deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2067
Published: 2024-03-01
Description: A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-computer.php. The manipulation of the argument computer leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-255382 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Computer%20Inventory%20System%20Using%20PHP/SQL%20Injection%20delete-computer.php%20.md; https://vuldb.com/?ctiid.255382; https://vuldb.com/?id.255382
CVE: CVE-2024-1624
Published: 2024-03-01
Description: An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x, SIMULIA Abaqus from Release 2022 through Release 2024, SIMULIA Isight from Release 2022 through Release 2024 and CATIA Composer from Release R2023 through Release R2024. A specially crafted HTTP request can lead to arbitrary command execution.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-78
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-27138
Published: 2024-03-01
Description: ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva.

Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2024/03/01/4; https://lists.apache.org/thread/070qcpclcb3sqk1hn8j5lvzohp30k1m2; http://www.openwall.com/lists/oss-security/2024/03/01/4
CVE: CVE-2024-27139
Published: 2024-03-01
Description: ** UNSUPPORTED WHEN ASSIGNED **

Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account takeover.

This issue affects Apache Archiva: from 2.0.0.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2024/03/01/3; https://lists.apache.org/thread/qr8b7r86p1hkn0dc0q827s981kf1bgd8; http://www.openwall.com/lists/oss-security/2024/03/01/3
CVE: CVE-2024-27140
Published: 2024-03-01
Description: ** UNSUPPORTED WHEN ASSIGNED **

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva.

This issue affects Apache Archiva: from 2.0.0.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2024/03/01/2; https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjy; http://www.openwall.com/lists/oss-security/2024/03/01/2
CVE: CVE-2024-27295
Published: 2024-03-01
Description: Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents. This is due to the fact that by default MySQL/MariaDB are configured for accent-insensitive and case-insensitive comparisons. This vulnerability is fixed in version 10.8.3.


CVSS Score: 8.2 (HIGH)
CWE: CWE-706, CWE-706
References: https://github.com/directus/directus/security/advisories/GHSA-qw9g-7549-7wg5; https://github.com/directus/directus/security/advisories/GHSA-qw9g-7549-7wg5
CVE: CVE-2024-27296
Published: 2024-03-01
Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0; https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j; https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0
CVE: CVE-2024-27499
Published: 2024-03-01
Description: Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/Ek-Saini/security/blob/main/xss-bagisto-v1.5.1; https://github.com/auspicious7/Vulnerability-Discover/blob/main/CVE-2024-27499_bagisto-V-1.5.1; https://github.com/bagisto/bagisto/pull/9474
CVE: CVE-2024-2068
Published: 2024-03-01
Description: A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /endpoint/update-computer.php. The manipulation of the argument model leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255383.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Computer%20Inventory%20System%20Using%20PHP/STORED%20XSS%20upadte-computer.php%20.md; https://vuldb.com/?ctiid.255383; https://vuldb.com/?id.255383
CVE: CVE-2024-2069
Published: 2024-03-01
Description: A vulnerability classified as critical has been found in SourceCodester FAQ Management System 1.0. Affected is an unknown function of the file /endpoint/delete-faq.php. The manipulation of the argument faq leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255384.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/SOURCECODESTER%20%5BFAQ%20Management%20System%20Using%20PHP%20and%20MySQL%5D%20SQLi%20on%20delete-faq.php.md; https://vuldb.com/?ctiid.255384; https://vuldb.com/?id.255384
CVE: CVE-2024-2070
Published: 2024-03-01
Description: A vulnerability classified as problematic was found in SourceCodester FAQ Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-faq.php. The manipulation of the argument question/answer leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255385 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/SOURCECODESTER%20%5BFAQ%20Management%20System%20Using%20PHP%20and%20MySQL%5D%20XSS%20on%20add-faq.php.md; https://vuldb.com/?ctiid.255385; https://vuldb.com/?id.255385
CVE: CVE-2023-52556
Published: 2024-03-01
Description: In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic.

CVSS Score: 6.2 (MEDIUM)
CWE: CWE-367
References: https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/009_pf.patch.sig; https://github.com/openbsd/src/commit/9d9f4dc6c833cb79d13f836581e3a781d06842e7; https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/009_pf.patch.sig
CVE: CVE-2023-52557
Published: 2024-03-01
Description: In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.

CVSS Score: 7.5 (HIGH)
CWE: CWE-131, CWE-805
References: https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/016_npppd.patch.sig; https://github.com/openbsd/src/commit/abf3a29384c582c807a621e7fc6e7c68d0cafe9b; https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/016_npppd.patch.sig
CVE: CVE-2023-52558
Published: 2024-03-01
Description: In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/019_msplit.patch.sig; https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/002_msplit.patch.sig; https://github.com/openbsd/src/commit/7b4d35e0a60ba1dd4daf4b1c2932020a22463a89
CVE: CVE-2024-27558
Published: 2024-03-01
Description: Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kilooooo/cms/blob/main/2.md; https://github.com/kilooooo/cms/blob/main/2.md
CVE: CVE-2024-27559
Published: 2024-03-01
Description: Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save_settings.php
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/kilooooo/cms/blob/main/1.md; https://github.com/kilooooo/cms/blob/main/1.md
CVE: CVE-2024-27689
Published: 2024-03-01
Description: Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via /update-article.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Xin246/cms/blob/main/2.md; https://github.com/Xin246/cms/blob/main/2.md
CVE: CVE-2024-27692
Published: 2024-03-01
Description: Rejected reason: * REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-22939. Reason: This candidate is a duplicate of CVE-2024-22939. Notes: All CVE users should reference CVE-2024-22939 instead of this candidate.
CVE: CVE-2024-27734
Published: 2024-03-01
Description: A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name fields of the Site Settings component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sms2056/cms/blob/main/3.md; https://github.com/sms2056/cms/blob/main/3.md
CVE: CVE-2024-2071
Published: 2024-03-01
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester FAQ Management System 1.0. Affected by this issue is some unknown functionality of the component Update FAQ. The manipulation of the argument Frequently Asked Question leads to cross site scripting. The attack may be launched remotely. VDB-255386 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/faq-management-system.md; https://vuldb.com/?ctiid.255386; https://vuldb.com/?id.255386
CVE: CVE-2024-2072
Published: 2024-03-01
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Flashcard Quiz App 1.0. This affects an unknown part of the file /endpoint/update-flashcard.php. The manipulation of the argument question/answer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255387.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/SOURCECODESTER%20%5BFlashcard%20Quiz%20App%20Using%20PHP%20and%20MySQL%5D%20XSS%20on%20update-flashcard.php.md; https://vuldb.com/?ctiid.255387; https://vuldb.com/?id.255387
CVE: CVE-2024-2073
Published: 2024-03-01
Description: A vulnerability has been found in SourceCodester Block Inserter for Dynamic Content 1.0 and classified as critical. This vulnerability affects unknown code of the file view_post.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255388.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/Block%20Inserter%20for%20Dynamic%20Content%20-%20Sql%20Injection.md; https://vuldb.com/?ctiid.255388; https://vuldb.com/?id.255388
CVE: CVE-2024-27298
Published: 2024-03-01
Description: parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://github.com/parse-community/parse-server/commit/a6e[PII_REDACTED]32904a69b51e513507fcf90a504; https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833; https://github.com/parse-community/parse-server/releases/tag/6.5.0
CVE: CVE-2024-2074
Published: 2024-03-01
Description: A vulnerability was found in Mini-Tmall up to 20231017 and classified as critical. This issue affects some unknown processing of the file ?r=tmall/admin/user/1/1. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255389 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yuziiiiiiiiii/CVE-SQL/blob/main/cve.md; https://vuldb.com/?ctiid.255389; https://vuldb.com/?id.255389
CVE: CVE-2024-2075
Published: 2024-03-01
Description: A vulnerability was found in SourceCodester Daily Habit Tracker 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/update-tracker.php. The manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255391.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/Stored%20XSS%20Daily%20Habit%20Tracker.md; https://vuldb.com/?ctiid.255391; https://vuldb.com/?id.255391
CVE: CVE-2024-1453
Published: 2024-03-01
Description: 
In Sante DICOM Viewer Pro versions 14.0.3 and prior, a user must open a malicious DICOM file, which could allow a local attacker to disclose information or execute arbitrary code.


CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-058-01; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-058-01
CVE: CVE-2024-2076
Published: 2024-03-01
Description: A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file booking.php/owner.php/tenant.php. The manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255392.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://docs.qq.com/doc/DYlREVXpuRUFwRFpQ; https://vuldb.com/?ctiid.255392; https://vuldb.com/?id.255392
CVE: CVE-2024-2077
Published: 2024-03-01
Description: A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument category_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255393 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yethu123/vulns-finding/blob/main/Simple%20Online%20Bidding%20System.md; https://vuldb.com/?ctiid.255393; https://vuldb.com/?id.255393
CVE: CVE-2024-1174
Published: 2024-03-01
Description: Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.0 SP 8, which includes updates to mitigate potential vulnerabilities.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]2671-16/hpsbhf03919; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]2671-16/hpsbhf03919
CVE: CVE-2023-7242
Published: 2024-03-01
Description: 

Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat 
Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds 
read during the process of analyzing a specific Ethercat packet. This 
could allow an attacker to crash the Zeek process and leak some 
information in memory.






CVSS Score: 8.2 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02
CVE: CVE-2023-7243
Published: 2024-03-01
Description: 
Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat 
Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds 
write while analyzing specific Ethercat datagrams. This could allow an 
attacker to cause arbitrary code execution.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02
CVE: CVE-2023-7244
Published: 2024-03-01
Description: Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat 
Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds 
write in their primary analyses function for Ethercat communication 
packets. This could allow an attacker to cause arbitrary code execution.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02
CVE: CVE-2024-20328
Published: 2024-03-01
Description: A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.
ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://blog.clamav.net/2023/11/clamav-130-122-105-released.html; https://blog.clamav.net/2023/11/clamav-130-122-105-released.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/
CVE: CVE-2024-21767
Published: 2024-03-01
Description: 
A remote attacker may be able to bypass access control of Commend WS203VICM by creating a malicious request.




CVSS Score: 9.4 (CRITICAL)
CWE: CWE-284
References: https://clibrary-online.commend.com/en/cyber-security/security-advisories.html; https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01; https://clibrary-online.commend.com/en/cyber-security/security-advisories.html
CVE: CVE-2024-22182
Published: 2024-03-01
Description: A remote, unauthenticated attacker may be able to send crafted messages 
to the web server of the Commend WS203VICM causing the system to 
restart, interrupting service.


CVSS Score: 8.6 (HIGH)
CWE: CWE-88
References: https://clibrary-online.commend.com/en/cyber-security/security-advisories.html; https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01; https://clibrary-online.commend.com/en/cyber-security/security-advisories.html
CVE: CVE-2024-23492
Published: 2024-03-01
Description: 

A weak encoding is used to transmit credentials for WS203VICM.






CVSS Score: 5.7 (MEDIUM)
CWE: CWE-261
References: https://clibrary-online.commend.com/en/cyber-security/security-advisories.html; https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01; https://clibrary-online.commend.com/en/cyber-security/security-advisories.html
CVE: CVE-2024-27101
Published: 2024-03-01
Description: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic.  Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem.  The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://github.com/authzed/spicedb/commit/ef443c442b[PII_REDACTED]0324a99849b0407007fe; https://github.com/authzed/spicedb/security/advisories/GHSA-h3m7-rqc4-7h9p; https://github.com/authzed/spicedb/commit/ef443c442b[PII_REDACTED]0324a99849b0407007fe