deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-28101
Published: 2024-03-21
Description: The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size. 

CVSS Score: 7.5 (HIGH)
CWE: CWE-409
References: https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413; https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj; https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413
CVE: CVE-2024-28102
Published: 2024-03-21
Description: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-770
References: https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f; https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97; https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f
CVE: CVE-2024-28123
Published: 2024-03-21
Description: Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.

CVSS Score: 7.3 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/wasmi-labs/wasmi/commit/f7b3200e9f3dc9e2cbca966cb255c228453c792f; https://github.com/wasmi-labs/wasmi/releases/tag/v0.31.1; https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-75jp-vq8x-h4cq
CVE: CVE-2024-28286
Published: 2024-03-21
Description: In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c function of src/mms/iso_mms/server/mms_file_service.c. The vulnerability manifests as SEGV and causes the application to crash
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mz-automation/libiec61850/issues/496; https://github.com/mz-automation/libiec61850/issues/496
CVE: CVE-2024-2007
Published: 2024-03-21
Description: A vulnerability was found in OpenBMB XAgent 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Privileged Mode. The manipulation leads to sandbox issue. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-255265 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-265
References: https://github.com/OpenBMB/XAgent/issues/386; https://vuldb.com/?ctiid.255265; https://vuldb.com/?id.255265
CVE: CVE-2024-2014
Published: 2024-03-21
Description: A vulnerability classified as critical was found in Panabit Panalog[PII_REDACTED]42. This vulnerability affects unknown code of the file /Maintain/sprog_upstatus.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255268. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/mashroompc0527/CVE/blob/main/vul.md; https://vuldb.com/?ctiid.255268; https://vuldb.com/?id.255268
CVE: CVE-2024-2015
Published: 2024-03-21
Description: A vulnerability, which was classified as critical, has been found in ZhiCms 4.0. This issue affects the function getindexdata of the file app/index/controller/mcontroller.php. The manipulation of the argument key leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255269 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5; https://vuldb.com/?ctiid.255269; https://vuldb.com/?id.255269
CVE: CVE-2024-2016
Published: 2024-03-21
Description: A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255270 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5; https://vuldb.com/?ctiid.255270; https://vuldb.com/?id.255270
CVE: CVE-2024-2053
Published: 2024-03-21
Description: The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the "www-data" user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: http://seclists.org/fulldisclosure/2024/Mar/11; https://korelogic.com/Resources/Advisories/KL-001-2024-001.txt; http://seclists.org/fulldisclosure/2024/Mar/11
CVE: CVE-2024-2054
Published: 2024-03-21
Description: The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://seclists.org/fulldisclosure/2024/Mar/12; https://korelogic.com/Resources/Advisories/KL-001-2024-002.txt; http://seclists.org/fulldisclosure/2024/Mar/12
CVE: CVE-2024-2167
Published: 2024-03-21
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-2041. Reason: This candidate is a reservation duplicate of CVE-2024-2041. Notes: All CVE users should reference CVE-2024-2041 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-2712
Published: 2024-03-21
Description: A vulnerability, which was classified as critical, has been found in Campcodes Complete Online DJ Booking System 1.0. This issue affects some unknown processing of the file /admin/user-search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257465 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20DJ%20Booking%20System/Complete%20Online%20DJ%20Booking%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.257465; https://vuldb.com/?id.257465
CVE: CVE-2024-2713
Published: 2024-03-21
Description: A vulnerability, which was classified as critical, was found in Campcodes Complete Online DJ Booking System 1.0. Affected is an unknown function of the file /admin/booking-search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257466 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20DJ%20Booking%20System/Complete%20Online%20DJ%20Booking%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.257466; https://vuldb.com/?id.257466
CVE: CVE-2023-48901
Published: 2024-03-21
Description: A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter "id" within the getPhotosByCarId function call in details.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/177660/Tramyardg-Autoexpress-1.3.0-SQL-Injection.html; https://packetstormsecurity.com/files/177660/Tramyardg-Autoexpress-1.3.0-SQL-Injection.html
CVE: CVE-2023-48902
Published: 2024-03-21
Description: An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in uploadCarImages.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://packetstormsecurity.com/files/177661/Tramyardg-Autoexpress-1.3.0-Authentication-Bypass.html; https://packetstormsecurity.com/files/177661/Tramyardg-Autoexpress-1.3.0-Authentication-Bypass.html
CVE: CVE-2023-48903
Published: 2024-03-21
Description: Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML within parameter "imgType" via in uploadCarImages.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/177662/Tramyardg-Autoexpress-1.3.0-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/177662/Tramyardg-Autoexpress-1.3.0-Cross-Site-Scripting.html
CVE: CVE-2024-1538
Published: 2024-03-21
Description: The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3051451/wp-file-manager; https://www.wordfence.com/threat-intel/vulnerabilities/id/57cc15a6-2cf5-481f-bb81-ada48aa74009?source=cve; https://plugins.trac.wordpress.org/changeset/3051451/wp-file-manager
CVE: CVE-2024-22724
Published: 2024-03-21
Description: An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo upload feature.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://github.com/osCommerce/osCommerce-V4/issues/62; https://medium.com/%40cupc4k3/oscommerce-v4-rce-unveiling-the-file-upload-bypass-threat-f1ac0097880c; https://github.com/osCommerce/osCommerce-V4/issues/62
CVE: CVE-2024-28635
Published: 2024-03-21
Description: Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/surveyjs/survey-creator/issues/5285; https://packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt; https://github.com/surveyjs/survey-creator/issues/5285
CVE: CVE-2024-29858
Published: 2024-03-21
Description: In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-616
References: https://github.com/MISP/MISP/commit/6a2986be6aad6b37858b4869e238f517b295c111; https://github.com/MISP/MISP/commit/6a2986be6aad6b37858b4869e238f517b295c111
CVE: CVE-2024-29859
Published: 2024-03-21
Description: In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/MISP/MISP/commit/238010bfd004680757b324cba0c6344f77a25399; https://github.com/MISP/MISP/commit/238010bfd004680757b324cba0c6344f77a25399
CVE: CVE-2024-29862
Published: 2024-03-21
Description: The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state.
CVSS Score: 7.5 (HIGH)
References: https://github.com/chirpstack/chirpstack-gateway-bridge/commit/0c1e80c9fa9f5d093ff62903caedad86ec4640b6; https://github.com/chirpstack/chirpstack-mqtt-forwarder/commit/4fa9e6eaaec8c3ca49ebfbf[PII_REDACTED]f17700f; https://github.com/chirpstack/chirpstack-gateway-bridge/commit/0c1e80c9fa9f5d093ff62903caedad86ec4640b6
CVE: CVE-2024-29864
Published: 2024-03-21
Description: Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/89luca89/distrobox/commit/82a69f0a234e73e447d0ea8c8b3443b84fd31944; https://github.com/89luca89/distrobox/issues/1275; https://github.com/89luca89/distrobox/commit/82a69f0a234e73e447d0ea8c8b3443b84fd31944
CVE: CVE-2024-28835
Published: 2024-03-21
Description: A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-248
References: https://access.redhat.com/errata/RHSA-2024:1879; https://access.redhat.com/errata/RHSA-2024:2570; https://access.redhat.com/errata/RHSA-2024:2889
CVE: CVE-2024-2161
Published: 2024-03-21
Description: Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227 .


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.kiloview.com/en/support/download/1779/; https://www.kiloview.com/en/support/download/n20-firmware-download/; https://www.kiloview.com/en/support/download/n3-for-ndi/
CVE: CVE-2024-2162
Published: 2024-03-21
Description: An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges.

This issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227 .


CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.kiloview.com/en/support/download/1779/; https://www.kiloview.com/en/support/download/n20-firmware-download/; https://www.kiloview.com/en/support/download/n3-for-ndi/
CVE: CVE-2024-2754
Published: 2024-03-21
Description: A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257544.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/wkeyi0x1/vul-report/issues/4; https://vuldb.com/?ctiid.257544; https://vuldb.com/?id.257544
CVE: CVE-2024-1147
Published: 2024-03-21
Description: Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://portal.microfocus.com/s/article/KM000026669; https://portal.microfocus.com/s/article/KM000026669; https://www.chtsecurity.com/news/7890c276-f75c-423a-a3fa-9ee1756eb0a9
CVE: CVE-2024-1148
Published: 2024-03-21
Description: Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and uploading of files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://portal.microfocus.com/s/article/KM000026669; https://portal.microfocus.com/s/article/KM000026669; https://www.chtsecurity.com/news/7890c276-f75c-423a-a3fa-9ee1756eb0a9
CVE: CVE-2024-29131
Published: 2024-03-21
Description: Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.

Users are recommended to upgrade to version 2.10.1, which fixes the issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2024/03/20/4; https://lists.apache.org/thread/03nzzzjn4oknyw5y0871tw7ltj0t3r37; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNKDKEEKZNL5FGCTZKJ6CFXFVWFL5FJ7/
CVE: CVE-2024-29133
Published: 2024-03-21
Description: Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.

Users are recommended to upgrade to version 2.10.1, which fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://www.openwall.com/lists/oss-security/2024/03/20/3; https://lists.apache.org/thread/ccb9w15bscznh6tnp3wsvrrj9crbszh2; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNKDKEEKZNL5FGCTZKJ6CFXFVWFL5FJ7/
CVE: CVE-2024-26307
Published: 2024-03-21
Description: Possible race condition vulnerability in Apache Doris.
Some of code using `chmod()` method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file.
This could theoretically happen, but the impact would be minimal.
This issue affects Apache Doris: before 1.2.8, before 2.0.4.

Users are recommended to upgrade to version 2.0.4, which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2024/03/21/2; https://lists.apache.org/thread/5shhw8x8m271hd2wfwzqzwgf36pmc4pl; http://www.openwall.com/lists/oss-security/2024/03/21/2
CVE: CVE-2024-27438
Published: 2024-03-21
Description: Download of Code Without Integrity Check vulnerability in Apache Doris.
The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution.
Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code snippet. This code snippet will be run when catalog is initializing without any check.
This issue affects Apache Doris: from 1.2.0 through 2.0.4.

Users are recommended to upgrade to version 2.0.5 or 2.1.x, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-494
References: http://www.openwall.com/lists/oss-security/2024/03/21/1; https://lists.apache.org/thread/h95h82b0svlnwcg6c2xq4b08j6gwgczh; http://www.openwall.com/lists/oss-security/2024/03/21/1
CVE: CVE-2023-52620
Published: 2024-03-21
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: disallow timeout for anonymous sets

Never used from userspace, disallow these parameters.
CVSS Score: 2.5 (LOW)
References: https://git.kernel.org/stable/c/00b19ee0dcc1aef06294471ab489bae26d94524e; https://git.kernel.org/stable/c/116b0e8e4673a5faa8a739a19b467010c4d3058c; https://git.kernel.org/stable/c/49ce99ae43314d887153e07cec8bb6a647a19268
CVE: CVE-2024-26642
Published: 2024-03-21
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: disallow anonymous set with timeout flag

Anonymous sets are never used with timeout from userspace, reject this.
Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/16603605b667b70da974bea8216c93e7db043bf1; https://git.kernel.org/stable/c/72c1efe3f247a581667b7d368fff3bd9a03cd57a; https://git.kernel.org/stable/c/7cdc1be24cc1bcd56a3e89ac4aef20e31ad09199
CVE: CVE-2024-26643
Published: 2024-03-21
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout

While the rhashtable set gc runs asynchronously, a race allows it to
collect elements from anonymous sets with timeouts while it is being
released from the commit path.

Mingi Cho originally reported this issue in a different path in 6.1.x
with a pipapo set with low timeouts which is not possible upstream since
7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set
element timeout").

Fix this by setting on the dead flag for anonymous sets to skip async gc
in this case.

According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on
transaction abort"), Florian plans to accelerate abort path by releasing
objects via workqueue, therefore, this sets on the dead flag for abort
path too.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/291cca35818bd52a407bc37ab45a15816039e363; https://git.kernel.org/stable/c/406b0241d0eb598a0b330ab20ae325537d8d8163; https://git.kernel.org/stable/c/5224afbc30c3ca9ba23e752f0f138729b2c48dd8
CVE: CVE-2024-29732
Published: 2024-03-21
Description: A SQL Injection has been found on SCAN_VISIO eDocument Suite Web Viewer of Abast. This vulnerability allows an unauthenticated user to retrieve, update and delete all the information of database. This vulnerability was found on login page via "user" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-scanvisio-edocument-suite-web-viewer-abast; https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-scanvisio-edocument-suite-web-viewer-abast
CVE: CVE-2024-1394
Published: 2024-03-21
Description: A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://access.redhat.com/errata/RHSA-2024:1462; https://access.redhat.com/errata/RHSA-2024:1468; https://access.redhat.com/errata/RHSA-2024:1472
CVE: CVE-2024-28834
Published: 2024-03-21
Description: A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://access.redhat.com/errata/RHSA-2024:1784; https://access.redhat.com/errata/RHSA-2024:1879; https://access.redhat.com/errata/RHSA-2024:1997
CVE: CVE-2024-29866
Published: 2024-03-21
Description: Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System privileges.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://datalust.co; https://github.com/datalust/seq-tickets/issues/2127; https://datalust.co