deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-41913
Published: 2024-08-06
Description: A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices.  The firmware flaw does not properly sanitize User input.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://support.hp.com/us-en/document/ish_1[PII_REDACTED]6512-16/hpsbpy03957
CVE: CVE-2024-36424
Published: 2024-08-06
Description: K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-5th-aug-2024-417; https://www.k7computing.com/
CVE: CVE-2024-7552
Published: 2024-08-06
Description: A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression of the file ConversionSqlParamValueMapper.java of the component Data Schema Page. The manipulation leads to improper neutralization of special elements used in an expression language statement. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273697 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-917
References: https://gitee.com/datagear/datagear/issues/IAF3H7; https://vuldb.com/?ctiid.273697; https://vuldb.com/?id.273697
CVE: CVE-2023-28806
Published: 2024-08-06
Description: An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=windows&applicable_version=4.2.0.190
CVE: CVE-2024-23456
Published: 2024-08-06
Description: Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347, CWE-347
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=windows&applicable_version=4.2.0.190
CVE: CVE-2024-23458
Published: 2024-08-06
Description: While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.
CVSS Score: 7.3 (HIGH)
CWE: CWE-346, CWE-346
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=windows&applicable_version=4.2.0.190
CVE: CVE-2024-23460
Published: 2024-08-06
Description: The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macos&applicable_version=4.2
CVE: CVE-2024-23464
Published: 2024-08-06
Description: In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1
CVSS Score: 7.2 (HIGH)
CWE: CWE-281
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Windows&applicable_version=4.2.1
CVE: CVE-2024-23483
Published: 2024-08-06
Description: An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS <4.2.
CVSS Score: 7.0 (HIGH)
CWE: CWE-20, CWE-78
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macos&applicable_version=4.2
CVE: CVE-2024-39225
Published: 2024-08-06
Description: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypass%20the%20login%20mechanism.md
CVE: CVE-2024-39226
Published: 2024-08-06
Description: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-77
References: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/s2s%20interface%20shell%20injection.md
CVE: CVE-2024-39228
Published: 2024-08-06
Description: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Ovpn%20interface%20shell%20injection.md
CVE: CVE-2024-39751
Published: 2024-08-06
Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  297429
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/297429; https://www.ibm.com/support/pages/node/7160580
CVE: CVE-2024-41333
Published: 2024-08-06
Description: A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the uname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/179891/Tourism-Management-System-2.0-Cross-Site-Scripting.html; https://www.linkedin.com/in/sampath-kumar-kadajari-4b18891a7
CVE: CVE-2024-41616
Published: 2024-08-06
Description: D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-259
References: https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DIR300/CVE-2024-41616; https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DIR300/D-Link300.md
CVE: CVE-2024-43111
Published: 2024-08-06
Description: Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1874907; https://www.mozilla.org/security/advisories/mfsa2024-36/
CVE: CVE-2024-43112
Published: 2024-08-06
Description: Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1874910; https://www.mozilla.org/security/advisories/mfsa2024-36/
CVE: CVE-2024-43113
Published: 2024-08-06
Description: The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1874964; https://www.mozilla.org/security/advisories/mfsa2024-36/
CVE: CVE-2024-6720
Published: 2024-08-06
Description: The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/d1449be1-ae85-46f4-b5ba-390d25b87723/
CVE: CVE-2024-6988
Published: 2024-08-06
Description: Use after free in Downloads in Google Chrome on iOS prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/349198731
CVE: CVE-2024-6989
Published: 2024-08-06
Description: Use after free in Loader in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/349342289
CVE: CVE-2024-6991
Published: 2024-08-06
Description: Use after free in Dawn in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/346618785
CVE: CVE-2024-6994
Published: 2024-08-06
Description: Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787, CWE-122
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/339686368
CVE: CVE-2024-6995
Published: 2024-08-06
Description: Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-358
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/343938078
CVE: CVE-2024-6996
Published: 2024-08-06
Description: Race in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 3.1 (LOW)
CWE: CWE-362, CWE-362, CWE-362
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/333708039
CVE: CVE-2024-6997
Published: 2024-08-06
Description: Use after free in Tabs in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/325293263
CVE: CVE-2024-6998
Published: 2024-08-06
Description: Use after free in User Education in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/340098902
CVE: CVE-2024-6999
Published: 2024-08-06
Description: Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/340893685
CVE: CVE-2024-7000
Published: 2024-08-06
Description: Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/339877158
CVE: CVE-2024-7001
Published: 2024-08-06
Description: Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-474
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/347509736
CVE: CVE-2024-7003
Published: 2024-08-06
Description: Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-358
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/338233148
CVE: CVE-2024-7004
Published: 2024-08-06
Description: Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-863
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/40063014
CVE: CVE-2024-7005
Published: 2024-08-06
Description: Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-807
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/40068800
CVE: CVE-2024-7564
Published: 2024-08-06
Description: Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability.

The specific flaw exists within the get_response_json_result endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-24680.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1021/
CVE: CVE-2024-39227
Published: 2024-08-06
Description: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-75
References: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Access%20to%20the%20C%20library%20without%20logging%20in.md
CVE: CVE-2024-39229
Published: 2024-08-06
Description: An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-924
References: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/DDNS%20data%20is%20not%20encrypted.md
CVE: CVE-2024-42358
Published: 2024-08-06
Description: PDFio is a simple C library for reading and writing PDF files. There is a denial of service (DOS) vulnerability in the TTF parser. Maliciously crafted TTF files can cause the program to utilize 100% of the Memory and enter an infinite loop. This can also lead to a heap-buffer-overflow vulnerability. An infinite loop occurs in the read_camp function by nGroups value. The ttf.h library is vulnerable. A value called nGroups is extracted from the file, and by changing that value, you can cause the program to utilize 100% of the Memory and enter an infinite loop. If the value of nGroups in the file is small, an infinite loop will not occur. This library, whether used as a standalone binary or as part of another application, is vulnerable to DOS attacks when parsing certain types of files. Automated systems, including web servers that use this code to convert PDF submissions into plaintext, can be DOSed if an attacker uploads a malicious TTF file. This issue has been addressed in release version 1.3.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://github.com/michaelrsweet/pdfio/commit/e4e1c[PII_REDACTED]6b0ab9f9ac14b20a8bad4f935; https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-4hh9-j68x-8353
CVE: CVE-2024-7502
Published: 2024-08-06
Description: A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-219-01
CVE: CVE-2024-41677
Published: 2024-08-06
Description: Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes causes the situation that the final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). This has been resolved in qwik version 1.6.0 and @builder.io/qwik version 1.7.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.ts#L1182-L1208; https://github.com/QwikDev/qwik/commit/7e742eb3a1001542d795776c0317d47df8b9d64e; https://github.com/QwikDev/qwik/security/advisories/GHSA-2rwj-7xq8-4gx4
CVE: CVE-2024-42347
Published: 2024-08-06
Description: matrix-react-sdk  is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server. This was patched in matrix-react-sdk 3.105.0. Deployments that trust their homeservers, as well as closed federations of trusted servers, are not affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-359
References: https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.105.1; https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4
CVE: CVE-2024-28739
Published: 2024-08-06
Description: An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-79
References: https://febin0x4e4a.wordpress.com/2024/03/07/xss-to-one-click-rce-in-koha-ils/
CVE: CVE-2024-28740
Published: 2024-08-06
Description: Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://febin0x4e4a.wordpress.com/2023/01/11/xss-vulnerability-in-koha-integrated-library-system/; https://febin0x4e4a.wordpress.com/2024/03/07/xss-to-one-click-rce-in-koha-ils/
CVE: CVE-2024-42393
Published: 2024-08-06
Description: There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-94
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE: CVE-2024-42394
Published: 2024-08-06
Description: There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-200
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE: CVE-2024-42395
Published: 2024-08-06
Description: There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-295
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE: CVE-2024-42396
Published: 2024-08-06
Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVSS Score: 5.3 (MEDIUM)
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE: CVE-2024-42397
Published: 2024-08-06
Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US