAL"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11169.json b/2024/11xxx/CVE-2024-11169.json
index 3b01ea0ed9c..07cc8bbeae1 100644
--- a/2024/11xxx/CVE-2024-11169.json
+++ b/2024/11xxx/CVE-2024-11169.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11169",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the server to crash. The vulnerability is fixed in version 0.7.6."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-115 Misinterpretation of Input",
+ "cweId": "CWE-115"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "danny-avila",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "danny-avila/librechat",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "0.7.6"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/754e1649-5612-4ba9-a533-06b46de5c4b5",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/754e1649-5612-4ba9-a533-06b46de5c4b5"
+ },
+ {
+ "url": "https://github.com/danny-avila/librechat/commit/629be5c0ca2b332178524b4e3f6fac715aea8cc4",
+ "refsource": "MISC",
+ "name": "https://github.com/danny-avila/librechat/commit/629be5c0ca2b332178524b4e3f6fac715aea8cc4"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "754e1649-5612-4ba9-a533-06b46de5c4b5",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11170.json b/2024/11xxx/CVE-2024-11170.json
index 0cd38772a87..92cd9cab588 100644
--- a/2024/11xxx/CVE-2024-11170.json
+++ b/2024/11xxx/CVE-2024-11170.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11170",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-29 Path Traversal: '\\..\\filename'",
+ "cweId": "CWE-29"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "danny-avila",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "danny-avila/librechat",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "0.7.6"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/b64156c2-5380-4d4d-af30-b2938dcdd46e",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/b64156c2-5380-4d4d-af30-b2938dcdd46e"
+ },
+ {
+ "url": "https://github.com/danny-avila/librechat/commit/629be5c0ca2b332178524b4e3f6fac715aea8cc4",
+ "refsource": "MISC",
+ "name": "https://github.com/danny-avila/librechat/commit/629be5c0ca2b332178524b4e3f6fac715aea8cc4"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "b64156c2-5380-4d4d-af30-b2938dcdd46e",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11301.json b/2024/11xxx/CVE-2024-11301.json
index a36b571e8a6..182b13d45c3 100644
--- a/2024/11xxx/CVE-2024-11301.json
+++ b/2024/11xxx/CVE-2024-11301.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11301",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator. The lack of database constraints or application-layer validation to prevent duplicates exposes the application to data integrity issues. This vulnerability can result in corrupted data and potentially malicious actions, impairing the system's functionality."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-837 Improper Enforcement of a Single, Unique Action",
+ "cweId": "CWE-837"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "lunary-ai",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lunary-ai/lunary",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "1.6.3"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/3d99aca5-b135-4833-b48b-7806bc4bf861",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/3d99aca5-b135-4833-b48b-7806bc4bf861"
+ },
+ {
+ "url": "https://github.com/lunary-ai/lunary/commit/79dc370596d979b756f6ea0250d97a2d02385ecd",
+ "refsource": "MISC",
+ "name": "https://github.com/lunary-ai/lunary/commit/79dc370596d979b756f6ea0250d97a2d02385ecd"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "3d99aca5-b135-4833-b48b-7806bc4bf861",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11302.json b/2024/11xxx/CVE-2024-11302.json
index 167805a280c..d49fbdea0fa 100644
--- a/2024/11xxx/CVE-2024-11302.json
+++ b/2024/11xxx/CVE-2024-11302.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11302",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /install_binding and /reinstall_binding endpoints, among others, enabling unauthorized access and manipulation of binding settings without requiring the client_id value."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-304 Missing Critical Step in Authentication",
+ "cweId": "CWE-304"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "parisneo",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "parisneo/lollms",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/e341304b-4651-4de9-b7b9-b89aead3b46e",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/e341304b-4651-4de9-b7b9-b89aead3b46e"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "e341304b-4651-4de9-b7b9-b89aead3b46e",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "HIGH",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
+ "baseScore": 8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11441.json b/2024/11xxx/CVE-2024-11441.json
index 89cf03db9b5..aad72c14d21 100644
--- a/2024/11xxx/CVE-2024-11441.json
+++ b/2024/11xxx/CVE-2024-11441.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11441",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A stored cross-site scripting (XSS) vulnerability exists in Serge version 0.9.0. The vulnerability is due to improper neutralization of input during web page generation in the chat prompt. An attacker can exploit this vulnerability by sending a crafted message containing malicious HTML/JavaScript code, which will be stored and executed whenever the chat is accessed, leading to unintended content being shown to the user and potential phishing attacks."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "serge-chat",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "serge-chat/serge",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/ae76d1ea-21a4-456d-bef2-331aef3ea376",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/ae76d1ea-21a4-456d-bef2-331aef3ea376"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "ae76d1ea-21a4-456d-bef2-331aef3ea376",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11449.json b/2024/11xxx/CVE-2024-11449.json
index db66d0f33a1..5e88ed6f11a 100644
--- a/2024/11xxx/CVE-2024-11449.json
+++ b/2024/11xxx/CVE-2024-11449.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11449",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6) allows for Server-Side Request Forgery (SSRF) through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation of the path parameter. This flaw can lead to unauthorized network access, sensitive data exposure, and further exploitation within the network."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "cweId": "CWE-918"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "haotian-liu",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "haotian-liu/llava",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/e96aba28-d564-4ecb-ab77-350511d2e1ee",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/e96aba28-d564-4ecb-ab77-350511d2e1ee"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "e96aba28-d564-4ecb-ab77-350511d2e1ee",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11603.json b/2024/11xxx/CVE-2024-11603.json
index c6ede2d1143..d09900108e9 100644
--- a/2024/11xxx/CVE-2024-11603.json
+++ b/2024/11xxx/CVE-2024-11603.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11603",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the `/queue/join?` endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal networks or the AWS metadata endpoint, potentially exposing sensitive data and compromising internal servers."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "cweId": "CWE-918"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "lm-sys",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lm-sys/fastchat",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/89f1158d-4a75-4000-a1bd-f82dd1a62bff",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/89f1158d-4a75-4000-a1bd-f82dd1a62bff"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "89f1158d-4a75-4000-a1bd-f82dd1a62bff",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11821.json b/2024/11xxx/CVE-2024-11821.json
index cd31b8339a6..e26edf5b8be 100644
--- a/2024/11xxx/CVE-2024-11821.json
+++ b/2024/11xxx/CVE-2024-11821.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11821",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-id}/model-config, allowing unauthorized users to alter chatbot configurations."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-250 Execution with Unnecessary Privileges",
+ "cweId": "CWE-250"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "langgenius",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "langgenius/dify",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/76d5986d-3882-4ea7-81cb-f00400e5c6b6",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/76d5986d-3882-4ea7-81cb-f00400e5c6b6"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "76d5986d-3882-4ea7-81cb-f00400e5c6b6",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+ "baseScore": 4.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11822.json b/2024/11xxx/CVE-2024-11822.json
index 95531204adb..29efb5b3aff 100644
--- a/2024/11xxx/CVE-2024-11822.json
+++ b/2024/11xxx/CVE-2024-11822.json
@@ -1,17 +1,86 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11822",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "cweId": "CWE-918"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "langgenius",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "langgenius/dify",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "unspecified",
+ "version_value": "latest"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.com/bounties/f3042029-5d4e-41c6-850d-bbe02fae6592",
+ "refsource": "MISC",
+ "name": "https://huntr.com/bounties/f3042029-5d4e-41c6-850d-bbe02fae6592"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "f3042029-5d4e-41c6-850d-bbe02fae6592",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/11xxx/CVE-2024-11824.json b/2024/11xxx/CVE-2024-11824.json
index 852fdba2076..b08db46bb68 100644
--- a/2024/11xxx/CVE-2024-11824.json
+++ b/2024/11xxx/CVE-2024-11824.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-11824",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@huntr.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like and