CVE-2024-52959criticalCWE-94

CVE-2024-52959: critical vulnerability in Galaxy Software Services Corporation iota C.ai…

iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')

Published

Follow this CVE+ Monitor iota C.ai Conversational Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.6%
A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H
Affected products
Galaxy Software Services Corporation · iota C.ai Conversational Platform
Related CVEs — Galaxy Software Services Corporation iota C.ai…

In the same product, most dangerous first.

CVE-2024-52958CRITICALiota C.ai Conversational Platform - Improper Verification of Cryptographic SignatureEPSS 0.3%