DuyTa/cve-kgrag-db huggingface dataset:
CVE-2024-9213
The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://plugins.trac.wordpress.org/browser/persian-woocommerce-sms/tags/7.0.2/src/Subscribe/Contacts.php#L290, https://plugins.trac.wordpress.org/browser/persian-woocommerce-sms/tags/7.0.2/src/Subscribe/Contacts.php#L412, https://plugins.trac.wordpress.org/browser/persian-woocommerce-sms/tags/7.0.2/src/Subscribe/Contacts.php#L527
CWE: CWE-79
CVE-2024-31370
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeIsAwesome AIKit aikit-wordpress-ai-writing-assistant-using-gpt3.This issue affects AIKit: from n/a through <= 4.14.1.
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://patchstack.com/database/Wordpress/Plugin/aikit-wordpress-ai-writing-assistant-using-gpt3/vulnerability/wordpress-codeisawesome-aikit-plugin-4-14-1-sql-injection-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/aikit-wordpress-ai-writing-assistant-using-gpt3/wordpress-codeisawesome-aikit-plugin-4-14-1-sql-injection-vulnerability?_s_id=cve
CWE: CWE-89
CVE-2024-3229
The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: salon_booking_system
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://plugins.trac.wordpress.org/changeset/3103584/salon-booking-system/trunk/src/SLN/Action/Ajax/ImportAssistants.php, https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbbf5be-5c0a-4514-88ac-003083c0bba3?source=cve, https://plugins.trac.wordpress.org/changeset/3103584/salon-booking-system/trunk/src/SLN/Action/Ajax/ImportAssistants.php
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2024-8699
The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: z-downloads
References: https://wpscan.com/vulnerability/9013351e-224f-4696-970f-eb843dc8dace/, https://wpscan.com/vulnerability/9013351e-224f-4696-970f-eb843dc8dace/
CVE-2024-51525
Permission control vulnerability in the clipboard module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1 Score: 6.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: harmonyos
Related CWEs: CWE-285
Related CAPECs: CAPEC-13, CAPEC-668, CAPEC-17
MITRE ATT&CK Techniques: T1574.006, T1565.002, T1005
MITRE ATT&CK Tactics: T1134, T1550, T1565
References: https://consumer.huawei.com/en/support/bulletin/2024/11/
CWE: CWE-285
MITRE ATT&CK techniques: T1574.006, T1565.002, T1005, T1083, T1574.007, T1550.004, T1134.001, T1574.010, T1562.003, T1574.005, T1012, T1552.002
MITRE ATT&CK tactics: T1134, T1550, T1565, T1552, T1562, T1574
CVE-2024-20267
A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the netstack process to unexpectedly restart, which could cause the device to stop processing network traffic or to reload. 
 This vulnerability is due to lack of proper error checking when processing an ingress MPLS frame. An attacker could exploit this vulnerability by sending a crafted IPv6 packet that is encapsulated within an MPLS frame to an MPLS-enabled interface of the targeted device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition.
 Note: The IPv6 packet can be generated multiple hops away from the targeted device and then encapsulated within MPLS. The DoS condition may occur when the NX-OS device processes the packet.
CVSS v3.1 Score: 8.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Affected Products: nx-os
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv6-mpls-dos-R9ycXkwM, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv6-mpls-dos-R9ycXkwM
CWE: CWE-120
CVE-2024-54206
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in URBAN BASE Z-Downloads z-downloads allows Stored XSS.This issue affects Z-Downloads: from n/a through <= 1.11.7.
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/z-downloads/vulnerability/wordpress-z-downloads-plugin-1-11-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2024-29071
HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-1391, CWE-522
Related CAPECs: CAPEC-560, CAPEC-644, CAPEC-653
MITRE ATT&CK Techniques: T1550.003, T1021.002, T1133
MITRE ATT&CK Tactics: T1110, T1114, T1558
References: https://jvn.jp/en/vu/JVNVU93546510/, https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f, https://jvn.jp/en/vu/JVNVU93546510/
CWE: CWE-1391, CWE-522
MITRE ATT&CK techniques: T1550.003, T1021.002, T1133, T1114.002, T1110.004, T1543, T1552.004, T1558.003, T1558, T1021, T1550.002, T1078
MITRE ATT&CK tactics: T1110, T1114, T1558, T1550, T1552, T1021
CVE-2024-21309
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_11_22h2, windows_11_23h2, windows_11_21h2, windows_server_2022, windows_server_2022_23h2
Related CWEs: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21309, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21309
CWE: CWE-191
CVE-2024-23198
Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access.
CVSS v3.1 Score: 6.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Affected Products: wi-fi_6_ax200, wi-fi_6e_ax411, wireless-ac_9560, wi-fi_7_be200, killer_wi-fi_6e_ax1690
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2024-1003
A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252272. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 8.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:M/C:C/I:C/A:C
Affected Products: n200re_firmware, n200re
Related CWEs: CWE-121
References: https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setLanguageCfg-72357294db1e4f8096b29d3f2592d1fc?pvs=4, https://vuldb.com/?ctiid.252272, https://vuldb.com/?id.252272
CWE: CWE-121
CVE-2024-44667
Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router M7628NNxISPxUIv2_v1.0.1557.15.35_P0 is vulnerable to Incorrect Access Control. Unauthenticated factory mode reset and command injection leads to information exposure and root shell access.
CVSS v3.1 Score: 8.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-863
References: http://shenzhen.com, https://medium.com/%40sengkyaut/unauthenticated-factory-mode-reset-and-at-command-injection-in-jboneos-or-jbonecloud-firmware-1dec156b7ddd
CWE: CWE-863
CVE-2024-51829
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in figoliquinn Mobile Kiosk mobile-kiosk allows Stored XSS.This issue affects Mobile Kiosk: from n/a through <= 1.3.0.
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/mobile-kiosk/vulnerability/wordpress-mobile-kiosk-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2024-33575
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0.


CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: https://patchstack.com/database/vulnerability/user-meta/wordpress-user-meta-plugin-3-0-sensitive-data-exposure-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/user-meta/wordpress-user-meta-plugin-3-0-sensitive-data-exposure-vulnerability?_s_id=cve
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2024-52514
Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 27.1.9, 28.0.5 or 29.0.0 and Nextcloud Enterprise Server is upgraded to 21.0.9.18, 22.2.10.23, 23.0.12.18, 24.0.12.14, 25.0.13.9, 26.0.13.3, 27.1.9, 28.0.5 or 29.0.0.
CVSS v3.1 Score: 4.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected Products: nextcloud_server
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g8pr-g25r-58xj, https://github.com/nextcloud/server/commit/5fffbcfe8650eab75b00e8d188fbc95b0e43f3a8, https://github.com/nextcloud/server/pull/44889
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2024-0005
A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected Products: purity////fb, purity////fa
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://purestorage.com/security
CWE: CWE-77
CVE-2024-37152
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by  /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products: argo_cd
Related CWEs: CWE-287, CWE-306
Related CAPECs: CAPEC-151, CAPEC-12, CAPEC-216
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771b, https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2, https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771b
CWE: CWE-287, CWE-306
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2024-12297
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.
Related CWEs: CWE-656
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241407-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-in-eds-508a-series, https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241408-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-identified-in-pt-switches
CWE: CWE-656
CVE-2024-51252
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: vigor3900, vigor3900_firmware
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CWE: CWE-78
CVE-2024-27174
Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combination with other vulnerabilities and  difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.
 https://www.toshibatec.com/contacts/products/ 
As for the affected products/models/versions, see the reference URL.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://seclists.org/fulldisclosure/2024/Jul/1, https://jvn.jp/en/vu/JVNVU97136265/index.html, https://www.toshibatec.com/information/20240531_01.html
CWE: CWE-22
CVE-2024-39489
In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: fix memleak in seg6_hmac_init_algo

seg6_hmac_init_algo returns without cleaning up the previous allocations
if one fails, so it's going to leak all that memory and the crypto tfms.

Update seg6_hmac_exit to only free the memory when allocated, so we can
reuse the code directly.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-401
References: https://git.kernel.org/stable/c/0e44d6cbe8de983470c3d2f978649783384fdcb6, https://git.kernel.org/stable/c/4a3fcf53725b70010d1cf869a2ba549fed6b8fb3, https://git.kernel.org/stable/c/599a5654215092ac22bfc453f4fd3959c55ea821
CWE: CWE-401
CVE-2024-34959
DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys_data_replace.php.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected Products: dedecms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://gitee.com/upgogo/s123/issues/I9MARO, https://gitee.com/upgogo/s123/issues/I9MARO
CWE: CWE-79
CVE-2024-35882
In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP

Jan Schunk reports that his small NFS servers suffer from memory
exhaustion after just a few days. A bisect shows that commit
e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single
sock_sendmsg() call") is the first bad commit.

That commit assumed that sock_sendmsg() releases all the pages in
the underlying bio_vec array, but the reality is that it doesn't.
svc_xprt_release() releases the rqst's response pages, but the
record marker page fragment isn't one of those, so it is never
released.

This is a narrow fix that can be applied to stable kernels. A
more extensive fix is in the works.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-401
References: https://git.kernel.org/stable/c/05258a0a69b3c5d2c003f818702c0a52b6fea861, https://git.kernel.org/stable/c/1ba1291172f935e6b6fe703161a948f3347400b8, https://git.kernel.org/stable/c/a2ebedf7bcd17a1194a0a18122c885eb578ee882
CWE: CWE-401
CVE-2024-20440
A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.

This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: smart_license_utility
Related CWEs: CWE-532
Related CAPECs: CAPEC-215
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw
CWE: CWE-532
CVE-2024-4970
The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products: widget_bundle
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://wpscan.com/vulnerability/4a9fc352-7ec2-4992-9cda-7bdca4f42788/, https://wpscan.com/vulnerability/4a9fc352-7ec2-4992-9cda-7bdca4f42788/
CWE: CWE-79
CVE-2024-41511
A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers to retrieve arbitrary local files via the "path" parameter.
CVSS v3.1 Score: 3.9 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected Products: cadclick
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://cadclick.de/, http://kimweb.de/, https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CWE: CWE-22
CVE-2024-25031
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials.  IBM X-Force ID:  281678.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: storage_defender
Related CWEs: CWE-307
Related CAPECs: CAPEC-560, CAPEC-653, CAPEC-600
MITRE ATT&CK Techniques: T1110.004, T1110.001, T1558
MITRE ATT&CK Tactics: T1110
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/281678, https://www.ibm.com/support/pages/node/7158446, https://exchange.xforce.ibmcloud.com/vulnerabilities/281678
CWE: CWE-307
MITRE ATT&CK techniques: T1110.004, T1110.001, T1558, T1110.003, T1078
MITRE ATT&CK tactics: T1110
CVE-2024-45740
In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: splunk_cloud_platform, splunk
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://advisory.splunk.com/advisories/SVD-2024-1010, https://research.splunk.com/application/d4f55f7c-6518-4122-a197-951fe0f21b25/
CWE: CWE-79
CVE-2024-37133
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to unauthorized gain of root-level access.
CVSS v3.1 Score: 6.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: powerscale_onefs
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities, https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CWE: CWE-269
MITRE ATT&CK techniques: T1548
CVE-2024-38537
Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard. Therefore it was possible for users of legacy, pre-2017 browsers who navigate to a page serving `fides.js` to download and execute malicious scripts from the `polyfill.io` domain when the domain was compromised and serving malware. No exploitation of `fides.js` via `polyfill.io` has been identified as of time of publication.

The vulnerability has been patched in Fides version `2.39.1`. Users are advised to upgrade to this version or later to secure their systems against this threat. On Thursday, June 27, 2024, Cloudflare and Namecheap intervened at a domain level to ensure `polyfill.io` and its subdomains could not resolve to the compromised service, rendering this vulnerability unexploitable. Prior to the domain level intervention, there were no server-side workarounds and the confidentiality, integrity, and availability impacts of this vulnerability were high. Clients could ensure they were not affected by using a modern browser that supported the fetch standard.
Affected Products: fides
Related CWEs: CWE-829
Related CAPECs: CAPEC-253, CAPEC-660, CAPEC-695
MITRE ATT&CK Techniques: T1195.001, T1574.006, T1505.005
MITRE ATT&CK Tactics: T1574, T1195, T1505
References: https://fetch.spec.whatwg.org, https://github.com/ethyca/fides/commit/868c4d629760572192bd61db34f5a4458ed12005, https://github.com/ethyca/fides/pull/5026
CWE: CWE-829
MITRE ATT&CK techniques: T1195.001, T1574.006, T1505.005, T1176, T1574.013, T1620, T1055, T1505.004
MITRE ATT&CK tactics: T1574, T1195, T1505
CVE-2024-43627
Windows Telephony Service Remote Code Execution Vulnerability
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_23h2, windows_11_24h2
Related CWEs: CWE-122
Related CAPECs: CAPEC-92
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43627
CWE: CWE-122
CVE-2024-30079
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_23h2, windows_11_21h2
Related CWEs: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30079, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30079
CWE: CWE-126
CVE-2024-33371
Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the makehtml_list_action.php component.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: dedecms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://gitee.com/zchuanwen/cve/issues/I9HQRY, https://gitee.com/zchuanwen/cve/issues/I9HQRY
CWE: CWE-79
CVE-2024-48541
Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive information by analyzing the code and data within the APK file.
CVSS v3.1 Score: 8.4 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-863
References: http://www.ruochanit.com/, https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.ruochan.dabai/com.ruochan.dabai.md
CWE: CWE-863
CVE-2024-56463
IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products: qradar_security_information_and_event_manager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://www.ibm.com/support/pages/node/7183251
CWE: CWE-79
CVE-2024-27763
XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where "scontrol show hostname" is executed in the presence of a crafted SLURM_NODELIST environment variable.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://gist.github.com/aydinnyunus/40e1d8a3b529261ae654ff4891f1e192, https://github.com/XPixelGroup/BasicSR/blob/master/basicsr/utils/dist_util.py#L44
CWE: CWE-77
CVE-2024-0519
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: chrome, couchbase_server, fedora
Related CWEs: CWE-125, CWE-787
Related CAPECs: CAPEC-540
WARNING: This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog
References: https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html, https://crbug.com/1517354, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/
CWE: CWE-125, CWE-787
CVE-2024-44983
In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: validate vlan header

Ensure there is sufficient room to access the protocol field of the
VLAN header, validate it once before the flowtable lookup.

=====================================================
BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32
 nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626
 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline]
 nf_ingress net/core/dev.c:5440 [inline]
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-908
References: https://git.kernel.org/stable/c/0279c35d242d037abeb73d60d06a6d1bb7f672d9, https://git.kernel.org/stable/c/043a18bb6cf16adaa2f8642acfde6e8956a9caaa, https://git.kernel.org/stable/c/6ea14ccb60c8ab829349979b22b58a941ec4a3ee
CWE: CWE-908
CVE-2024-53140
In the Linux kernel, the following vulnerability has been resolved:

netlink: terminate outstanding dump on socket close

Netlink supports iterative dumping of data. It provides the families
the following ops:
 - start - (optional) kicks off the dumping process
 - dump  - actual dump helper, keeps getting called until it returns 0
 - done  - (optional) pairs with .start, can be used for cleanup
The whole process is asynchronous and the repeated calls to .dump
don't actually happen in a tight loop, but rather are triggered
in response to recvmsg() on the socket.

This gives the user full control over the dump, but also means that
the user can close the socket without getting to the end of the dump.
To make sure .start is always paired with .done we check if there
is an ongoing dump before freeing the socket, and if so call .done.

The complication is that sockets can get freed from BH and .done
is allowed to sleep. So we use a workqueue to defer the call, when
needed.

Unfortunately this does not work correctly. What we defer is not
the cleanup but rather releasing a reference on the socket.
We have no guarantee that we own the last reference, if someone
else holds the socket they may release it in BH and we're back
to square one.

The whole dance, however, appears to be unnecessary. Only the user
can interact with dumps, so we can clean up when socket is closed.
And close always happens in process context. Some async code may
still access the socket after close, queue notification skbs to it etc.
but no dumps can start, end or otherwise make progress.

Delete the workqueue and flush the dump state directly from the release
handler. Note that further cleanup is possible in -next, for instance
we now always call .done before releasing the main module reference,
so dump doesn't have to take a reference of its own.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/114a61d8d94ae3a43b82446cf737fd757021b834, https://git.kernel.org/stable/c/176c41b3ca9281a9736b67c6121b03dbf0c8c08f, https://git.kernel.org/stable/c/1904fb9ebf911441f90a68e96b22aa73e4410505
CVE-2024-53797
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Stored XSS.This issue affects Beaver Builder: from n/a through <= 2.8.4.3.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: beaver_builder
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/beaver-builder-lite-version/vulnerability/wordpress-beaver-builder-wordpress-page-builder-plugin-2-8-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2024-37506
Missing Authorization vulnerability in Charitable Donations & Fundraising Team Charitable allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Charitable: from n/a through 1.8.1.7.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/vulnerability/charitable/wordpress-donation-forms-by-charitable-plugin-1-8-1-7-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2024-39564
This is a similar, but different vulnerability than the issue reported as CVE-2024-39549.

A double-free vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This double free of memory is causing an rpd crash, leading to a Denial of Service (DoS).


This issue affects:

Junos OS:   *  from 22.4 before 22.4R3-S4.


Junos OS Evolved:  *  from 22.4 before 22.4R3-S4-EVO.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: junos_os_evolved, junos
Related CWEs: CWE-415
References: https://supportportal.juniper.net/JSA83011
CWE: CWE-415
CVE-2024-35099
TOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the function loginAuth.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: lr350, lr350_firmware
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/V9.3.5u.6698_B20230810/README.md, https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/V9.3.5u.6698_B20230810/README.md
CWE: CWE-120
CVE-2024-0737
A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Login. The manipulation of the argument user leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251560.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: xlight_ftp_server
Related CWEs: CWE-404
Related CAPECs: CAPEC-496, CAPEC-125, CAPEC-666
MITRE ATT&CK Techniques: T1499.001, T1499.003, T1499
MITRE ATT&CK Tactics: T1498, T1499
References: https://packetstormsecurity.com/files/176553/LightFTP-1.1-Denial-Of-Service.html, https://vuldb.com/?ctiid.251560, https://vuldb.com/?id.251560
CWE: CWE-404
MITRE ATT&CK techniques: T1499.001, T1499.003, T1499, T1498.001
MITRE ATT&CK tactics: T1498, T1499
CVE-2024-1264
A vulnerability has been found in Juanpao JPShop up to 1.5.02 and classified as critical. Affected by this vulnerability is the function actionUpdate of the file /api/controllers/common/UploadsController.php. The manipulation of the argument imgage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-253003.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: jpshop
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://note.zhaoj.in/share/f8b2IX7GsZS5, https://vuldb.com/?ctiid.253003, https://vuldb.com/?id.253003
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2024-0320
Cross-Site Scripting in FireEye Malware Analysis (AX) affecting version 9.0.3.936530. This vulnerability allows an attacker to send a specially crafted JavaScript payload in the application URL to retrieve the session details of a legitimate user.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products: malware_analysis
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products, https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products
CWE: CWE-79
CVE-2024-51506
Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the description.
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products: tiki
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/r0ck3t1973/xss_payload/issues/8, https://security.tiki.org/Disclose-a-Vulnerability
CWE: CWE-79
CVE-2024-49838
Information disclosure while parsing the OCI IE with invalid length.
CVSS v3.1 Score: 8.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected Products: qca6777aq, wsa8832, qcm8550_firmware, ssg2125p, sd865_5g_firmware
Related CWEs: CWE-125, CWE-126
Related CAPECs: CAPEC-540
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CWE: CWE-125, CWE-126
CVE-2024-49068
Microsoft SharePoint Elevation of Privilege Vulnerability
CVSS v3.1 Score: 8.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected Products: sharepoint_server
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49068
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2024-33681
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Regenerate post permalink allows Cross-Site Scripting (XSS).This issue affects Regenerate post permalink: from n/a through 1.0.3.


CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/regenerate-post-permalinks/wordpress-regenerate-post-permalink-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, https://patchstack.com/database/vulnerability/regenerate-post-permalinks/wordpress-regenerate-post-permalink-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2024-26967
In the Linux kernel, the following vulnerability has been resolved:

clk: qcom: camcc-sc8280xp: fix terminating of frequency table arrays

The frequency table arrays are supposed to be terminated with an
empty element. Add such entry to the end of the arrays where it
is missing in order to avoid possible out-of-bound access when
the table is traversed by functions like qcom_find_freq() or
qcom_find_freq_floor().

Only compile tested.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-129
Related CAPECs: CAPEC-100
References: https://git.kernel.org/stable/c/6a3d70f7802a98e6c28a74f997a264118b9f50cd, https://git.kernel.org/stable/c/93ff48729211dae55df5d216023be4528d29babb, https://git.kernel.org/stable/c/6a3d70f7802a98e6c28a74f997a264118b9f50cd
CWE: CWE-129
CVE-2024-38610
In the Linux kernel, the following vulnerability has been resolved:

drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()

Patch series "mm: follow_pte() improvements and acrn follow_pte() fixes".

Patch #1 fixes a bunch of issues I spotted in the acrn driver.  It
compiles, that's all I know.  I'll appreciate some review and testing from
acrn folks.

Patch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding
more sanity checks, and improving the documentation.  Gave it a quick test
on x86-64 using VM_PAT that ends up using follow_pte().


This patch (of 3):

We currently miss handling various cases, resulting in a dangerous
follow_pte() (previously follow_pfn()) usage.

(1) We're not checking PTE write permissions.

Maybe we should simply always require pte_write() like we do for
pin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let's check for
ACRN_MEM_ACCESS_WRITE for now.

(2) We're not rejecting refcounted pages.

As we are not using MMU notifiers, messing with refcounted pages is
dangerous and can result in use-after-free. Let's make sure to reject them.

(3) We are only looking at the first PTE of a bigger range.

We only lookup a single PTE, but memmap->len may span a larger area.
Let's loop over all involved PTEs and make sure the PFN range is
actually contiguous. Reject everything else: it couldn't have worked
either way, and rather made use access PFNs we shouldn't be accessing.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
Related CWEs: CWE-416
References: https://git.kernel.org/stable/c/2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb, https://git.kernel.org/stable/c/3d6586008f7b638f91f3332602592caa8b00b559, https://git.kernel.org/stable/c/4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4
CWE: CWE-416
CVE-2024-9454
The PriPre plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS v3.1 Score: 6.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://wordpress.org/plugins/pripre/#developers, https://www.wordfence.com/threat-intel/vulnerabilities/id/6662fee4-7e04-492f-bf79-2c915da92c92?source=cve
CWE: CWE-79
CVE-2024-22734
An issue was discovered in AMCS Group Trux Waste Management Software before version 7.19.0018.26912, allows local attackers to obtain sensitive information via a static, hard-coded AES Key-IV pair in the TxUtilities.dll and TruxUser.cfg components.
CVSS v3.1 Score: 6.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: trux_waste_management
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: https://www.redlinecybersecurity.com/blog/cve-2024-22734, https://www.redlinecybersecurity.com/blog/cve-2024-22734
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2024-9722
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24106.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: sketchup_viewer
Related CWEs: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1481/
CWE: CWE-416
CVE-2024-41074
In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Set object to close if ondemand_id < 0 in copen

If copen is maliciously called in the user mode, it may delete the request
corresponding to the random id. And the request may have not been read yet.

Note that when the object is set to reopen, the open request will be done
with the still reopen state in above case. As a result, the request
corresponding to this object is always skipped in select_req function, so
the read request is never completed and blocks other process.

Fix this issue by simply set object to close if its id < 0 in copen.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
Related CWEs: CWE-416
References: https://git.kernel.org/stable/c/0845c553db11c84ff53fccd59da11b6d6ece4a60, https://git.kernel.org/stable/c/4f8703fb3482f92edcfd31661857b16fec89c2c0, https://git.kernel.org/stable/c/703bea37d13e4ccdafd17ae7c4cb583752ba7663
CWE: CWE-416
CVE-2024-51639
Cross-Site Request Forgery (CSRF) vulnerability in Hints Naver Blog naver-blog-api allows Stored XSS.This issue affects Naver Blog: from n/a through <= 1.0.
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/Wordpress/Plugin/naver-blog-api/vulnerability/wordpress-naver-blog-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2024-32482
The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available.
CVSS v3.1 Score: 2.2 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Related CWEs: CWE-367, CWE-125
Related CAPECs: CAPEC-540, CAPEC-29, CAPEC-27
References: https://bugbounty.tillitis.se/security-bulletins/tillitis-security-bulletin-240115-1, https://github.com/tillitis/tkey-device-signer/security/advisories/GHSA-frqc-62hv-379p, https://bugbounty.tillitis.se/security-bulletins/tillitis-security-bulletin-240115-1
CWE: CWE-367, CWE-125
CVE-2024-0808
Integer underflow in WebUI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: debian_linux, fedora, chrome
Related CWEs: CWE-191
References: https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_23.html, https://crbug.com/1504936, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMI6GXFONZV6HE3BPZO3AP6GUVQLG4JQ/
CWE: CWE-191
CVE-2024-43086
In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: android
Related CWEs: CWE-276
Related CAPECs: CAPEC-127, CAPEC-1, CAPEC-81
MITRE ATT&CK Techniques: T1083, T1574.010
MITRE ATT&CK Tactics: T1574
References: https://android.googlesource.com/platform/frameworks/base/+/55a3d36701bb874358f685d3ac3381eda10fcff0, https://source.android.com/security/bulletin/2024-11-01
CWE: CWE-276
MITRE ATT&CK techniques: T1083, T1574.010
MITRE ATT&CK tactics: T1574