alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2024-0099 (published 2024-06-13)
NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where the guest OS could cause buffer overrun in the host. A successful exploit of this vulnerability might lead to information disclosure, data tampering, escalation of privileges, and denial of service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
CVE-2024-0100 (published 2024-05-14)
NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system files. A successful exploit of this vulnerability might lead to denial of service and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-73
Affected vendors: linux, nvidia
Affected products: linux_kernel, triton_inference_server
CVE-2024-0101 (published 2024-08-08)
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter definitions could enable an attacker to cause a failure by attacking the switch. A successful exploit of this vulnerability might lead to denial of service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-693
Affected vendors: nvidia
Affected products: mga100-hs2, mlnx-gw, mlnx-os, mtq8400-hs2r, nvda-os_xc, onyx, tq8100-hs2f, tq8200-hs2f
CVE-2024-0102 (published 2024-08-08)
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm, where an attacker can cause an out-of-bounds read issue by deceiving a user into reading a malformed ELF file. A successful exploit of this vulnerability might lead to denial of service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: linux, microsoft, nvidia
Affected products: cuda_toolkit, linux_kernel, windows
CVE-2024-0103 (published 2024-06-13)
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user may cause an incorrect Initialization of resource by network issue. A successful exploit of this vulnerability may lead to information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: linux, microsoft, nvidia
Affected products: linux_kernel, triton_inference_server, windows
CVE-2024-0104 (published 2024-08-08)
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a user can cause improper access. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and escalation of privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: nvidia
Affected products: mga100-hs2, mlnx-gw, mlnx-os, mtq8400-hs2r, nvda-os_xc, onyx, tq8100-hs2f, tq8200-hs2f
CVE-2024-0105 (published 2024-11-01)
NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H)
Weakness: CWE-274
CVE-2024-0106 (published 2024-11-01)
NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H)
Weakness: CWE-274
CVE-2024-0107 (published 2024-08-08)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: microsoft, nvidia
Affected products: cloud_gaming, geforce, gpu_display_driver, quadro, rtx, tesla, virtual_gpu, windows
CVE-2024-0108 (published 2024-08-08)
NVIDIA Jetson Linux contains a vulnerability in NvGPU where error handling paths in GPU MMU mapping code fail to clean up a failed mapping attempt. A successful exploit of this vulnerability may lead to denial of service, code execution, and escalation of privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-755
Affected vendors: nvidia
Affected products: jetson_agx_xavier, jetson_agx_xavier_16gb, jetson_agx_xavier_32gb, jetson_agx_xavier_64gb, jetson_agx_xavier_8gb, jetson_agx_xavier_industrial, jetson_linux, jetson_nano, jetson_nano_2gb, jetson_tx1, jetson_tx1_l4t, jetson_tx2, jetson_tx2_4gb, jetson_tx2_nx, jetson_tx2i, jetson_xavier_nx, jetson_xavier_nx_16gb
CVE-2024-0109 (published 2024-08-31)
NVIDIA CUDA Toolkit contains a vulnerability in command `cuobjdump` where a user may cause a crash by passing in a malformed ELF file. A successful exploit of this vulnerability may cause an out of bounds read in the unprivileged process memory which could lead to a limited denial of service.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Weakness: CWE-125
Affected vendors: nvidia
Affected products: cuda_toolkit
CVE-2024-0110 (published 2024-08-31)
NVIDIA CUDA Toolkit contains a vulnerability in command `cuobjdump` where a user may cause an out-of-bound write by passing in a malformed ELF file. A successful exploit of this vulnerability may lead to code execution or denial of service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: nvidia
Affected products: cuda_toolkit
CVE-2024-0111 (published 2024-08-31)
NVIDIA CUDA Toolkit contains a vulnerability in command 'cuobjdump' where a user may cause a crash or produce incorrect output by passing a malformed ELF file. A successful exploit of this vulnerability may lead to a limited denial of service or data tampering.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Weakness: CWE-1284
Affected vendors: nvidia
Affected products: cuda_toolkit
CVE-2024-0113 (published 2024-08-12)
NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A successful exploit of this vulnerability might lead to escalation of privileges and information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-35
Affected vendors: nvidia
Affected products: mga100-hs2, mlnx-gw, mlnx-os, mtq8400-hs2r, nvda-os_xc, onyx, tq8100-hs2f, tq8200-hs2f
CVE-2024-0115 (published 2024-08-12)
NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled resource consumption issue by a long running CV-CUDA Python process. A successful exploit of this vulnerability may lead to denial of service and data loss.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
Weakness: CWE-400
Affected vendors: canonical, nvidia
Affected products: cv-cuda, jetpack_software_development_kit, ubuntu_linux
CVE-2024-0116 (published 2024-10-01)
NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory region while it is in use. A successful exploit of this vulnerability may lead to denial of service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: linux, nvidia
Affected products: linux_kernel, triton_inference_server
CVE-2024-0117 (published 2024-10-26)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
CVE-2024-0118 (published 2024-10-26)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
CVE-2024-0119 (published 2024-10-26)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
CVE-2024-0120 (published 2024-10-26)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
CVE-2024-0121 (published 2024-10-26)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
CVE-2024-0122 (published 2024-11-23)
NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)
Weakness: CWE-862
CVE-2024-0123 (published 2024-10-03)
NVIDIA CUDA toolkit for Windows and Linux contains a vulnerability in the nvdisasm command line tool where an attacker may cause an improper validation in input issue by tricking the user into running nvdisasm on a malicious ELF file. A successful exploit of this vulnerability may lead to denial of service.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Weakness: CWE-1285
Affected vendors: linux, microsoft, nvidia
Affected products: cuda_toolkit, linux_kernel, windows
CVE-2024-0124 (published 2024-10-03)
NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can cause nvdisasm to read freed memory by running it on a malformed ELF file. A successful exploit of this vulnerability might lead to a limited denial of service.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Weakness: CWE-416
Affected vendors: linux, microsoft, nvidia
Affected products: cuda_toolkit, linux_kernel, windows
CVE-2024-0125 (published 2024-10-03)
NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can cause a NULL pointer dereference by running nvdisasm on a malformed ELF file. A successful exploit of this vulnerability might lead to a limited denial of service.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Weakness: CWE-476
Affected vendors: linux, microsoft, nvidia
Affected products: cuda_toolkit, linux_kernel, windows
CVE-2024-0126 (published 2024-10-26)
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-20
CVE-2024-0127 (published 2024-10-26)
NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for all supported hypervisors, where a user of the guest OS can cause an improper input validation by compromising the guest OS kernel. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
CVE-2024-0128 (published 2024-10-26)
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and escalation of privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-732
CVE-2024-0129 (published 2024-10-15)
NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: apple, linux, microsoft, nvidia
Affected products: linux_kernel, macos, nemo, windows
CVE-2024-0130 (published 2024-12-06)
NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
CVE-2024-0132 (published 2024-09-26)
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: linux, nvidia
Affected products: linux_kernel, nvidia_container_toolkit, nvidia_gpu_operator
CVE-2024-0133 (published 2024-09-26)
NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N)
Weakness: CWE-367
Affected vendors: linux, nvidia
Affected products: linux_kernel, nvidia_container_toolkit, nvidia_gpu_operator
CVE-2024-0134 (published 2024-11-05)
NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to data tampering.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N)
Weakness: CWE-61
Affected vendors: linux, nvidia
Affected products: linux_kernel, nvidia_container_toolkit, nvidia_gpu_operator
CVE-2024-0138 (published 2024-11-23)
NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
CVE-2024-0139 (published 2024-12-06)
NVIDIA Base Command Manager and Bright Cluster Manager for Linux contain an insecure temporary file vulnerability. A successful exploit of this vulnerability might lead to denial of service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
CVE-2024-0151 (published 2024-04-24)
Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains that implement 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4, allows an attacker to pass values to Secure state that are out of range for types smaller than 32-bits. Out of range values might lead to incorrect operations in secure state.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N)
Weakness: CWE-241
CVE-2024-0153 (published 2024-07-01)
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Valhall GPU Firmware, Arm Ltd Arm 5th Gen GPU Architecture Firmware allows a local non-privileged user to make improper GPU processing operations to access a limited amount outside of buffer bounds. If the operations are carefully prepared, then this in turn could give them access to all system memory. This issue affects Valhall GPU Firmware: from r29p0 through r46p0; Arm 5th Gen GPU Architecture Firmware: from r41p0 through r46p0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: arm
Affected products: 5th_gen_gpu_architecture_firmware, valhall_gpu_firmware
CVE-2024-0154 (published 2024-03-13)
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-788
Affected vendors: dell
Affected products: dss_8440, dss_8440_firmware, emc_xc_core_6420_system, emc_xc_core_6420_system_firmware, emc_xc_core_xc450, emc_xc_core_xc450_firmware, emc_xc_core_xc640_system, emc_xc_core_xc640_system_firmware, emc_xc_core_xc650, emc_xc_core_xc650_firmware, emc_xc_core_xc6520, emc_xc_core_xc6520_firmware, emc_xc_core_xc740xd2, emc_xc_core_xc740xd2_firmware, emc_xc_core_xc740xd_system, emc_xc_core_xc740xd_system_firmware, emc_xc_core_xc750, emc_xc_core_xc750_firmware, emc_xc_core_xc750xa, emc_xc_core_xc750xa_firmware, emc_xc_core_xc7525, emc_xc_core_xc7525_firmware, emc_xc_core_xc940_system, emc_xc_core_xc940_system_firmware, emc_xc_core_xcxr2
CVE-2024-0155 (published 2024-03-04)
Dell Digital Delivery, versions prior to 5.2.0.0, contain a Use After Free Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to application crash or execution of arbitrary code.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: dell
Affected products: digital_delivery
CVE-2024-0156 (published 2024-03-04)
Dell Digital Delivery, versions prior to 5.2.0.0, contain a Buffer Overflow Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to arbitrary code execution and/or privilege escalation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: dell
Affected products: digital_delivery
CVE-2024-0157 (published 2024-04-12)
Dell Storage Resource Manager, 4.9.0.0 and below, contain(s) a Session Fixation Vulnerability in SRM Windows Host Agent. An adjacent network unauthenticated attacker could potentially exploit this vulnerability, leading to the hijack of a targeted user's application session.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-400
Affected vendors: dell
Affected products: storage_monitoring_and_reporting, storage_resource_manager
CVE-2024-0158 (published 2024-07-02)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability to modify a UEFI variable, leading to denial of service and escalation of privileges
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: alienware_m15_r6, alienware_m15_r6_firmware, alienware_m15_r7, alienware_m15_r7_firmware, alienware_m16_r1, alienware_m16_r1_firmware, alienware_m18_r1, alienware_m18_r1_firmware, alienware_m18_r2, alienware_m18_r2_firmware, alienware_x14_r2, alienware_x14_r2_firmware, alienware_x16_r1, alienware_x16_r1_firmware, alienware_x16_r2, alienware_x16_r2_firmware, chengming_3900, chengming_3900_firmware, chengming_3910, chengming_3910_firmware, chengming_3911, chengming_3911_firmware, chengming_3990, chengming_3990_firmware, chengming_3991
CVE-2024-0159 (published 2024-04-10)
Dell Alienware Command Center, versions 5.5.52.0 and prior, contain improper access control vulnerability, leading to Denial of Service on local system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-1107
Affected vendors: dell
Affected products: alienware_command_center
CVE-2024-0160 (published 2024-06-12)
Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by bypassing BIOS authorization to modify settings in the BIOS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-863
Affected vendors: dell
Affected products: g3_3500, g3_3500_firmware, g5_5500, g5_5500_firmware, g7_7500, g7_7500_firmware, g7_7700, g7_7700_firmware, inspiron_7500, inspiron_7500_firmware, inspiron_7501, inspiron_7501_firmware, latitude_3410, latitude_3410_firmware, latitude_3420, latitude_3420_firmware, latitude_3510, latitude_3510_firmware, latitude_3520, latitude_3520_firmware, precision_5550, precision_5550_firmware, precision_5750, precision_5750_firmware, vostro_7500
CVE-2024-0161 (published 2024-03-13)
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: dss_8440, dss_8440_firmware, emc_storage_nx3240, emc_storage_nx3240_firmware, emc_storage_nx3340, emc_storage_nx3340_firmware, emc_xc_core_6420, emc_xc_core_6420_firmware, emc_xc_core_xc450, emc_xc_core_xc450_firmware, emc_xc_core_xc640, emc_xc_core_xc640_firmware, emc_xc_core_xc650, emc_xc_core_xc650_firmware, emc_xc_core_xc6520, emc_xc_core_xc6520_firmware, emc_xc_core_xc740xd, emc_xc_core_xc740xd2, emc_xc_core_xc740xd2_firmware, emc_xc_core_xc740xd_firmware, emc_xc_core_xc750, emc_xc_core_xc750_firmware, emc_xc_core_xc750xa, emc_xc_core_xc750xa_firmware, emc_xc_core_xc940
CVE-2024-0162 (published 2024-03-13)
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to out-of-bound read/writes to SMRAM.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: dell
Affected products: emc_xc_core_xc450, emc_xc_core_xc450_firmware, emc_xc_core_xc650, emc_xc_core_xc650_firmware, emc_xc_core_xc6520, emc_xc_core_xc6520_firmware, emc_xc_core_xc750, emc_xc_core_xc750_firmware, emc_xc_core_xc750xa, emc_xc_core_xc750xa_firmware, emc_xc_core_xc7525, emc_xc_core_xc7525_firmware, poweredge_c6520, poweredge_c6520_firmware, poweredge_c6525, poweredge_c6525_firmware, poweredge_c6615, poweredge_c6615_firmware, poweredge_c6620, poweredge_c6620_firmware, poweredge_hs5610, poweredge_hs5610_firmware, poweredge_hs5620, poweredge_hs5620_firmware, poweredge_mx750c
CVE-2024-0163 (published 2024-03-13)
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-367
Affected vendors: dell
Affected products: emc_xc_core_xc450, emc_xc_core_xc450_firmware, emc_xc_core_xc650, emc_xc_core_xc650_firmware, emc_xc_core_xc6520, emc_xc_core_xc6520_firmware, emc_xc_core_xc750, emc_xc_core_xc750_firmware, emc_xc_core_xc750xa, emc_xc_core_xc750xa_firmware, emc_xc_core_xc7525, emc_xc_core_xc7525_firmware, poweredge_c6520, poweredge_c6520_firmware, poweredge_c6525, poweredge_c6525_firmware, poweredge_c6615, poweredge_c6615_firmware, poweredge_c6620, poweredge_c6620_firmware, poweredge_hs5610, poweredge_hs5610_firmware, poweredge_hs5620, poweredge_hs5620_firmware, poweredge_mx750c
CVE-2024-0164 (published 2024-02-12)

Dell Unity, versions prior to 5.4, contain an OS Command Injection Vulnerability in its svc_topstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary commands with elevated privileges.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dell
Affected products: unity_operating_environment
CVE-2024-0165 (published 2024-02-12)

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_acldb_dump utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dell
Affected products: unity_operating_environment
CVE-2024-0166 (published 2024-02-12)

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_tcpdump utility. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands with elevated privileges.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dell
Affected products: unity_operating_environment
CVE-2024-0167 (published 2024-02-12)

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svc_topstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files on the file system with root privileges.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dell
Affected products: unity_operating_environment
CVE-2024-0168 (published 2024-02-12)

Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svc_oscheck utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to inject arbitrary operating system commands. This vulnerability allows an authenticated attacker to execute commands with root privileges.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dell
Affected products: unity_operating_environment
CVE-2024-0169 (published 2024-02-12)
Dell Unity, version(s) 5.3 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dell
Affected products: unity_operating_environment
CVE-2024-0170 (published 2024-02-12)

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cava utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dell
Affected products: unity_operating_environment
CVE-2024-0171 (published 2024-06-25)
Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L)
Weakness: CWE-367
Affected vendors: dell
Affected products: poweredge_c6615, poweredge_c6615_firmware, poweredge_r6615, poweredge_r6615_firmware, poweredge_r6625, poweredge_r6625_firmware, poweredge_r7615, poweredge_r7615_firmware, poweredge_r7625, poweredge_r7625_firmware, xc_core_xc7625, xc_core_xc7625_firmware
CVE-2024-0172 (published 2024-04-03)
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: dell
Affected products: dss_8440, dss_8440_firmware, emc_storage_nx3240, emc_storage_nx3240_firmware, emc_storage_nx3340, emc_storage_nx3340_firmware, emc_xc_core_6420_system, emc_xc_core_6420_system_firmware, emc_xc_core_xc450, emc_xc_core_xc450_firmware, emc_xc_core_xc640_system, emc_xc_core_xc640_system_firmware, emc_xc_core_xc650, emc_xc_core_xc650_firmware, emc_xc_core_xc6520, emc_xc_core_xc6520_firmware, emc_xc_core_xc740xd2, emc_xc_core_xc740xd2_firmware, emc_xc_core_xc740xd_system, emc_xc_core_xc740xd_system_firmware, emc_xc_core_xc750, emc_xc_core_xc750_firmware, emc_xc_core_xc750xa, emc_xc_core_xc750xa_firmware, emc_xc_core_xc7525
CVE-2024-0173 (published 2024-03-13)
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-788
Affected vendors: dell
Affected products: dss_8440, dss_8440_firmware, emc_xc_core_6420_system, emc_xc_core_6420_system_firmware, emc_xc_core_xc450, emc_xc_core_xc450_firmware, emc_xc_core_xc640_system, emc_xc_core_xc640_system_firmware, emc_xc_core_xc650, emc_xc_core_xc650_firmware, emc_xc_core_xc6520, emc_xc_core_xc6520_firmware, emc_xc_core_xc740xd2, emc_xc_core_xc740xd2_firmware, emc_xc_core_xc740xd_system, emc_xc_core_xc740xd_system_firmware, emc_xc_core_xc750, emc_xc_core_xc750_firmware, emc_xc_core_xc750xa, emc_xc_core_xc750xa_firmware, emc_xc_core_xc7525, emc_xc_core_xc7525_firmware, emc_xc_core_xc940_system, emc_xc_core_xc940_system_firmware, emc_xc_core_xcxr2
CVE-2024-0181 (published 2024-01-01)
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin_user.php of the component Admin Panel. The manipulation of the argument Firstname/Lastname/Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249433 was assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: nia
Affected products: rrj_nueva_ecija_engineer_online_portal
CVE-2024-0182 (published 2024-01-01)
A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-249440.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: janobe
Affected products: engineers_online_portal
CVE-2024-0183 (published 2024-01-01)
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/students.php of the component NIA Office. The manipulation leads to basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249441 was assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-80
Affected vendors: nia
Affected products: rrj_nueva_ecija_engineer_online_portal
CVE-2024-0184 (published 2024-01-02)
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/edit_teacher.php of the component Add Enginer. The manipulation of the argument Firstname/Lastname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249442 is the identifier assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: nia
Affected products: rrj_nueva_ecija_engineer_online_portal
CVE-2024-0185 (published 2024-01-02)
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file dasboard_teacher.php of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249443.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: nia
Affected products: rrj_nueva_ecija_engineer_online_portal
CVE-2024-0186 (published 2024-01-02)
A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249444.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-640
Affected vendors: huiran_host_reseller_system_project
Affected products: huiran_host_reseller_system
CVE-2024-0187 (published 2024-01-16)
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: peepso
Affected products: peepso
CVE-2024-0188 (published 2024-01-02)
A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_password_teacher.php. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-249501 was assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-521
Affected vendors: nia
Affected products: rrj_nueva_ecija_engineer_online_portal
CVE-2024-0189 (published 2024-01-02)
A vulnerability has been found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file teacher_message.php of the component Create Message Handler. The manipulation of the argument Content with the input </title><scRipt>alert(x)</scRipt> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249502 is the identifier assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: nia
Affected products: rrj_nueva_ecija_engineer_online_portal
CVE-2024-0190 (published 2024-01-02)
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file add_quiz.php of the component Quiz Handler. The manipulation of the argument Quiz Title/Quiz Description with the input </title><scRipt>alert(x)</scRipt> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249503.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: nia
Affected products: rrj_nueva_ecija_engineer_online_portal
CVE-2024-0191 (published 2024-01-02)
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/uploads/. The manipulation leads to file and directory information exposure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249504.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-538
Affected vendors: nia
Affected products: rrj_nueva_ecija_engineer_online_portal
CVE-2024-0192 (published 2024-01-02)
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file downloadable.php of the component Add Downloadable. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249505 was assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-434
Affected vendors: nia
Affected products: rrj_nueva_ecija_engineer_online_portal
CVE-2024-0193 (published 2024-01-02)
A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: linux, redhat
Affected products: codeready_linux_builder, codeready_linux_builder_for_eus, codeready_linux_builder_for_ibm_z_systems, codeready_linux_builder_for_ibm_z_systems_eus, codeready_linux_builder_for_power_little_endian, codeready_linux_builder_for_power_little_endian_eus, enterprise_linux, enterprise_linux_for_arm_64, enterprise_linux_for_arm_64_els, enterprise_linux_for_arm_64_eus, enterprise_linux_for_els, enterprise_linux_for_eus, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_ibm_z_systems_els, enterprise_linux_for_ibm_z_systems_eus, enterprise_linux_for_power_little_endian, enterprise_linux_for_power_little_endian_els, enterprise_linux_for_power_little_endian_eus, enterprise_linux_for_update_services_for_sap_solutions, enterprise_linux_server_aus, enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions, linux_kernel, openshift_logging
CVE-2024-0194 (published 2024-01-02)
A vulnerability, which was classified as critical, has been found in CodeAstro Internet Banking System up to 1.0. This issue affects some unknown processing of the file pages_account.php of the component Profile Picture Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249509 was assigned to this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: codeastro
Affected products: internet_banking_system
CVE-2024-0195 (published 2024-01-02)
A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: ssssssss
Affected products: spider-flow
CVE-2024-0196 (published 2024-01-02)
A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /resource/file/api/save?auto=1. The manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249511.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: ssssssss
Affected products: magic-api
CVE-2024-0197 (published 2024-02-27)
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: microsoft, thalesgroup
Affected products: sentinel_hasp_ldk, windows
CVE-2024-0199 (published 2024-03-07)
An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-863
Affected vendors: gitlab
Affected products: gitlab
CVE-2024-0200 (published 2024-01-16)
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.


Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-470
Affected vendors: github
Affected products: enterprise_server
CVE-2024-0201 (published 2024-01-03)
The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings. CVE-2023-52179 appears to be a duplicate of this issue.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-862
Affected vendors: webcodingplace
Affected products: product_expiry_for_woocommerce
CVE-2024-0202 (published 2024-02-05)
A security vulnerability has been identified in the cryptlib cryptographic library when cryptlib is compiled with the support for RSA key exchange ciphersuites in TLS (by setting the USE_RSA_SUITES define), it will be vulnerable to the timing variant of the Bleichenbacher attack. An attacker that is able to perform a large number of connections to the server will be able to decrypt RSA ciphertexts or forge signatures using server's certificate. THIS CVE ID IS CURRENTLY DISPUTED - MAINTAINER NOTE: There are only two situations where it's enabled, one is for fuzz-testing to exercise code paths that wouldn't otherwise be available, the other is for static source code analysis with tools like Coverity and Prefast, again to open up code paths that otherwise wouldn't be available.  It can also be enabled manually in two specific test builds just to make sure the code still compiles OK, to avoid bit rot and verify that the fuzz-testing build will compile without errors.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-208
Affected vendors: cryptlib
Affected products: cryptlib
CVE-2024-0203 (published 2024-03-07)
The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing nonce validation in the 'digits_save_settings' function. This makes it possible for unauthenticated attackers to modify the default role of registered users to elevate user privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: unitedover
Affected products: digits
CVE-2024-0204 (published 2024-01-22)
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-425
Affected vendors: fortra
Affected products: goanywhere_managed_file_transfer
CVE-2024-0206 (published 2024-01-09)

A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. This was achieved by adding an entry to the registry under the Trellix ENS registry folder with a symbolic link to files that the user wouldn't normally have permission to. After a scan, the Engine would follow the links and remove the files


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-59
Affected vendors: microsoft, trellix
Affected products: anti-malware_engine, windows
CVE-2024-0207 (published 2024-01-03)
HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: wireshark
Affected products: wireshark
CVE-2024-0208 (published 2024-01-03)
GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-230
Affected vendors: wireshark
Affected products: wireshark