CVE-2024-22193

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-922

Affected software

VendorProductVersions
vantage6vantage6< 4.2.0

References

Timeline

Published
Jan 30, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-221942.8cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic CVE-2024-221956.1Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible tCVE-2024-221966.5Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This isCVE-2024-221978.8Nginx-ui is online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home CVE-2024-221988.8Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration setCVE-2024-221996.1This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerCVE-2024-22203.5The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege usersCVE-2024-222005.3vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, CVE-2024-222017.5Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it tCVE-2024-222026.5phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows aCVE-2024-222039.8Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate theCVE-2024-222045.3Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration o