GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-1395

Allowed-with-Review

Dependency on Vulnerable Third-Party Component

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product has a dependency on a third-party component that contains one or more known vulnerabilities.

118 vulnerabilities reference this CWE, most recent first.

CVE-2025-12219 (GCVE-0-2025-12219)

Vulnerability from cvelistv5 – Published: 2025-10-25 15:51 – Updated: 2025-10-28 14:17
VLAI
Title
Vulnerable Components in Azure Access OS
Summary
Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity
10 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-28 14:17 UTC
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Credits
Kevin Schaller Benjamin Lafois Alexi Bitsios Sebastian Toscano Dominik Schneider
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-28T14:17:05.349713Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-28T14:17:14.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BLU-IC2",
          "vendor": "Azure Access Technology",
          "versions": [
            {
              "lessThanOrEqual": "1.19.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "BLU-IC4",
          "vendor": "Azure Access Technology",
          "versions": [
            {
              "lessThanOrEqual": "1.19.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kevin Schaller"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Benjamin Lafois"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexi Bitsios"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sebastian Toscano"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Dominik Schneider"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerable Components in Azure Access OS.\u003cp\u003eThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.\u003c/p\u003e"
            }
          ],
          "value": "Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-22",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-22 Exploiting Trust in Client"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-25T15:51:58.319Z",
        "orgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220",
        "shortName": "azure-access"
      },
      "references": [
        {
          "url": "https://azure-access.com/security-advisories"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerable Components in Azure Access OS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220",
    "assignerShortName": "azure-access",
    "cveId": "CVE-2025-12219",
    "datePublished": "2025-10-25T15:51:58.319Z",
    "dateReserved": "2025-10-25T15:50:41.942Z",
    "dateUpdated": "2025-10-28T14:17:14.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-11159 (GCVE-0-2025-11159)

Vulnerability from cvelistv5 – Published: 2026-05-13 05:36 – Updated: 2026-05-13 14:44
VLAI
Title
Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component
Summary
Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 14:44 UTC
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Vendor Product Version
Hitachi Vantara Pentaho Data Integration and Analytics Affected: 1.0 , < 10.2.0.7 (maven)
Affected: 1.0 , < 11.0 (maven)
Create a notification for this product.
Credits
Nir Zadok (nirza) and Moshe Siman Tov Bustan from OX Security
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11159",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T14:44:30.743315Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T14:44:36.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pentaho Data Integration and Analytics",
          "vendor": "Hitachi Vantara",
          "versions": [
            {
              "lessThan": "10.2.0.7",
              "status": "affected",
              "version": "1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "11.0",
              "status": "affected",
              "version": "1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Zadok (nirza) and Moshe Siman Tov Bustan  from OX Security"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Hitachi Vantara Pentaho Data Integration \u0026amp; Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a\u0026nbsp;data source administrator."
            }
          ],
          "value": "Hitachi Vantara Pentaho Data Integration \u0026 Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a\u00a0data source administrator."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-310",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-310 Scanning for Vulnerable Software"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T05:36:43.720Z",
        "orgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
        "shortName": "HITVAN"
      },
      "references": [
        {
          "url": "https://support.pentaho.com/hc/en-us/articles/39954640408077--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Dependency-on-Vulnerable-Third-Party-Component-Versions-before-10-2-0-7-and-11-0-0-0-Impacted-CVE-2025-11159"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Hitachi Vantara Pentaho Data Integration \u0026 Analytics - Dependency on Vulnerable Third-Party  Component",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
    "assignerShortName": "HITVAN",
    "cveId": "CVE-2025-11159",
    "datePublished": "2026-05-13T05:36:43.720Z",
    "dateReserved": "2025-09-29T14:53:44.917Z",
    "dateUpdated": "2026-05-13T14:44:36.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-10226 (GCVE-0-2025-10226)

Vulnerability from cvelistv5 – Published: 2025-09-10 12:38 – Updated: 2025-10-08 11:56
VLAI
Title
PostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple Vulnerabilities
Summary
Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multiple known CVEs present in PostgreSQL v10.x, which are resolved in PostgreSQL 17.4.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 13:11 UTC
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Vendor Product Version
AxxonSoft AxxonOne C-Werk Affected: 0 , ≤ 2.0.8 (semver)
Create a notification for this product.
Credits
Implemented internally by the AxxonSoft DevOps and QA Security teams.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-10T13:11:00.834219Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-10T13:11:16.308Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "AxxonOne C-Werk",
          "vendor": "AxxonSoft",
          "versions": [
            {
              "lessThanOrEqual": "2.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Implemented internally by the AxxonSoft DevOps and QA Security teams."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multiple known CVEs present in PostgreSQL v10.x, which are resolved in PostgreSQL 17.4."
            }
          ],
          "value": "Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multiple known CVEs present in PostgreSQL v10.x, which are resolved in PostgreSQL 17.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-630",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-630: Dependency Substitution"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-08T11:56:42.741Z",
        "orgId": "15ede60e-6fda-426e-be9c-e788f151a377",
        "shortName": "AxxonSoft"
      },
      "references": [
        {
          "url": "https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories"
        },
        {
          "url": "https://www.postgresql.org/docs/release"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade bundled or external PostgreSQL instances to \u003cstrong\u003ev17.4 or later\u003c/strong\u003e, which addresses all known CVEs up to that release and strengthens DB hardening.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Upgrade bundled or external PostgreSQL instances to v17.4 or later, which addresses all known CVEs up to that release and strengthens DB hardening."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple Vulnerabilities",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "For environments unable to upgrade immediately, limit database exposure (network segmentation, firewalling).\n\n\u003cbr\u003e\n\nRegularly monitor PostgreSQL security advisories for backported patches.\n\n\u003cbr\u003e"
            }
          ],
          "value": "For environments unable to upgrade immediately, limit database exposure (network segmentation, firewalling).\n\n\n\n\nRegularly monitor PostgreSQL security advisories for backported patches."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "15ede60e-6fda-426e-be9c-e788f151a377",
    "assignerShortName": "AxxonSoft",
    "cveId": "CVE-2025-10226",
    "datePublished": "2025-09-10T12:38:42.549Z",
    "dateReserved": "2025-09-10T12:37:44.975Z",
    "dateUpdated": "2025-10-08T11:56:42.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45399 (GCVE-0-2024-45399)

Vulnerability from cvelistv5 – Published: 2024-09-04 20:12 – Updated: 2024-09-04 20:17
VLAI
Title
Indico has a Cross-Site-Scripting during account creation
Summary
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the `next` URL. Exploitation requires initiating the account creation process with a maliciously crafted link, and then finalizing the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users. Indico 3.3.4 upgrades the dependency on Flask-Multipass to version 0.5.5, which fixes the issue. Those who build the Indico package themselves and cannot upgrade can update the `flask-multipass` dependency to `>=0.5.5` which fixes the vulnerability. Otherwise one could configure one's web server to disallow requests containing a query string with a `next` parameter that starts with `javascript:`.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-04 20:17 UTC
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Vendor Product Version
indico indico Affected: < 3.3.4
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45399",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T20:17:25.903426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T20:17:38.298Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "indico",
          "vendor": "indico",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the `next` URL. Exploitation requires initiating the account creation process with a maliciously crafted link, and then finalizing the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users. Indico 3.3.4 upgrades the dependency on Flask-Multipass to version 0.5.5, which fixes the issue. Those who build the Indico package themselves and cannot upgrade can update the `flask-multipass` dependency to `\u003e=0.5.5` which fixes the vulnerability. Otherwise one could configure one\u0027s web server to disallow requests containing a query string with a `next` parameter that starts with `javascript:`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T20:12:20.457Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/indico/indico/security/advisories/GHSA-rrqf-w74j-24ff",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/indico/indico/security/advisories/GHSA-rrqf-w74j-24ff"
        },
        {
          "name": "https://github.com/indico/flask-multipass/commit/0bdcf656d469e5f675cb56fd644d82fea3a97c2a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/indico/flask-multipass/commit/0bdcf656d469e5f675cb56fd644d82fea3a97c2a"
        },
        {
          "name": "https://github.com/indico/indico/commit/7dcb573837b9fd09d95f74d1baeae225b164cc8f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/indico/indico/commit/7dcb573837b9fd09d95f74d1baeae225b164cc8f"
        },
        {
          "name": "https://github.com/indico/indico/releases/tag/v3.3.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/indico/indico/releases/tag/v3.3.4"
        }
      ],
      "source": {
        "advisory": "GHSA-rrqf-w74j-24ff",
        "discovery": "UNKNOWN"
      },
      "title": "Indico has a Cross-Site-Scripting during account creation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-45399",
    "datePublished": "2024-09-04T20:12:20.457Z",
    "dateReserved": "2024-08-28T20:21:32.803Z",
    "dateUpdated": "2024-09-04T20:17:38.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38526 (GCVE-0-2024-38526)

Vulnerability from cvelistv5 – Published: 2024-06-25 23:53 – Updated: 2025-02-13 17:53
VLAI
Title
pdoc embeds link to malicious CDN if math mode is enabled
Summary
pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.
Severity
0 (None)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-14 14:23 UTC
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Vendor Product Version
mitmproxy pdoc Affected: < 14.5.1
Create a notification for this product.
mitmproxy pdoc Affected: 0 , < 14.5.1 (custom)
    cpe:2.3:a:mitmproxy:pdoc:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mitmproxy:pdoc:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pdoc",
            "vendor": "mitmproxy",
            "versions": [
              {
                "lessThan": "14.5.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38526",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-14T14:23:46.307681Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-14T14:25:31.686Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.740Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62"
          },
          {
            "name": "https://github.com/mitmproxy/pdoc/pull/703",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mitmproxy/pdoc/pull/703"
          },
          {
            "name": "https://sansec.io/research/polyfill-supply-chain-attack",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sansec.io/research/polyfill-supply-chain-attack"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pdoc",
          "vendor": "mitmproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 14.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-24T16:18:22.866Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62"
        },
        {
          "name": "https://github.com/mitmproxy/pdoc/pull/703",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mitmproxy/pdoc/pull/703"
        },
        {
          "name": "https://sansec.io/research/polyfill-supply-chain-attack",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sansec.io/research/polyfill-supply-chain-attack"
        },
        {
          "url": "https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526"
        }
      ],
      "source": {
        "advisory": "GHSA-5vgj-ggm4-fg62",
        "discovery": "UNKNOWN"
      },
      "title": "pdoc embeds link to malicious CDN if math mode is enabled"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-38526",
    "datePublished": "2024-06-25T23:53:54.677Z",
    "dateReserved": "2024-06-18T16:37:02.728Z",
    "dateUpdated": "2025-02-13T17:53:15.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-32753 (GCVE-0-2024-32753)

Vulnerability from cvelistv5 – Published: 2024-07-11 15:30 – Updated: 2024-08-16 14:50
VLAI
Title
TYCO Illustra Pro Gen 4 - JQuery version
Summary
Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component
Severity
7 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-12 19:41 UTC
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Vendor Product Version
Johnson Controls TYCO Illustra Pro4 Fixed cameras Affected: 0 , ≤ Illustra.SS016.05.03.01.0007 (custom)
Create a notification for this product.
Johnson Controls TYCO Illustra Pro4 PTZ cameras Affected: 0 , ≤ Illustra.SS010.24.03.00.0005 (custom)
Create a notification for this product.
Johnson Controls TYCO Illustra Flex4 Fixed & PTZ cameras Affected: 0 , ≤ Illustra.SS018.24.03.00.0010 (custom)
Create a notification for this product.
Johnson Controls TYCO Illustra Pro4 MultiSensor Cameras Affected: 0 , ≤ Illustra.SS017.24.03.00.0009 (custom)
Create a notification for this product.
Johnson Controls TYCO Illustra Flex4 DualSensor Cameras Affected: 0 , ≤ Illustra.SS022.24.03.00.0008 (custom)
Create a notification for this product.
johnsoncontrols illustra_flex4_dualsensor_firmware Affected: 0 , ≤ Illustra.SS022.24.03.00.0008 (custom)
    cpe:2.3:o:johnsoncontrols:illustra_flex4_dualsensor_firmware:*:*:*:*:*:*:*:*
Create a notification for this product.
johnsoncontrols illustra_pro4_multisensor_firmware Affected: 0 , ≤ Illustra.SS017.24.03.00.0009 (custom)
    cpe:2.3:o:johnsoncontrols:illustra_pro4_multisensor_firmware:*:*:*:*:*:*:*:*
Create a notification for this product.
johnsoncontrols illustra_flex4_fixed_firmware Affected: 0 , ≤ Illustra.SS018.24.03.00.0010 (custom)
    cpe:2.3:o:johnsoncontrols:illustra_flex4_fixed_firmware:*:*:*:*:*:*:*:*
Create a notification for this product.
johnsoncontrols illustra_flex4_ptz_firmware Affected: 0 , ≤ Illustra.SS018.24.03.00.0010 (custom)
    cpe:2.3:o:johnsoncontrols:illustra_flex4_ptz_firmware:*:*:*:*:*:*:*:*
Create a notification for this product.
johnsoncontrols illustra_pro4_ptz_firmware Affected: 0 , ≤ Illustra.SS010.24.03.00.0005 (custom)
    cpe:2.3:o:johnsoncontrols:illustra_pro4_ptz_firmware:*:*:*:*:*:*:*:*
Create a notification for this product.
johnsoncontrols illustra_pro_gen_4_firmware Affected: 0 , ≤ Illustra.SS016.05.03.01.0007 (custom)
    cpe:2.3:o:johnsoncontrols:illustra_pro_gen_4_firmware:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2024-07-09 16:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:johnsoncontrols:illustra_flex4_dualsensor_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "illustra_flex4_dualsensor_firmware",
            "vendor": "johnsoncontrols",
            "versions": [
              {
                "lessThanOrEqual": "Illustra.SS022.24.03.00.0008",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:johnsoncontrols:illustra_pro4_multisensor_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "illustra_pro4_multisensor_firmware",
            "vendor": "johnsoncontrols",
            "versions": [
              {
                "lessThanOrEqual": "Illustra.SS017.24.03.00.0009",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:johnsoncontrols:illustra_flex4_fixed_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "illustra_flex4_fixed_firmware",
            "vendor": "johnsoncontrols",
            "versions": [
              {
                "lessThanOrEqual": "Illustra.SS018.24.03.00.0010",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:johnsoncontrols:illustra_flex4_ptz_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "illustra_flex4_ptz_firmware",
            "vendor": "johnsoncontrols",
            "versions": [
              {
                "lessThanOrEqual": "Illustra.SS018.24.03.00.0010",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:johnsoncontrols:illustra_pro4_ptz_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "illustra_pro4_ptz_firmware",
            "vendor": "johnsoncontrols",
            "versions": [
              {
                "lessThanOrEqual": "Illustra.SS010.24.03.00.0005",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:johnsoncontrols:illustra_pro_gen_4_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "illustra_pro_gen_4_firmware",
            "vendor": "johnsoncontrols",
            "versions": [
              {
                "lessThanOrEqual": "Illustra.SS016.05.03.01.0007",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32753",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-12T19:41:41.470969Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-17T14:23:41.965Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:20:35.268Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-03"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "TYCO Illustra Pro4 Fixed cameras",
          "vendor": "Johnson Controls",
          "versions": [
            {
              "lessThanOrEqual": "Illustra.SS016.05.03.01.0007",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TYCO Illustra Pro4 PTZ cameras",
          "vendor": "Johnson Controls",
          "versions": [
            {
              "lessThanOrEqual": "Illustra.SS010.24.03.00.0005",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TYCO Illustra Flex4 Fixed \u0026 PTZ cameras",
          "vendor": "Johnson Controls",
          "versions": [
            {
              "lessThanOrEqual": "Illustra.SS018.24.03.00.0010",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TYCO Illustra Pro4 MultiSensor Cameras",
          "vendor": "Johnson Controls",
          "versions": [
            {
              "lessThanOrEqual": "Illustra.SS017.24.03.00.0009",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TYCO Illustra Flex4 DualSensor Cameras",
          "vendor": "Johnson Controls",
          "versions": [
            {
              "lessThanOrEqual": "Illustra.SS022.24.03.00.0008",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-07-09T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnder certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component\u003c/span\u003e"
            }
          ],
          "value": "Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-588",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-588: DOM-Based XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-16T14:50:34.077Z",
        "orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
        "shortName": "jci"
      },
      "references": [
        {
          "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-03"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\u003cli\u003e\u003cp\u003eUpdate firmware of \u003cstrong\u003ePro4 Fixed\u003c/strong\u003e cameras to \u003cstrong\u003eIllustra.SS016.24.03.00.0007\u003c/strong\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eUpdate firmware of \u003cstrong\u003ePro4 PTZ\u003c/strong\u003e cameras to\u003cstrong\u003e Illustra.SS010.24.03.00.0005\u003c/strong\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eUpdate firmware of \u003cstrong\u003eFlex4 Fixed \u0026amp; PTZ\u003c/strong\u003e cameras to \u003cstrong\u003eIllustra.SS018.24.03.00.0010\u003c/strong\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eUpdate firmware of \u003cstrong\u003ePro4 MultiSensor \u003c/strong\u003ecameras to \u003cstrong\u003eIllustra.SS017.24.03.00.0009\u003c/strong\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eUpdate firmware of \u003cstrong\u003eFlex4 DualSensor \u003c/strong\u003ecameras to \u003cstrong\u003eIllustra.SS022.24.03.00.0008\u003c/strong\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "*  Update firmware of Pro4 Fixed cameras to Illustra.SS016.24.03.00.0007\n\n\n  *  Update firmware of Pro4 PTZ cameras to Illustra.SS010.24.03.00.0005\n\n\n  *  Update firmware of Flex4 Fixed \u0026 PTZ cameras to Illustra.SS018.24.03.00.0010\n\n\n  *  Update firmware of Pro4 MultiSensor cameras to Illustra.SS017.24.03.00.0009\n\n\n  *  Update firmware of Flex4 DualSensor cameras to Illustra.SS022.24.03.00.0008"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYCO Illustra Pro Gen 4 - JQuery version",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
    "assignerShortName": "jci",
    "cveId": "CVE-2024-32753",
    "datePublished": "2024-07-11T15:30:39.367Z",
    "dateReserved": "2024-04-17T17:26:35.180Z",
    "dateUpdated": "2024-08-16T14:50:34.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-26293 (GCVE-0-2024-26293)

Vulnerability from cvelistv5 – Published: 2025-07-14 09:18 – Updated: 2025-07-14 14:40
VLAI
Title
Unauthenticated Path Traversal affecting Avid NEXIS
Summary
The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-14 14:37 UTC
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Credits
DriveByte CERT-Bund
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26293",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-14T14:37:19.883688Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-14T14:40:41.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "Windows"
          ],
          "product": "Avid NEXIS E-series",
          "vendor": "Avid",
          "versions": [
            {
              "lessThan": "2025.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "Windows"
          ],
          "product": "Avid NEXIS F-series",
          "vendor": "Avid",
          "versions": [
            {
              "lessThan": "2025.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "windows"
          ],
          "product": "Avid NEXIS PRO+",
          "vendor": "Avid",
          "versions": [
            {
              "lessThan": "2025.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "Windows"
          ],
          "product": "System Director Appliance (SDA+)",
          "vendor": "Avid",
          "versions": [
            {
              "lessThan": "2025.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "DriveByte"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "CERT-Bund"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Avid Nexis Agent uses a vulnerable gSOAP\nversion. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability.\u003cbr\u003e\u003cp\u003eThis issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.\u003c/p\u003e"
            }
          ],
          "value": "The Avid Nexis Agent uses a vulnerable gSOAP\nversion. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability.\nThis issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-14T09:18:18.045Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://resources.avid.com/SupportFiles/attach/AvidNEXIS/AvidNEXIS_2025_5_1_ReadMe.pdf"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.genivia.com/changelog.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated Path Traversal affecting Avid NEXIS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2024-26293",
    "datePublished": "2025-07-14T09:18:18.045Z",
    "dateReserved": "2024-02-16T16:12:43.383Z",
    "dateUpdated": "2025-07-14T14:40:41.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21421 (GCVE-0-2024-21421)

Vulnerability from cvelistv5 – Published: 2024-03-12 16:57 – Updated: 2025-05-03 00:46
VLAI
Title
Azure SDK Spoofing Vulnerability
Summary
Azure SDK Spoofing Vulnerability
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-12 19:21 UTC
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure SDK Affected: 1.0.0 , < 1.29.5 (custom)
    cpe:2.3:a:microsoft:azure_sdk:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2024-03-12 07:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:20:40.662Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure SDK Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21421"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-12T19:21:36.716605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-09T14:16:37.921Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure SDK",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.29.5",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_sdk:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.29.5",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-03-12T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure SDK Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-03T00:46:37.963Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure SDK Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21421"
        }
      ],
      "title": "Azure SDK Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-21421",
    "datePublished": "2024-03-12T16:57:43.762Z",
    "dateReserved": "2023-12-08T22:45:21.301Z",
    "dateUpdated": "2025-05-03T00:46:37.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-14031 (GCVE-0-2024-14031)

Vulnerability from cvelistv5 – Published: 2026-03-31 11:31 – Updated: 2026-04-01 16:30
VLAI
Title
Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library
Summary
Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-31 14:19 UTC
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Vendor Product Version
YVES Sereal::Encoder Affected: 4.000 , ≤ 4.009_002 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-14031",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T14:19:21.141997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1395",
                "description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T14:19:27.286Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Sereal-Encoder",
          "product": "Sereal::Encoder",
          "repo": "https://github.com/Sereal/Sereal",
          "vendor": "YVES",
          "versions": [
            {
              "lessThanOrEqual": "4.009_002",
              "status": "affected",
              "version": "4.000",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T16:30:00.649Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/advisories/GHSA-w77f-wv46-4vcx"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11922"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/YVES/Sereal-Encoder-4.010/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Sereal::Encoder version 4.010 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2017-02-06T00:00:00.000Z",
          "value": "Sereal::Encoder version 4.001_001 released."
        },
        {
          "lang": "en",
          "time": "2018-12-27T00:00:00.000Z",
          "value": "Zstandard 1.3.8 released."
        },
        {
          "lang": "en",
          "time": "2019-07-25T00:00:00.000Z",
          "value": "CVE-2019-11922 for Zstandard published"
        },
        {
          "lang": "en",
          "time": "2020-02-04T00:00:00.000Z",
          "value": "Sereal::Encoder version 4.010 released."
        },
        {
          "lang": "en",
          "time": "2023-02-09T00:00:00.000Z",
          "value": "Advisory added to the CPANSA database."
        },
        {
          "lang": "en",
          "time": "2024-02-17T00:00:00.000Z",
          "value": "Advisory updated in the CPANSA database."
        }
      ],
      "title": "Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2024-14031",
    "datePublished": "2026-03-31T11:31:28.100Z",
    "dateReserved": "2026-03-29T15:12:06.674Z",
    "dateUpdated": "2026-04-01T16:30:00.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-14030 (GCVE-0-2024-14030)

Vulnerability from cvelistv5 – Published: 2026-03-31 11:31 – Updated: 2026-04-01 16:29
VLAI
Title
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library
Summary
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-31 14:18 UTC
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Vendor Product Version
YVES Sereal::Decoder Affected: 4.000 , ≤ 4.009_002 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-14030",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T14:18:18.323057Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1395",
                "description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T14:18:55.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Sereal-Decoder",
          "product": "Sereal::Decoder",
          "repo": "https://github.com/Sereal/Sereal",
          "vendor": "YVES",
          "versions": [
            {
              "lessThanOrEqual": "4.009_002",
              "status": "affected",
              "version": "4.000",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T16:29:33.903Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/advisories/GHSA-w77f-wv46-4vcx"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11922"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Sereal::Decoder version 4.010 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2017-02-06T00:00:00.000Z",
          "value": "Sereal::Decoder version 4.001_001 released."
        },
        {
          "lang": "en",
          "time": "2018-12-27T00:00:00.000Z",
          "value": "Zstandard 1.3.8 released."
        },
        {
          "lang": "en",
          "time": "2019-07-25T00:00:00.000Z",
          "value": "CVE-2019-11922 for Zstandard published"
        },
        {
          "lang": "en",
          "time": "2020-02-04T00:00:00.000Z",
          "value": "Sereal::Decoder version 4.010 released."
        },
        {
          "lang": "en",
          "time": "2023-02-09T00:00:00.000Z",
          "value": "Advisory added to the CPANSA database."
        },
        {
          "lang": "en",
          "time": "2024-02-17T00:00:00.000Z",
          "value": "Advisory updated in the CPANSA database."
        }
      ],
      "title": "Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2024-14030",
    "datePublished": "2026-03-31T11:31:08.541Z",
    "dateReserved": "2026-03-28T19:49:07.023Z",
    "dateUpdated": "2026-04-01T16:29:33.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Requirements Policy

In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.

Mitigation
Requirements

Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].

Mitigation
Architecture and Design Implementation Integration Manufacturing

Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."

Mitigation
Operation Patching and Maintenance

Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.

Mitigation
Operation Patching and Maintenance

Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list