deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-40535
Published: 2024-07-16
Description: Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a stack overflow via the apn_name_3g parameter in the config_3g_para function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://github.com/tt01bolt/vul/blob/main/LBT-T300-T400_Buffer%20overflow.md; https://github.com/tt01bolt/vul/blob/main/LBT-T300-T400_Buffer%20overflow.md
CVE: CVE-2024-40536
Published: 2024-07-16
Description: Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 were discovered to contain a stack overflow via the pin_3g_code parameter in the config_3g_para function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/tt01bolt/vul/blob/main/LBT-T300-T400_Buffer%20overflow.md; https://github.com/tt01bolt/vul/blob/main/LBT-T300-T400_Buffer%20overflow.md
CVE: CVE-2020-25836
Published: 2024-07-16
Description: Exposure of Sensitive Information
to an Unauthorized Access vulnerability in OpenText NetIQ Directory and
Resource Administrator. This issue affects NetIQ Directory and Resource
Administrator versions prior to 10.0.2 and prior to 9.2.1 Patch 10.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-200
References: https://www.netiq.com/documentation/directory-and-resource-administrator-10/releasenotes_10.0.2/data/releasenotes_10.0.2.html#b149h4pv; https://www.netiq.com/documentation/directory-and-resource-administrator-10/releasenotes_10.0.2/data/releasenotes_10.0.2.html#b149h4pv
CVE: CVE-2024-5566
Published: 2024-07-16
Description: An improper privilege management vulnerability allowed users to migrate private repositories without having appropriate scopes defined on the related Personal Access Token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-269
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.10; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6
CVE: CVE-2024-5795
Published: 2024-07-16
Description: A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large payload to the Git server. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 7.7 (HIGH)
CWE: CWE-400, CWE-400
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6
CVE: CVE-2024-5815
Published: 2024-07-16
Description: A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request types. A mitigating factor is that the attacker would have to be a trusted GitHub Enterprise Server user, and the victim would have to visit a tag in the attacker's fork of their own repository. vulnerability affected all versions of GitHub Enterprise Server prior 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17.


 This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.9.17; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.10.14; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.11.12
CVE: CVE-2024-5816
Published: 2024-07-16
Description: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a suspended GitHub App to retain access to the repository via a scoped user access token. This was only exploitable in public repositories while private repositories were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.9.17, 3.10.14, 3.11.12, 3.12.6, 3.13.1. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15; https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.9.17; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12
CVE: CVE-2024-5817
Published: 2024-07-16
Description: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was only exploitable in internal repositories and required the attacker to have access to the corresponding project board. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6
CVE: CVE-2024-6336
Published: 2024-07-16
Description: A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6
CVE: CVE-2024-6395
Published: 2024-07-16
Description: An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6; https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1
CVE: CVE-2024-6772
Published: 2024-07-16
Description: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-358
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/346597059; https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html
CVE: CVE-2024-6773
Published: 2024-07-16
Description: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/347724915; https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html
CVE: CVE-2024-6774
Published: 2024-07-16
Description: Use after free in Screen Capture in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/346898524; https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html
CVE: CVE-2024-6775
Published: 2024-07-16
Description: Use after free in Media Stream in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/347373236; https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html
CVE: CVE-2024-6776
Published: 2024-07-16
Description: Use after free in Audio in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/346692546; https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html
CVE: CVE-2024-6777
Published: 2024-07-16
Description: Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/345640549; https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html
CVE: CVE-2024-6778
Published: 2024-07-16
Description: Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-366
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/341136300; https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html
CVE: CVE-2024-6779
Published: 2024-07-16
Description: Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787, CWE-125
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/351327767; https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html
CVE: CVE-2019-25154
Published: 2024-07-16
Description: Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 9.6 (CRITICAL)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/40094752; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2020-36765
Published: 2024-07-16
Description: Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html; https://issues.chromium.org/issues/40091076; https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html
CVE: CVE-2022-35640
Published: 2024-07-16
Description: IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned. IBM X-Force ID: 230933.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230933; https://www.ibm.com/support/pages/node/7160300; https://exchange.xforce.ibmcloud.com/vulnerabilities/230933
CVE: CVE-2023-4860
Published: 2024-07-16
Description: Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-303
References: https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/40064341; https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html
CVE: CVE-2023-7010
Published: 2024-07-16
Description: Use after free in WebRTC in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/40070891; https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
CVE: CVE-2023-7011
Published: 2024-07-16
Description: Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html; https://issues.chromium.org/issues/40066780; https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html
CVE: CVE-2023-7012
Published: 2024-07-16
Description: Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20, CWE-138
References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/40061509; https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
CVE: CVE-2023-7013
Published: 2024-07-16
Description: Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html; https://issues.chromium.org/issues/40071326; https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html
CVE: CVE-2024-20996
Published: 2024-07-16
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.37 and prior and  8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpujul2024.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpujul2024.html
CVE: CVE-2024-21122
Published: 2024-07-16
Description: Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Text Catalog).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Shared Components.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Shared Components, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Shared Components accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise HCM Shared Components accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-276
References: https://www.oracle.com/security-alerts/cpujul2024.html; https://www.oracle.com/security-alerts/cpujul2024.html
CVE: CVE-2024-21123
Published: 2024-07-16
Description: Vulnerability in the Oracle Database Core component of Oracle Database Server.  Supported versions that are affected are 19.3-19.23. Easily exploitable vulnerability allows high privileged attacker having SYSDBA privilege with logon to the infrastructure where Oracle Database Core executes to compromise Oracle Database Core.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Database Core accessible data. CVSS 3.1 Base Score 2.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).
CVSS Score: 2.3 (LOW)
CWE: CWE-276
References: https://www.oracle.com/security-alerts/cpujul2024.html; https://www.oracle.com/security-alerts/cpujul2024.html
CVE: CVE-2024-21125
Published: 2024-07-16
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS).  Supported versions that are affected are 8.0.37 and prior and  8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2024.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpujul2024.html
CVE: CVE-2024-21126
Published: 2024-07-16
Description: Vulnerability in the Oracle Database Portable Clusterware component of Oracle Database Server.  Supported versions that are affected are 19.3-19.23 and  21.3-21.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Database Portable Clusterware.  While the vulnerability is in Oracle Database Portable Clusterware, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Portable Clusterware. CVSS 3.1 Base Score 5.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L).
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpujul2024.html; https://www.oracle.com/security-alerts/cpujul2024.html
CVE: CVE-2024-21127
Published: 2024-07-16
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.37 and prior and  8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpujul2024.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpujul2024.html
CVE: CVE-2024-21128
Published: 2024-07-16
Description: Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: APIs).  Supported versions that are affected are 12.2.6-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Object Library, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as  unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2024.html; https://www.oracle.com/security-alerts/cpujul2024.html
CVE: CVE-2024-21129
Published: 2024-07-16
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.37 and prior and  8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2024.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpujul2024.html
CVE: CVE-2024-21130
Published: 2024-07-16
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.37 and prior and  8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpujul2024.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpujul2024.html