deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-54662
Published: 2024-12-17
Description: Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://www.inet.no/dante/; https://www.inet.no/dante/advisory-2024-12-16.txt
CVE: CVE-2024-55496
Published: 2024-12-17
Description: A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project 1.0. This issue affects some unknown functionality of add_company.php. Actions on the delete parameter result in SQL injection.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://1000projects.org/bookstore-management-system-php-mysql-project.html; https://github.com/wpc1122/CVE/issues/1; https://github.com/wpc1122/CVE/issues/1
CVE: CVE-2024-51479
Published: 2024-12-17
Description: Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285, CWE-863
References: https://github.com/vercel/next.js/releases/tag/v14.2.15; https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f
CVE: CVE-2024-56139
Published: 2024-12-17
Description: pdftools is a high level tools to convert PDF files to ePUB formats. In versions up to and including 0.5.0 maliciously crafted epub files can cause a stack overflow leading to a crash. This issue has not yet been addressed and users are advised to avoid untrusted input to their systems.
CWE: CWE-121
References: https://github.com/leonhad/pdftools/security/advisories/GHSA-hgvf-4pf3-fwc9; https://github.com/leonhad/pdftools/security/advisories/GHSA-hgvf-4pf3-fwc9
CVE: CVE-2024-49194
Published: 2024-12-17
Description: Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://kb.databricks.com/en_US/data-sources/security-bulletin-databricks-jdbc-driver-vulnerability-advisory-cve-2024-49194
CVE: CVE-2024-55513
Published: 2024-12-17
Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_netaction.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://gist.github.com/wscg928/cbe88078751abad2ada2334eb12a5060
CVE: CVE-2024-55514
Published: 2024-12-17
Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_sfmig.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://gist.github.com/wscg928/cbe88078751abad2ada2334eb12a5060
CVE: CVE-2024-55515
Published: 2024-12-17
Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_ipslib.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://gist.github.com/wscg928/cbe88078751abad2ada2334eb12a5060
CVE: CVE-2024-55516
Published: 2024-12-17
Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90. The component affected by this issue is /upload_sysconfig.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://gist.github.com/wscg928/cbe88078751abad2ada2334eb12a5060
CVE: CVE-2024-11993
Published: 2024-12-17
Description: Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993
CVE: CVE-2024-12539
Published: 2024-12-17
Description: An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://discuss.elastic.co/t/elasticsearch-8-16-2-8-17-0-security-update/372091
CVE: CVE-2024-55056
Published: 2024-12-17
Description: A stored cross-site scripting (XSS) vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-form.php via the full name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55056; https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55056
CVE: CVE-2024-55057
Published: 2024-12-17
Description: Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-916
References: https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55057
CVE: CVE-2024-55058
Published: 2024-12-17
Description: An insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerability resides in the viewid parameter of /user/view-application-detail.php. Authenticated users can exploit this flaw by manipulating the viewid parameter in the URL to access sensitive birth certificate details of other users without proper authorization checks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-706
References: https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55058
CVE: CVE-2024-55059
Published: 2024-12-17
Description: A stored HTML Injection vulnerability was identified in PHPGurukul Online Birth Certificate System v1.0 in /user/certificate-form.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55059
CVE: CVE-2023-37940
Published: 2024-12-17
Description: Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940
CVE: CVE-2024-29646
Published: 2024-12-17
Description: Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://gist.github.com/Crispy-fried-chicken/0be4a204e7226fa2cea761c09f027690; https://github.com/radareorg/radare2/pull/22562; https://github.com/radareorg/radare2/pull/22567
CVE: CVE-2024-31668
Published: 2024-12-17
Description: rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://gist.github.com/Crispy-fried-chicken/cb0b3a653a43a2fe2361641eddd8330d; https://github.com/rizinorg/rizin/commit/c025dcee40c8eac2ab559f2caa3798a2dbf019e4
CVE: CVE-2024-51175
Published: 2024-12-17
Description: An issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://github.com/a1drewlong/h3c-S1526/blob/main/Vulnerability%20Cases.md
CVE: CVE-2024-52792
Published: 2024-12-17
Description: LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM does not properly sanitize configuration values, that are set via `mainmanage.php` and `confmain.php`. This allows setting arbitrary config values and thus effectively bypassing `mitigation` of CVE-2024-23333/GHSA-fm9w-7m7v-wxqv. Configuration values for the main config or server profiles are set via `mainmanage.php` and `confmain.php`.
The values are written to `config.cfg` or `serverprofile.conf` in the format of `settingsName: settingsValue` line-by-line.
An attacker can smuggle arbitrary config values in a config file, by inserting a newline into certain config fields, followed by the value. This vulnerability has been addressed in version 9.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-610
References: https://github.com/LDAPAccountManager/lam/blob/fd665fef3b222bf8205154b14f676815d2d6ae20/lam/templates/config/mainmanage.php#L263; https://github.com/LDAPAccountManager/lam/releases/tag/9.0; https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-6cp9-j5r7-xhcc
CVE: CVE-2024-56142
Published: 2024-12-17
Description: pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. A vulnerability has been discovered that could allow an attacker to acquire disk access with privileges equivalent to those of pghoard, allowing for unintended path traversal. Depending on the permissions/privileges assigned to pghoard, this could allow disclosure of sensitive information. This issue has been addressed in releases after 2.2.2a. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Aiven-Open/pghoard/security/advisories/GHSA-m9hc-vxjj-4x6q
CVE: CVE-2024-10973
Published: 2024-12-17
Description: A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-319
References: https://access.redhat.com/security/cve/CVE-2024-10973; https://bugzilla.redhat.com/show_bug.cgi?id=2324361
CVE: CVE-2024-9779
Published: 2024-12-17
Description: A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named "cluster-manager", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster.
CVSS Score: 7.5 (HIGH)
CWE: CWE-266
References: https://access.redhat.com/security/cve/CVE-2024-9779; https://bugzilla.redhat.com/show_bug.cgi?id=2317916; https://github.com/open-cluster-management-io/ocm/pull/325
CVE: CVE-2024-11439
Published: 2024-12-18
Description: The ScanCircle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'scancircle' shortcode in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/scancircle/trunk/scancircle.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202428%40scancircle&new=3202428%40scancircle&sfp_email=&sfph_mail=; https://wordpress.org/plugins/scancircle/
CVE: CVE-2024-11748
Published: 2024-12-18
Description: The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and including, 0.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/taeggie-feed/trunk/taeggie_feed.php#L40; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207857%40taeggie-feed&new=3207857%40taeggie-feed&sfp_email=&sfph_mail=; https://wordpress.org/plugins/taeggie-feed/
CVE: CVE-2024-11881
Published: 2024-12-18
Description: The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easywaveformplayer' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/easy-waveform-player/trunk/includes/class-easywaveformplayer.php#L263; https://plugins.trac.wordpress.org/changeset/3208124/easy-waveform-player/trunk/includes/class-easywaveformplayer.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/17a0d8b3-e54d-4af4-8915-e8b192cc138b?source=cve
CVE: CVE-2024-12500
Published: 2024-12-18
Description: The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L107; https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L140; https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L167
CVE: CVE-2024-12513
Published: 2024-12-18
Description: The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RF_CONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208765%40contests-from-rewards-fuel&new=3208765%40contests-from-rewards-fuel&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c89934b1-5e3c-4bf2-8d36-17c4268ccd4e?source=cve
CVE: CVE-2024-47480
Published: 2024-12-18
Description: Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with local access may exploit this vulnerability, potentially resulting in Elevation of Privileges and unauthorized file system access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-61, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000255700/dsa-2024-475
CVE: CVE-2024-11254
Published: 2024-12-18
Description: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter in all versions up to, and including, 1.1.1 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.93/includes/disqus.html?rev=3024147#L34; https://www.wordfence.com/threat-intel/vulnerabilities/id/5da82149-c827-4574-8269-b2b798edca59?source=cve
CVE: CVE-2024-12025
Published: 2024-12-18
Description: The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201979%40collapsing-categories&new=3201979%40collapsing-categories&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/05153b11-2f26-425e-99ab[PII_REDACTED]2b?source=cve
CVE: CVE-2024-12061
Published: 2024-12-18
Description: The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naevents_elementor_template shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208546%40events-addon-for-elementor&new=3208546%40events-addon-for-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f59d9d8a-467a-4920-963a-da45f1f4462f?source=cve
CVE: CVE-2024-12250
Published: 2024-12-18
Description: The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configuration data which can be used to aid in other attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208517%40accept-authorize-net-payments-using-contact-form-7&new=3208517%40accept-authorize-net-payments-using-contact-form-7&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d8801b9a-afcb-483b-a018-4f68448e96de?source=cve
CVE: CVE-2024-12259
Published: 2024-12-18
Description: The CRM WordPress Plugin – RepairBuddy plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.8120. This is due to the plugin not properly validating a user's identity prior to updating their email through the wc_update_user_data AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204501%40computer-repair-shop&new=3204501%40computer-repair-shop&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206568%40computer-repair-shop&new=3206568%40computer-repair-shop&sfp_email=&sfph_mail=#file548; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208270%40computer-repair-shop&new=3208270%40computer-repair-shop&sfp_email=&sfph_mail=
CVE: CVE-2024-12432
Published: 2024-12-18
Description: The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generate_key' function not producing a sufficiently random value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as site administrators, granted they have triggered the ajax_login() function which generates a unique key that can be used to log in.
CVSS Score: 8.1 (HIGH)
CWE: CWE-330
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208130%40wpc-shop-as-customer&new=3208130%40wpc-shop-as-customer&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/048625e8-10b7-418d-a13b-329f1d7e0171?source=cve
CVE: CVE-2024-12449
Published: 2024-12-18
Description: The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_player_html' shortcode in all versions up to, and including, 2.6.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3208668/video-share-vod/trunk/video-share-vod.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b857e64c-a345-4ed3-b690-5b9d1a0cae15?source=cve
CVE: CVE-2024-12596
Published: 2024-12-18
Description: The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3208662/lifterlms/trunk/includes/abstracts/llms-abstract-controller-user-engagements.php; https://plugins.trac.wordpress.org/changeset/3208662/lifterlms/trunk/includes/controllers/class.llms.controller.certificates.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e75a03b-7552-4228-a4d0-13c78d20f6d5?source=cve
CVE: CVE-2024-12698
Published: 2024-12-18
Description: An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were protected, not streams created by authenticated sources.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2024:6122; https://access.redhat.com/security/cve/CVE-2024-12698; https://bugzilla.redhat.com/show_bug.cgi?id=2332674