deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4650
Published: 2024-05-08
Description: A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. This vulnerability affects unknown code of the file /view/student_due_payment.php. The manipulation of the argument due_month leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263494 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2019.pdf; https://vuldb.com/?ctiid.263494; https://vuldb.com/?id.263494
CVE: CVE-2024-4651
Published: 2024-05-08
Description: A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. This issue affects some unknown processing of the file /view/student_attendance_history1.php. The manipulation of the argument year leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263495.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2020.pdf; https://vuldb.com/?ctiid.263495; https://vuldb.com/?id.263495
CVE: CVE-2024-4652
Published: 2024-05-08
Description: A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file /view/show_teacher2.php. The manipulation of the argument month leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263496.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2021.pdf; https://vuldb.com/?ctiid.263496; https://vuldb.com/?id.263496
CVE: CVE-2024-21793
Published: 2024-05-08
Description: An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://my.f5.com/manage/s/article/K000138732; https://my.f5.com/manage/s/article/K000138732
CVE: CVE-2024-25515
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_work_finish_file_down.aspx.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_work_finish_file_downaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_work_finish_file_downaspx
CVE: CVE-2024-25517
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#mfaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#mfaspx
CVE: CVE-2024-25518
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_fields_approve.aspx.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_get_fields_approveaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_get_fields_approveaspx
CVE: CVE-2024-25519
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_print.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_work_printaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_work_printaspx
CVE: CVE-2024-25520
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#sys_blogtemplate_newaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#sys_blogtemplate_newaspx
CVE: CVE-2024-25521
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#get_companyaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#get_companyaspx
CVE: CVE-2024-25522
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_work_form_save.aspx.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_work_form_saveaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_work_form_saveaspx
CVE: CVE-2024-25523
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_memo.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#file_memoaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#file_memoaspx
CVE: CVE-2024-25524
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPlanAttachDownLoad.aspx.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#workplanattachdownloadaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#workplanattachdownloadaspx
CVE: CVE-2024-25525
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#officefiledownloadaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#officefiledownloadaspx
CVE: CVE-2024-25526
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/pm_gatt_inc.aspx.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#pm_gatt_incaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#pm_gatt_incaspx
CVE: CVE-2024-25560
Published: 2024-05-08
Description: 
When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://my.f5.com/manage/s/article/K000139037; https://my.f5.com/manage/s/article/K000139037
CVE: CVE-2024-26026
Published: 2024-05-08
Description: An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://my.f5.com/manage/s/article/K000138733; https://my.f5.com/manage/s/article/K000138733
CVE: CVE-2024-26579
Published: 2024-05-08
Description: Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, 

 the attackers can bypass using malicious parameters.

Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it.

[1]  https://github.com/apache/inlong/pull/9694 

[2]  https://github.com/apache/inlong/pull/9707
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2024/05/09/2; https://github.com/advisories/GHSA-fgh3-pwmp-3qw3; https://lists.apache.org/thread/d2hndtvh6bll4pkl91o2oqxyynhr54k3
CVE: CVE-2024-27202
Published: 2024-05-08
Description: 
A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://my.f5.com/manage/s/article/K000138520; https://my.f5.com/manage/s/article/K000138520
CVE: CVE-2024-28132
Published: 2024-05-08
Description: 
Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.




CVSS Score: 4.4 (MEDIUM)
CWE: CWE-922
References: https://my.f5.com/manage/s/article/K000138913; https://my.f5.com/manage/s/article/K000138913
CVE: CVE-2024-28883
Published: 2024-05-08
Description: An origin validation vulnerability exists in 

BIG-IP APM browser network access VPN client 



 for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.4 (HIGH)
CWE: CWE-346
References: https://my.f5.com/manage/s/article/K000138744; https://my.f5.com/manage/s/article/K000138744
CVE: CVE-2024-28889
Published: 2024-05-08
Description: 


When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-825
References: https://my.f5.com/manage/s/article/K000138912; https://my.f5.com/manage/s/article/K000138912
CVE: CVE-2024-31156
Published: 2024-05-08
Description: 
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.



CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://my.f5.com/manage/s/article/K000138636; https://my.f5.com/manage/s/article/K000138636
CVE: CVE-2024-32049
Published: 2024-05-08
Description: BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score: 7.4 (HIGH)
CWE: CWE-300
References: https://my.f5.com/manage/s/article/K000138634; https://my.f5.com/manage/s/article/K000138634
CVE: CVE-2024-32113
Published: 2024-05-08
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2024/05/09/1; https://issues.apache.org/jira/browse/OFBIZ-13006; https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd
CVE: CVE-2024-32761
Published: 2024-05-08
Description: Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://my.f5.com/manage/s/article/K000139217; https://my.f5.com/manage/s/article/K000139217
CVE: CVE-2024-32980
Published: 2024-05-08
Description: Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-610
References: https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354; https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh; https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354
CVE: CVE-2024-33604
Published: 2024-05-08
Description: 
A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://my.f5.com/manage/s/article/K000138894; https://my.f5.com/manage/s/article/K000138894
CVE: CVE-2024-33608
Published: 2024-05-08
Description: When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-824
References: https://my.f5.com/manage/s/article/K000138728; https://my.f5.com/manage/s/article/K000138728
CVE: CVE-2024-33612
Published: 2024-05-08
Description: An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://my.f5.com/manage/s/article/K000139012; https://my.f5.com/manage/s/article/K000139012
CVE: CVE-2024-34347
Published: 2024-05-08
Description: @hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript code. This is because code inside the vm context can break out if it can get a hold of any reference to an object created outside of the vm. In the case of @hoppscotch/js-sandbox, multiple references to external objects are passed into the vm context to allow pre-request scripts interactions with environment variables and more. But this also allows the pre-request script to escape the sandbox. This vulnerability is fixed in 0.8.0.
CVSS Score: 8.3 (HIGH)
CWE: CWE-77
References: https://github.com/hoppscotch/hoppscotch/commit/22c6eabd133195d22874250a5ae40cb26b851b01; https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qmmm-73r2-f8xr; https://www.sonarsource.com/blog/scripting-outside-the-box-api-client-security-risks-part-2
CVE: CVE-2024-3951
Published: 2024-05-08
Description: 
PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.


CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-01
CVE: CVE-2024-4653
Published: 2024-05-08
Description: A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical. Affected by this issue is some unknown functionality of the file /xds/outIndex.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263498 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Hefei-Coffee/cve/blob/main/sql.md; https://vuldb.com/?ctiid.263498; https://vuldb.com/?id.263498
CVE: CVE-2024-4654
Published: 2024-05-08
Description: A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/cloudInterface.php. The manipulation of the argument INSTI_CODE leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263499.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Hefei-Coffee/cve/blob/main/sql2.md; https://vuldb.com/?ctiid.263499; https://vuldb.com/?id.263499
CVE: CVE-2024-22460
Published: 2024-05-08
Description: Dell PowerProtect DM5500 version 5.15.0.0 and prior contains an insecure deserialization Vulnerability. A remote attacker with high privileges could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.
CVSS Score: 2.2 (LOW)
CWE: CWE-502
References: https://www.dell.com/support/kbdoc/en-us/000224843/dsa-2024-083-security-update-for-dell-powerprotect-data-manager-appliance-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000224843/dsa-2024-083-security-update-for-dell-powerprotect-data-manager-appliance-for-multiple-vulnerabilities
CVE: CVE-2024-24787
Published: 2024-05-08
Description: On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
CVSS Score: 6.4 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/05/08/3; https://go.dev/cl/583815; https://go.dev/issue/67119
CVE: CVE-2024-24788
Published: 2024-05-08
Description: A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2024/05/08/3; https://go.dev/cl/578375; https://go.dev/issue/66754
CVE: CVE-2024-24908
Published: 2024-05-08
Description: Dell PowerProtect DM5500 version 5.15.0.0 and prior contain an Arbitrary File Delete via Path Traversal vulnerability. A remote attacker with high privileges could potentially exploit this vulnerability to deletion of arbitrary files stored on the server filesystem.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000224843/dsa-2024-083-security-update-for-dell-powerprotect-data-manager-appliance-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000224843/dsa-2024-083-security-update-for-dell-powerprotect-data-manager-appliance-for-multiple-vulnerabilities
CVE: CVE-2024-25527
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#worklog_template_showaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#worklog_template_showaspx
CVE: CVE-2024-25529
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_history_show.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_office_file_history_showaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_office_file_history_showaspx
CVE: CVE-2024-25530
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condiction.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#get_find_condictionaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#get_find_condictionaspx
CVE: CVE-2024-25531
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#searchcondictionaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#searchcondictionaspx
CVE: CVE-2024-28971
Published: 2024-05-08
Description: Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS Score: 3.5 (LOW)
CWE: CWE-256, CWE-522
References: https://www.dell.com/support/kbdoc/en-us/000224849/dsa-2024-209-security-update-for-dell-update-manager-plugin-vulnerability; https://www.dell.com/support/kbdoc/en-us/000224849/dsa-2024-209-security-update-for-dell-update-manager-plugin-vulnerability
CVE: CVE-2024-31961
Published: 2024-05-08
Description: A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands via the level2 parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://bugs.sonic-technology.com/cve-2024-31961.html; https://bugs.sonic-technology.com/cve-2024-31961.html
CVE: CVE-2024-25528
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_work_stat_settingaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#wf_work_stat_settingaspx
CVE: CVE-2024-25532
Published: 2024-05-08
Description: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#get_dictaspx; https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#get_dictaspx