deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-46970
Published: 2024-09-16
Description: In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible
CVSS Score: 3.3 (LOW)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-22399
Published: 2024-09-16
Description: Deserialization of Untrusted Data vulnerability in Apache Seata. 

When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol.

This issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0.

Users are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/91nzzlxyj4nmks85gbzwkkjtbmnmlkc4; http://www.openwall.com/lists/oss-security/2024/09/11/2
CVE: CVE-2024-46424
Published: 2024-09-16
Description: TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the UploadCustomModule function, which allows attackers to cause a Denial of Service (DoS) via the File parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/UploadCustomModule.md
CVE: CVE-2024-46451
Published: 2024-09-16
Description: TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/offshore0315/loT-vulnerable/blob/main/TOTOLINK/AC1200%20T8/setWiFiAclRules.md
CVE: CVE-2024-46937
Published: 2024-09-16
Description: An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the serial parameter by number identifier: GA00001, GA00002, GA00003, etc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/WI1D-41/IDOR-in-MFASOFT-Secure-Authentication-Server; https://mfasoft.ru
CVE: CVE-2024-46419
Published: 2024-09-16
Description: TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWizardCfg function via the ssid5g parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/setWizardCfg.md
CVE: CVE-2024-38315
Published: 2024-09-16
Description: IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/294742; https://www.ibm.com/support/pages/node/7168379
CVE: CVE-2024-39772
Published: 2024-09-16
Description: Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.
CVSS Score: 3.7 (LOW)
CWE: CWE-284
References: https://mattermost.com/security-updates
CVE: CVE-2024-45835
Published: 2024-09-16
Description: Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.
CVSS Score: 2.5 (LOW)
CWE: CWE-693
References: https://mattermost.com/security-updates
CVE: CVE-2024-6401
Published: 2024-09-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection.This issue affects InsureE GL: before 4.6.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1475; https://vuldb.com/?id.277555
CVE: CVE-2024-7098
Published: 2024-09-16
Description: Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://www.usom.gov.tr/bildirim/tr-24-1475
CVE: CVE-2024-7104
Published: 2024-09-16
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection.This issue affects ww.Winsure: before 4.6.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.usom.gov.tr/bildirim/tr-24-1475
CVE: CVE-2024-44623
Published: 2024-09-16
Description: An issue in TuomoKu SPx-GC v.1.3.0 and before allows a remote attacker to execute arbitrary code via the child_process.js function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/TuomoKu/SPX-GC; https://github.com/TuomoKu/SPX-GC/blob/v.1.3.0/routes/routes-api.js#L39; https://github.com/merbinr/CVE-2024-44623
CVE: CVE-2024-8752
Published: 2024-09-16
Description: The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.tenable.com/security/research/tra-2024-38
CVE: CVE-2023-22351
Published: 2024-09-16
Description: Out-of-bounds write in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-23904
Published: 2024-09-16
Description: NULL pointer dereference in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-395
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-25546
Published: 2024-09-16
Description: Out-of-bounds read in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 2.5 (LOW)
CWE: CWE-125
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-41833
Published: 2024-09-16
Description: A race condition in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-42772
Published: 2024-09-16
Description: Untrusted pointer dereference in UEFI firmware for some Intel(R) reference processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-822
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-43626
Published: 2024-09-16
Description: Improper access control in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-43753
Published: 2024-09-16
Description: Improper conditions check in some Intel(R) Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-92
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-21781
Published: 2024-09-16
Description: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to enable information disclosure or denial of service via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-21829
Published: 2024-09-16
Description: Improper input validation in UEFI firmware error handler for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-21871
Published: 2024-09-16
Description: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-23599
Published: 2024-09-16
Description: Race condition in Seamless Firmware Updates for some Intel(R) reference platforms may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 7.9 (HIGH)
CWE: CWE-362
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-23984
Published: 2024-09-16
Description: Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html; https://lists.debian.org/debian-lts-announce/2024/11/msg00022.html; https://lists.debian.org/debian-lts-announce/2024/12/msg00024.html
CVE: CVE-2024-24968
Published: 2024-09-16
Description: Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to potentially enable a denial of service via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1245
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html; https://lists.debian.org/debian-lts-announce/2024/11/msg00022.html
CVE: CVE-2024-28170
Published: 2024-09-16
Description: Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2024-32666
Published: 2024-09-16
Description: NULL pointer dereference in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2024-32940
Published: 2024-09-16
Description: Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2024-33848
Published: 2024-09-16
Description: Uncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2024-34153
Published: 2024-09-16
Description: Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2024-34543
Published: 2024-09-16
Description: Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2024-34545
Published: 2024-09-16
Description: Improper input validation in some Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable information disclosure via adjacent access.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2024-36247
Published: 2024-09-16
Description: Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2024-36261
Published: 2024-09-16
Description: Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-45854
Published: 2024-09-16
Description: A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd parameter in the add-to-cart function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://kafka-esc.com/posts/2024/09/cve-2023-45854-interger-overflow-in-shopkit-1.0/; https://shopk.it/
CVE: CVE-2024-8661
Published: 2024-09-16
Description: Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload  by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6 with vector  CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N  Since the "Next&Previous Nav" block output was not sufficiently sanitized, the malicious payload could be executed in the browsers of targeted users. Thanks, Chu Quoc Khanh for reporting.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes; https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes; https://github.com/concretecms/concretecms/commit/ce5ee2ab83fe8de6fa012dd51c5a1dde05cb0dc4
CVE: CVE-2024-32034
Published: 2024-09-16
Description: decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users are advised to upgrade. Users unable to upgrade may redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645; https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072; https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0
CVE: CVE-2024-39910
Published: 2024-09-16
Description: decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to upgrade should review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f; https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm
CVE: CVE-2024-45799
Published: 2024-09-16
Description: FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a result all logged in to fluxcp users can have their session info stolen. This issue has been addressed in release version 1.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-200, CWE-79
References: https://github.com/rathena/FluxCP/security/advisories/GHSA-xvqv-25vf-88g4
CVE: CVE-2024-45801
Published: 2024-09-16
Description: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1333, CWE-1321
References: https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21; https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc; https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674
CVE: CVE-2024-22013
Published: 2024-09-16
Description: U-Boot environment is read from unauthenticated partition.
CVSS Score: 5.3 (MEDIUM)
References: https://support.google.com/product-documentation/answer/14950962?hl=en&ref_topic=12974021&sjid=[PII_REDACTED]262170957-NA#zippy=%2Cwifi
CVE: CVE-2024-34016
Published: 2024-09-16
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-7188
CVE: CVE-2024-42794
Published: 2024-09-16
Description: Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Save%20User%20%26%20Account%20Takeover.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42795
Published: 2024-09-16
Description: An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3 in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to view valid user details.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20View%20User.pdf; https://www.kashipara.com/
CVE: CVE-2024-42796
Published: 2024-09-16
Description: An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to delete the valid music genre entries.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Delete%20Genre.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42798
Published: 2024-09-16
Description: An Incorrect Access Control vulnerability was found in /music/index.php?page=user_list and /music/index.php?page=edit_user in Kashipara Music Management System v1.0. This allows a low privileged attacker to take over the administrator account.
CVSS Score: 7.6 (HIGH)
CWE: CWE-269
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Priv%20Esc%20-%20Save%20Edit%20User%20-%20AC%20Takeover.pdf; https://www.kashipara.com/
CVE: CVE-2024-44445
Published: 2024-09-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-45800
Published: 2024-09-16
Description: Snappymail is an open source web-based email client. SnappyMail uses the `cleanHtml()` function to cleanup HTML and CSS in emails. Research discovered that the function has a few bugs which cause an mXSS exploit. Because the function allowed too many (invalid) HTML elements, it was possible (with incorrect markup) to trick the browser to "fix" the broken markup into valid markup. As a result a motivated attacker may be able to inject javascript. However, due to the default Content Security Policy the impact of the exploit is minimal. It could be possible to create an attack which leaks some data when loading images through the proxy.
This way it might be possible to use the proxy to attack the local system, like with `http://localhost:5000/leak`. Another attack could be to load a JavaScript attachment of the email. This is very tricky as the email must link to every possible UID as each email has a unique UID which has a value between 1 and[PII_REDACTED][PII_REDACTED] **v2.38.0** and up now remove unsupported HTML elements which mitigates the issue. Users are advised to upgrade. Older versions can install an extension named "Security mXSS" as a mitigation. This will be available at the administration area at `/?admin#/packages`. **NOTE:** this extension can not "fix" malicious code in encrypted messages or (html) attachments as it can't manipulate the JavaScript code for this. It only protects normal message HTML.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79
References: https://github.com/the-djmaze/snappymail/blob/master/dev/Common/Html.js; https://github.com/the-djmaze/snappymail/commit/cfbc47488a6b2e2ae4be484f501ee1a3485f542e; https://github.com/the-djmaze/snappymail/security/advisories/GHSA-2rq7-79vp-ffxm
CVE: CVE-2024-8766
Published: 2024-09-16
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235, Acronis Cyber Protect 16 (Windows) before build 39169.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-7218