deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-31136
Published: 2024-03-28
Description: In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter
CVSS Score: 7.4 (HIGH)
CWE: CWE-1288
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-31137
Published: 2024-03-28
Description: In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-31138
Published: 2024-03-28
Description: In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-31139
Published: 2024-03-28
Description: In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-31140
Published: 2024-03-28
Description: In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-1288
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-3039
Published: 2024-03-28
Description: A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml(1,concat(0x3f,md5(123456),0x3f),1)=1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://spoofer.cn/bladex_sqli/; https://vuldb.com/?ctiid.258426; https://vuldb.com/?id.258426
CVE: CVE-2024-3040
Published: 2024-03-28
Description: A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_crl_conf. The manipulation of the argument CRLId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258429 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-list_crl_conf.md; https://vuldb.com/?ctiid.258429; https://vuldb.com/?id.258429
CVE: CVE-2024-3041
Published: 2024-03-28
Description: A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-listloginfo.md; https://vuldb.com/?ctiid.258430; https://vuldb.com/?id.258430
CVE: CVE-2024-3042
Published: 2024-03-28
Description: A vulnerability was found in SourceCodester Simple Subscription Website 1.0 and classified as critical. This issue affects some unknown processing of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258431.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/maxmvp666/planCve/blob/main/Simple%20Subscription%20Website%20with%20Admin%20System%20manage_user.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.258431; https://vuldb.com/?id.258431
CVE: CVE-2023-40390
Published: 2024-03-28
Description: A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sonoma 14.2. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT214036; https://support.apple.com/en-us/HT214036; https://support.apple.com/kb/HT214036
CVE: CVE-2023-42892
Published: 2024-03-28
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://support.apple.com/en-us/HT214036; https://support.apple.com/en-us/HT214037; https://support.apple.com/en-us/HT214038
CVE: CVE-2023-42893
Published: 2024-03-28
Description: A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, tvOS 17.2, watchOS 10.2, macOS Sonoma 14.2. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2024/May/10; http://seclists.org/fulldisclosure/2024/May/12; https://support.apple.com/en-us/HT214034
CVE: CVE-2023-42896
Published: 2024-03-28
Description: An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, macOS Sonoma 14.2. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://support.apple.com/en-us/HT214034; https://support.apple.com/en-us/HT214035; https://support.apple.com/en-us/HT214036
CVE: CVE-2023-42913
Published: 2024-03-28
Description: This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk access permissions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-922
References: https://support.apple.com/en-us/HT214036; https://support.apple.com/en-us/HT214036; https://support.apple.com/kb/HT214036
CVE: CVE-2023-42930
Published: 2024-03-28
Description: This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT214036; https://support.apple.com/en-us/HT214037; https://support.apple.com/en-us/HT214038
CVE: CVE-2023-42931
Published: 2024-03-28
Description: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin privileges without proper authentication.
CVSS Score: 7.8 (HIGH)
CWE: CWE-280
References: https://support.apple.com/en-us/HT214036; https://support.apple.com/en-us/HT214037; https://support.apple.com/en-us/HT214038
CVE: CVE-2023-42936
Published: 2024-03-28
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2, macOS Sonoma 14.2. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT214035; https://support.apple.com/en-us/HT214036; https://support.apple.com/en-us/HT214037
CVE: CVE-2023-42947
Published: 2024-03-28
Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2, macOS Sonoma 14.2. An app may be able to break out of its sandbox.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://support.apple.com/en-us/HT214035; https://support.apple.com/en-us/HT214036; https://support.apple.com/en-us/HT214037
CVE: CVE-2023-42950
Published: 2024-03-28
Description: A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2, macOS Sonoma 14.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2024/03/26/1; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXLXIOAH5S7J22LJTCIAVFVVJ4TESAX4/; https://support.apple.com/en-us/HT214035
CVE: CVE-2023-42956
Published: 2024-03-28
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2. Processing web content may lead to a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/03/26/1; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXLXIOAH5S7J22LJTCIAVFVVJ4TESAX4/; https://support.apple.com/en-us/HT214035
CVE: CVE-2023-42962
Published: 2024-03-28
Description: This issue was addressed with improved checks This issue is fixed in iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. A remote attacker may be able to cause a denial-of-service.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT214034; https://support.apple.com/en-us/HT214035; https://support.apple.com/en-us/HT214034
CVE: CVE-2023-42974
Published: 2024-03-28
Description: A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, macOS Sonoma 14.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://support.apple.com/en-us/HT214034; https://support.apple.com/en-us/HT214035; https://support.apple.com/en-us/HT214036
CVE: CVE-2024-25959
Published: 2024-03-28
Description: Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to sensitive information disclosure, escalation of privileges.
CVSS Score: 7.9 (HIGH)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-25961
Published: 2024-03-28
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an improper privilege management vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-25946
Published: 2024-03-28
Description: Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opportunity.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-77
References: https://www.dell.com/support/kbdoc/en-us/000223609/dsa-2024-108-dell-powermaxos-5978-dell-powermax-os-10-0-1-5-dell-powermax-os-10-1-0-2-dell-unisphere-360-unisphere-powermax-unisphere-powermax-vapp-dell-solutions-enabler-vapp-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223609/dsa-2024-108-dell-powermaxos-5978-dell-powermax-os-10-0-1-5-dell-powermax-os-10-1-0-2-dell-unisphere-360-unisphere-powermax-unisphere-powermax-vapp-dell-solutions-enabler-vapp-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
CVE: CVE-2024-25952
Published: 2024-03-28
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, information tampering.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-61, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-25953
Published: 2024-03-28
Description: Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, information tampering.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-61, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-25954
Published: 2024-03-28
Description: Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613
References: https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-25955
Published: 2024-03-28
Description: Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opportunity.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-77
References: https://www.dell.com/support/kbdoc/en-us/000223609/dsa-2024-108-dell-powermaxos-5978-dell-powermax-os-10-0-1-5-dell-powermax-os-10-1-0-2-dell-unisphere-360-unisphere-powermax-unisphere-powermax-vapp-dell-solutions-enabler-vapp-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223609/dsa-2024-108-dell-powermaxos-5978-dell-powermax-os-10-0-1-5-dell-powermax-os-10-1-0-2-dell-unisphere-360-unisphere-powermax-unisphere-powermax-vapp-dell-solutions-enabler-vapp-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
CVE: CVE-2024-25960
Published: 2024-03-28
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-319
References: https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-25963
Published: 2024-03-28
Description: Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-25971
Published: 2024-03-28
Description: Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information disclosure, denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://www.dell.com/support/kbdoc/en-us/000223556/dsa-2024-132-security-update-dell-power-protect-data-manager-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000223556/dsa-2024-132-security-update-dell-power-protect-data-manager-for-multiple-security-vulnerabilities
CVE: CVE-2024-27719
Published: 2024-03-28
Description: A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the Frequently Asked Question field in the Add FAQ function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.sourcecodester.com/php/17175/faq-management-system-using-php-and-mysql-source-code.html; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2024-002; https://www.sourcecodester.com/php/17175/faq-management-system-using-php-and-mysql-source-code.html
CVE: CVE-2024-28713
Published: 2024-03-28
Description: An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://mblog.com; https://gitee.com/mtons/mblog; https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%871.png
CVE: CVE-2024-2947
Published: 2024-03-28
Description: A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://access.redhat.com/errata/RHSA-2024:3667; https://access.redhat.com/errata/RHSA-2024:3843; https://access.redhat.com/security/cve/CVE-2024-2947
CVE: CVE-2024-31061
Published: 2024-03-28
Description: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahildari/cve/blob/master/CVE-2024-31061.md; https://owasp.org/www-community/attacks/xss/; https://portswigger.net/web-security/cross-site-scripting/stored
CVE: CVE-2024-31062
Published: 2024-03-28
Description: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input field.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-80
References: https://github.com/sahildari/cve/blob/master/CVE-2024-31062.md; https://owasp.org/www-community/attacks/xss/; https://portswigger.net/web-security/cross-site-scripting/stored
CVE: CVE-2024-31063
Published: 2024-03-28
Description: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input field.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahildari/cve/blob/master/CVE-2024-31063.md; https://owasp.org/www-community/attacks/xss/; https://portswigger.net/web-security/cross-site-scripting/stored
CVE: CVE-2024-31064
Published: 2024-03-28
Description: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://insurance.com; http://sourcecodester.com; https://drive.google.com/file/d/1yTIeXAPs3PJcQwj9gxhvs92zTdBwKGVB/view?usp=sharing
CVE: CVE-2024-31065
Published: 2024-03-28
Description: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahildari/cve/blob/master/CVE-2024-31065.md; https://owasp.org/www-community/attacks/xss/; https://portswigger.net/web-security/cross-site-scripting/stored
CVE: CVE-2024-3019
Published: 2024-03-28
Description: A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-668
References: https://access.redhat.com/errata/RHSA-2024:2566; https://access.redhat.com/errata/RHSA-2024:3264; https://access.redhat.com/errata/RHSA-2024:3321
CVE: CVE-2024-25506
Published: 2024-03-28
Description: Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pm_sys_sys cookie.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40proflamyt/cve-2024-25506-425ba3212fb6; https://medium.com/%40proflamyt/cve-2024-25506-425ba3212fb6
CVE: CVE-2024-28090
Published: 2024-03-28
Description: Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via User name in dyn_dns.asp.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/actuator/cve/blob/main/Technicolor/CVE-2024-28090; https://github.com/actuator/cve/blob/main/Technicolor/CVE-2024-28090
CVE: CVE-2024-28091
Published: 2024-03-28
Description: Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via User Defined Service in managed_services_add.asp (the victim must click an X for a deletion).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/actuator/cve/blob/main/Technicolor/CVE-2024-28091; https://github.com/actuator/cve/blob/main/Technicolor/CVE-2024-28091
CVE: CVE-2024-23727
Published: 2024-03-28
Description: The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.
CVSS Score: 8.4 (HIGH)
CWE: CWE-94
References: https://github.com/actuator/yi/blob/main/com.kamivision.yismart.V1.0.0_20231219.md; https://github.com/actuator/yi/blob/main/com.kamivision.yismart.V1.0.0_20231219.md
CVE: CVE-2023-25341
Published: 2024-03-28
Description: A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to read files accessible to the user via GET requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.runjak.codes/posts/2024-03-21-ladle-cve; https://www.runjak.codes/posts/2024-03-21-ladle-cve