Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.8/admin/release-notes/#3.8.16 - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes/#3.9.11 - https://https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.8 - https://https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.16
CVE ID: CVE-2024-1909 State: PUBLISHED Published: 2024-02-27T11:05:07.234Z Last Updated: 2024-08-23T19:43:13.249Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: frenify Products: Categorify – WordPress Media Library Category & File Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxRenameCategory function. This makes it possible for unauthenticated attackers to rename categories via a forged request granted they can trick a site admi
s it possible for unauthenticated attackers to rename categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/58b29729-e9c3-4d57-affd-6142dfa8cc6f?source=cve - https://plugins.trac.wordpress.org/changeset/3034410/categorify
CVE ID: CVE-2024-1910 State: PUBLISHED Published: 2024-02-27T11:05:09.553Z Last Updated: 2024-08-01T18:56:22.322Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: frenify Products: Categorify – WordPress Media Library Category & File Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxClearCategory function. This makes it possible for unauthenticated attackers to clear categories via a forged request granted they can trick a site admini
it possible for unauthenticated attackers to clear categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c2712d-0865-4759-98da-1e11a26f2466?source=cve - https://plugins.trac.wordpress.org/changeset/3034410/categorify
CVE ID: CVE-2024-1912 State: PUBLISHED Published: 2024-02-27T11:05:07.777Z Last Updated: 2024-08-01T18:56:22.567Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: frenify Products: Categorify – WordPress Media Library Category & File Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxUpdateFolderPosition function. This makes it possible for unauthenticated attackers to update the folder position of categories as well as update the meta
s makes it possible for unauthenticated attackers to update the folder position of categories as well as update the metadata of other taxonomies via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca28c91-f75e-4691-91cf-459cc9da5ad8?source=cve - https://plugins.trac.wordpress.org/changeset/3034410/categorify
CVE ID: CVE-2024-1913 State: PUBLISHED Published: 2024-05-14T13:20:55.671Z Last Updated: 2024-08-01T18:56:22.392Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: ABB Products: RobotWare 6, RobotWare 7 Problem Types: CWE-787 Description: An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible, or execute arbitrary code. The vulnerability could potentially be exploited to perform unauthorized actions by an attacker. This vulnerability arises under specific condition when specially crafted message is processed by the system. Below are reported vulnerabilities in the Robot Ware versions. *
specially crafted message is processed by the system. Below are reported vulnerabilities in the Robot Ware versions. * IRC5- RobotWare 6 < 6.15.06 except 6.10.10, and 6.13.07 * OmniCore- RobotWare 7 < 7.14 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=SI20330&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-1914 State: PUBLISHED Published: 2024-05-14T13:41:02.136Z Last Updated: 2024-08-01T18:56:22.492Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ABB Products: RobotWare 6, RobotWare 7 Problem Types: CWE-476 Description: An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible. The vulnerability could potentially be exploited to perform unauthorized actions by an attacker. This vulnerability arises under specific condition when specially crafted message is processed by the system. Below are reported vulnerabilities in the Robot Ware versions. * IRC5- RobotWare 6 < 6.15.
e is processed by the system. Below are reported vulnerabilities in the Robot Ware versions. * IRC5- RobotWare 6 < 6.15.06 except 6.10.10, and 6.13.07 * OmniCore- RobotWare 7 < 7.14 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=SI20330&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-1915 State: PUBLISHED Published: 2024-03-15T00:00:46.607Z Last Updated: 2024-08-27T19:56:54.512Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mitsubishi Electric Corporation Products: MELSEC-Q Series Q03UDECPU, MELSEC-Q Series Q04UDEHCPU, MELSEC-Q Series Q06UDEHCPU, MELSEC-Q Series Q10UDEHCPU, MELSEC-Q Series Q13UDEHCPU, MELSEC-Q Series Q20UDEHCPU, MELSEC-Q Series Q26UDEHCPU, MELSEC-Q Series Q50UDEHCPU, MELSEC-Q Series Q100UDEHCPU, MELSEC-Q Series Q03UDVCPU, MELSEC-Q Series Q04UDVCPU, MELSEC-Q Series Q06UDVCPU, MELSEC-Q Series Q13UDVCPU, MELSEC-Q Series Q26UDVCPU, MELSEC-Q Series Q04UDPVCPU, MELSEC-Q Series Q06UDPVCPU, MELSEC-Q Series Q
Q Series Q13UDVCPU, MELSEC-Q Series Q26UDVCPU, MELSEC-Q Series Q04UDPVCPU, MELSEC-Q Series Q06UDPVCPU, MELSEC-Q Series Q13UDPVCPU, MELSEC-Q Series Q26UDPVCPU, MELSEC-L Series L02CPU, MELSEC-L Series L06CPU, MELSEC-L Series L26CPU, MELSEC-L Series L02CPU-P, MELSEC-L Series L06CPU-P, MELSEC-L Series L26CPU-P, MELSEC-L Series L26CPU-BT, MELSEC-L Series L26CPU-PBT Problem Types: CWE-468 Description: Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet. Additional Analyst Notes: - CVE Program Container: -
ous code on a target product by sending a specially crafted packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf - https://jvn.jp/vu/JVNVU99690199/ - https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14
CVE ID: CVE-2024-1916 State: PUBLISHED Published: 2024-03-15T00:01:39.440Z Last Updated: 2024-08-27T19:57:29.350Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mitsubishi Electric Corporation Products: MELSEC-Q Series Q03UDECPU, MELSEC-Q Series Q04UDEHCPU, MELSEC-Q Series Q06UDEHCPU, MELSEC-Q Series Q10UDEHCPU, MELSEC-Q Series Q13UDEHCPU, MELSEC-Q Series Q20UDEHCPU, MELSEC-Q Series Q26UDEHCPU, MELSEC-Q Series Q50UDEHCPU, MELSEC-Q Series Q100UDEHCPU, MELSEC-Q Series Q03UDVCPU, MELSEC-Q Series Q04UDVCPU, MELSEC-Q Series Q06UDVCPU, MELSEC-Q Series Q13UDVCPU, MELSEC-Q Series Q26UDVCPU, MELSEC-Q Series Q04UDPVCPU, MELSEC-Q Series Q06UDPVCPU, MELSEC-Q Series Q
CVE ID: CVE-2024-1917 State: PUBLISHED Published: 2024-03-15T00:02:39.351Z Last Updated: 2024-08-27T19:58:12.567Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mitsubishi Electric Corporation Products: MELSEC-Q Series Q03UDECPU, MELSEC-Q Series Q04UDEHCPU, MELSEC-Q Series Q06UDEHCPU, MELSEC-Q Series Q10UDEHCPU, MELSEC-Q Series Q13UDEHCPU, MELSEC-Q Series Q20UDEHCPU, MELSEC-Q Series Q26UDEHCPU, MELSEC-Q Series Q50UDEHCPU, MELSEC-Q Series Q100UDEHCPU, MELSEC-Q Series Q03UDVCPU, MELSEC-Q Series Q04UDVCPU, MELSEC-Q Series Q06UDVCPU, MELSEC-Q Series Q13UDVCPU, MELSEC-Q Series Q26UDVCPU, MELSEC-Q Series Q04UDPVCPU, MELSEC-Q Series Q06UDPVCPU, MELSEC-Q Series Q
CVE ID: CVE-2024-1918 State: PUBLISHED Published: 2024-02-27T13:00:07.944Z Last Updated: 2024-08-01T18:56:22.413Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S42 Management Platform Problem Types: CWE-434 Description: A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/userattestation.php. The manipulation of the argument hidwel leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-25
The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254839. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254839 - https://vuldb.com/?ctiid.254839 - https://vuldb.com/?submit.284382 - https://github.com/Echosssy/CVE/blob/main/%E5%85%B3%E4%BA%8ESmart%20S42%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%E5%AD%98%E5%9C%A8%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E%E7%9A%84%E6%83%85%E5%86%B5%E9%80%9A%E6%8A%A5-userattestation.php.docx
CVE ID: CVE-2024-1919 State: PUBLISHED Published: 2024-02-27T13:31:04.551Z Last Updated: 2024-08-12T13:20:55.203Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Job Portal Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Online Job Portal 1.0. This vulnerability affects unknown code of the file /Employer/ManageWalkin.php of the component Manage Walkin Page. The manipulation of the argument Job Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-254854 is the identifier assigned to this vulnerability. Addit
oit has been disclosed to the public and may be used. VDB-254854 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.254854 - https://vuldb.com/?ctiid.254854 - https://prnt.sc/1W0g0F8vv2mw
CVE ID: CVE-2024-1920 State: PUBLISHED Published: 2024-02-27T13:31:11.311Z Last Updated: 2024-08-01T18:56:22.565Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: osuuu Products: LightPicture Problem Types: CWE-321 Description: A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/middleware/TokenVerify.php. The manipulation leads to use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The
ather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254855. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254855 - https://vuldb.com/?ctiid.254855 - https://vuldb.com/?submit.287588 - https://note.zhaoj.in/share/gKyCbSSdJ5fY
CVE ID: CVE-2024-1921 State: PUBLISHED Published: 2024-02-27T15:00:10.072Z Last Updated: 2024-08-01T18:56:22.336Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: osuuu Products: LightPicture Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254856. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References
this vulnerability is VDB-254856. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254856 - https://vuldb.com/?ctiid.254856 - https://note.zhaoj.in/share/FeCRflSHPLbj
CVE ID: CVE-2024-1922 State: PUBLISHED Published: 2024-02-27T15:31:04.614Z Last Updated: 2024-08-01T18:56:22.646Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Job Portal Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Employer/ManageJob.php of the component Manage Job Page. The manipulation of the argument Qualification/Description leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254857 was
ck can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254857 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254857 - https://vuldb.com/?ctiid.254857 - https://prnt.sc/zw3SnPnfpKGu - https://prnt.sc/WD3nof5FsEBv
CVE ID: CVE-2024-1923 State: PUBLISHED Published: 2024-02-27T16:00:06.873Z Last Updated: 2024-08-01T18:56:22.342Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Student Attendance System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as critical. Affected by this issue is the function delete_class/delete_student of the file /ajax-api.php of the component List of Classes Page. The manipulation of the argument id with the input 1337'+or+1=1;--+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
ds to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254858 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254858 - https://vuldb.com/?ctiid.254858 - https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/SOURCECODESTER%20%5BSimple%20Student%20Attendance%20System%20using%20PHP%20and%20MySQL%5D%20SQLi%20on%20ajax-api.php%3Faction=delete_class.md
CVE ID: CVE-2024-1924 State: PUBLISHED Published: 2024-02-27T16:31:04.454Z Last Updated: 2024-08-01T18:56:22.586Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: CodeAstro Products: Membership Management System Problem Types: CWE-89 Description: A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /get_membership_amount.php. The manipulation of the argument membershipTypeId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254859. Additional Analy
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254859. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254859 - https://vuldb.com/?ctiid.254859 - https://github.com/1testnew/CVE_Hunter/blob/main/SQLi-1.md
CVE ID: CVE-2024-1925 State: PUBLISHED Published: 2024-02-27T17:00:10.439Z Last Updated: 2024-08-08T19:09:47.257Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Ctcms Problem Types: CWE-434 Description: A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Upsys.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-25486
fficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254860. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.254860 - https://vuldb.com/?ctiid.254860 - https://docs.qq.com/doc/DQkVmRXBlbGNPZmlL
CVE ID: CVE-2024-1926 State: PUBLISHED Published: 2024-02-27T17:00:12.007Z Last Updated: 2025-04-22T16:08:36.353Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Free and Open Source Inventory Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /app/ajax/search_sales_report.php. The manipulation of the argument customer leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254861 was a
may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254861 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254861 - https://vuldb.com/?ctiid.254861 - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Free%20and%20Open%20Source%20inventory%20management%20system-SQLi.md
CVE ID: CVE-2024-1927 State: PUBLISHED Published: 2024-02-27T17:31:04.548Z Last Updated: 2024-08-12T15:54:14.791Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Web-Based Student Clearance System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin/login.php. The manipulation of the argument txtpassword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254863. Add
oit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254863. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.254863 - https://vuldb.com/?ctiid.254863 - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Web-Based%20Student%20Clearance%20System%20-%20SQLi.md
CVE ID: CVE-2024-1928 State: PUBLISHED Published: 2024-02-27T17:31:05.940Z Last Updated: 2024-08-01T18:56:22.352Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Web-Based Student Clearance System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit-admin.php of the component Edit User Profile Page. The manipulation of the argument Fullname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifie
ection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254864. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254864 - https://vuldb.com/?ctiid.254864 - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Web-Based%20Student%20Clearance%20System%20-%20XSS.md
CVE ID: CVE-2024-1929 State: PUBLISHED Published: 2024-05-08T01:53:34.726Z Last Updated: 2024-09-17T21:32:39.341Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Fedora Products: dnf5daemon-server Problem Types: CWE-20 Description: Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. There are issues with the D-Bus interface long before Polkit is invoked. The `org.rpm.dnf.v0.SessionManager.open_session` method takes a key/value map of configuration entries. A sub-entry in this map, placed under the "config" key, is another key/value map.
y/value map of configuration entries. A sub-entry in this map, placed under the "config" key, is another key/value map. The configuration values found in it will be forwarded as configuration overrides to the `libdnf5::Base` configuration. Practically all libdnf5 configuration aspects can be influenced here. Already when opening the session via D-Bus, the libdnf5 will be initialized using these override configuration values. There is no sanity checking of the content of this "config" map, which is untrusted data. It is possible to make the library loading a plug-in shared library under control of an unprivileged user, hence achieving root access. Additional Analyst Notes: - CISA ADP Vulnrich
ibrary under control of an unprivileged user, hence achieving root access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2024/03/04/2
CVE ID: CVE-2024-1930 State: PUBLISHED Published: 2024-05-08T01:52:54.938Z Last Updated: 2024-08-01T18:56:22.475Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Fedora Products: dnf5daemon-server Problem Types: CWE-400 Description: No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the `open_session()` D-Bus method. For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further conn
thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2024/03/04/2