deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-30314
Published: 2024-05-28
Description: An issue discovered in 360 V6G, 360 T5G, 360 T6M, and 360 P1 routers allows attackers to hijack TCP sessions which could lead to a denial of service.
CVSS Score: 6.5 (MEDIUM)
References: https://www.ndss-symposium.org/ndss-paper/exploiting-sequence-number-leakage-tcp-hijacking-in-nat-enabled-wi-fi-networks/; https://www.ndss-symposium.org/ndss-paper/exploiting-sequence-number-leakage-tcp-hijacking-in-nat-enabled-wi-fi-networks/
CVE: CVE-2024-23579
Published: 2024-05-28
Description: HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover some or all encrypted values.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113496; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113496
CVE: CVE-2024-23580
Published: 2024-05-28
Description: HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access to the database to recover some or all encrypted values.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113496; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113496
CVE: CVE-2024-36112
Published: 2024-05-28
Description: Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI view (`/extras/dynamic-groups/<uuid>/`) and/or the members REST API view (`/api/extras/dynamic-groups/<uuid>/members/`) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's `dcim.view_device` permissions or lack thereof. This issue has been fixed in Nautobot versions 1.6.23 and 2.2.5. Users are advised to upgrade. This vulnerability can be partially mitigated by removing `extras.view_dynamicgroup` permission from users however a full fix will require upgrading.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://github.com/nautobot/nautobot/pull/5757; https://github.com/nautobot/nautobot/pull/5762; https://github.com/nautobot/nautobot/security/advisories/GHSA-qmjf-wc2h-6x3q
CVE: CVE-2024-5437
Published: 2024-05-29
Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as problematic. Affected is the function save_category of the file /admin/index.php?page=categories. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266442 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/pijiawei/CVE/blob/pijiawei-photo/SourceCodester%20Simple%20Online%20Bidding%20System%20XSS.md; https://vuldb.com/?ctiid.266442; https://vuldb.com/?id.266442
CVE: CVE-2024-5150
Published: 2024-05-29
Description: The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user email. The vulnerability is patched in version 1.7.26, but there is an issue in the patch that causes the entire function to not work, and this issue is fixed in version 1.7.27.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4183; https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4220; https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4241
CVE: CVE-2024-5204
Published: 2024-05-29
Description: The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.7. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for authenticated attackers with contributor-level and above permissions to log in as any existing user on the site, such as an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/swiss-toolkit-for-wp/trunk/includes/plugins/class-boomdevs-swiss-toolkit-generate-login-url.php?rev=3077000#L50; https://plugins.trac.wordpress.org/changeset/3091913/swiss-toolkit-for-wp; https://www.wordfence.com/threat-intel/vulnerabilities/id/a8526106-847a-420f-9275-f759a8dd4dfb?source=cve
CVE: CVE-2024-0434
Published: 2024-05-29
Description: The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ttbm_new_place_save' function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to create and publish new place posts. This function is also vulnerable to CSRF.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/tour-booking-manager/trunk/admin/settings/tour/TTBM_Settings_place_you_see.php#L225; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3092969%40tour-booking-manager%2Ftrunk&old=3091912%40tour-booking-manager%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e84d3e22-8568-4bdb-be9b-ffe78c69ec24?source=cve
CVE: CVE-2023-6743
Published: 2024-05-29
Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import functionality. This makes it possible for authenticated attackers, with contributor access and above, to execute code on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1336, CWE-94
References: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_output.class.php#L1765; https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/core/plugins/unlimited_elements/elementor/elementor_widget.class.php#L3948; https://plugins.trac.wordpress.org/changeset/3010986/unlimited-elements-for-elementor#file6
CVE: CVE-2024-21512
Published: 2024-05-29
Description: Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a; https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc; https://github.com/sidorares/node-mysql2/pull/2702
CVE: CVE-2024-4611
Published: 2024-05-29
Description: The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCookieAuth' functions in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they previously used the login via the plugin API. This can only be exploited if the 'openssl' php extension is not loaded on the server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-703, CWE-754
References: https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_Theme_Switcher.php?rev=2456516#L133; https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_Theme_Switcher.php?rev=2456516#L167; https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_User.php?rev=2789173#L40
CVE: CVE-2024-3050
Published: 2024-05-29
Description: The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking
CVSS Score: 9.1 (CRITICAL)
References: https://wpscan.com/vulnerability/04c1581e-fd36-49d4-8463-b49915d4b1ac/; https://wpscan.com/vulnerability/04c1581e-fd36-49d4-8463-b49915d4b1ac/
CVE: CVE-2024-3921
Published: 2024-05-29
Description: The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3c114e14-9113-411d-91f3-2e2daeb40739/; https://wpscan.com/vulnerability/3c114e14-9113-411d-91f3-2e2daeb40739/
CVE: CVE-2024-3937
Published: 2024-05-29
Description: The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0cd5b288-05b3-48b7-9245-f59ce7377861/; https://wpscan.com/vulnerability/0cd5b288-05b3-48b7-9245-f59ce7377861/
CVE: CVE-2024-4419
Published: 2024-05-29
Description: The Fetch JFT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3089669%40fetch-jft%2Ftrunk&old=3025839%40fetch-jft%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5aca31f5-310f-441b-8d8c-51b7bf2b0b7d?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3089669%40fetch-jft%2Ftrunk&old=3025839%40fetch-jft%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-36014
Published: 2024-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/arm/malidp: fix a possible null pointer dereference

In malidp_mw_connector_reset, new memory is allocated with kzalloc, but
no check is performed. In order to prevent null pointer dereferencing,
ensure that mw_state is checked before calling
__drm_atomic_helper_connector_reset.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/335cc45ef2b81b68be63c698b4f867a530bdf7a5; https://git.kernel.org/stable/c/3e54d4e[PII_REDACTED]6dfe91a6c49f116a9f68490; https://git.kernel.org/stable/c/565d9ad7e5a18eb69ed8b66a9e9bb3f45346520c
CVE: CVE-2024-36015
Published: 2024-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ppdev: Add an error check in register_device

In register_device, the return value of ida_simple_get is unchecked,
in witch ida_simple_get will use an invalid index value.

To address this issue, index should be checked after ida_simple_get. When
the index value is abnormal, a warning message should be printed, the port
should be dropped, and the value should be recorded.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/5d5b24edad1107a2ffa99058f20f6aeeafeb5d39; https://git.kernel.org/stable/c/65cd017d43f4319a56747d38308b0a24cf57299e; https://git.kernel.org/stable/c/b65d0410b879af0295d22438a4a32012786d152a
CVE: CVE-2024-5086
Published: 2024-05-29
Description: The Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team Member Carousel widget in all Pro versions up to, and including, 5.8.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://essential-addons.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f7773b98-537f-4f4e-98d6-db61d2bffe8c?source=cve; https://essential-addons.com/changelog/
CVE: CVE-2024-3412
Published: 2024-05-29
Description: The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/3076275/wp-staging/trunk/Framework/Network/AjaxBackupDownloader.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/8ebb1072-ea05-4914-961d-0d8f20248078?source=cve; https://plugins.trac.wordpress.org/changeset/3076275/wp-staging/trunk/Framework/Network/AjaxBackupDownloader.php
CVE: CVE-2024-28826
Published: 2024-05-29
Description: Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-73, CWE-610
References: https://checkmk.com/werk/15200; https://checkmk.com/werk/15200
CVE: CVE-2023-52881
Published: 2024-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

tcp: do not accept ACK of bytes we never sent

This patch is based on a detailed report and ideas from Yepeng Pan
and Christian Rossow.

ACK seq validation is currently following RFC 5961 5.2 guidelines:

   The ACK value is considered acceptable only if
   it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=
   SND.NXT).  All incoming segments whose ACK value doesn't satisfy the
   above condition MUST be discarded and an ACK sent back.  It needs to
   be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a
   duplicate (SEG.ACK < SND.UNA), it can be ignored.  If the ACK
   acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an
   ACK, drop the segment, and return".  The "ignored" above implies that
   the processing of the incoming data segment continues, which means
   the ACK value is treated as acceptable.  This mitigation makes the
   ACK check more stringent since any ACK < SND.UNA wouldn't be
   accepted, instead only ACKs that are in the range ((SND.UNA -
   MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.

This can be refined for new (and possibly spoofed) flows,
by not accepting ACK for bytes that were never sent.

This greatly improves TCP security at a little cost.

I added a Fixes: tag to make sure this patch will reach stable trees,
even if the 'blamed' patch was adhering to the RFC.

tp->bytes_acked was added in linux-4.2

Following packetdrill test (courtesy of Yepeng Pan) shows
the issue at hand:

0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0 bind(3, ..., ...) = 0
+0 listen(3, 1024) = 0

// ---------------- Handshake ------------------- //

// when window scale is set to 14 the window size can be extended to
// 65535 * (2^14) =[PII_REDACTED]. Linux would accept an ACK packet
// with ack number in (Server_ISN[PII_REDACTED]. Server_ISN+1)
// ,though this ack number acknowledges some data never
// sent by the server.

+0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14>
+0 > S. 0:0(0) ack 1 <...>
+0 < . 1:1(0) ack 1 win 65535
+0 accept(3, ..., ...) = 4

// For the established connection, we send an ACK packet,
// the ack packet uses ack number 1 -[PII_REDACTED] + 2^32,
// where 2^32 is used to wrap around.
// Note: we used[PII_REDACTED] instead of[PII_REDACTED] to avoid possible
// edge cases.
// 1 -[PII_REDACTED] + 2^32 =[PII_REDACTED]

// Oops, old kernels happily accept this packet.
+0 < . 1:1001(1000) ack[PII_REDACTED] win 65535

// After the kernel fix the following will be replaced by a challenge ACK,
// and prior malicious frame would be dropped.
+0 > . 1:1(0) ack 1001
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440; https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fc; https://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757
CVE: CVE-2024-27313
Published: 2024-05-29
Description: Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version 6610.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27313.html; https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27313.html
CVE: CVE-2023-42005
Published: 2024-05-29
Description: IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a user with access to the Kubernetes pod, to make system calls compromising the security of containers. IBM X-Force ID: 265264.
CVSS Score: 7.4 (HIGH)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265264; https://www.ibm.com/support/pages/node/7155078; https://exchange.xforce.ibmcloud.com/vulnerabilities/265264
CVE: CVE-2024-25976
Published: 2024-05-29
Description: When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of "$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2024/May/34; https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1; https://r.sec-consult.com/hawki
CVE: CVE-2024-25977
Published: 2024-05-29
Description: The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.
CVSS Score: 7.3 (HIGH)
CWE: CWE-384
References: http://seclists.org/fulldisclosure/2024/May/34; https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1; https://r.sec-consult.com/hawki
CVE: CVE-2024-5039
Published: 2024-05-29
Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/views/woof.php#L525; https://plugins.trac.wordpress.org/changeset/3093324/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6e7fcd-f5f5-47a0-9d8a-74e2f67d10b5?source=cve
CVE: CVE-2024-5185
Published: 2024-05-29
Description: The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromised, leading to unauthorized entries or data poisoning attacks, which are delivered by a CSRF vulnerability due to the absence of a secure session management implementation and weak CORS policies weakness. An attacker can direct a user to a malicious webpage that exploits a CSRF vulnerability within the EmbedAI application. By leveraging this CSRF vulnerability, the attacker can deceive the user into inadvertently uploading and integrating incorrect data into the application’s language model.
CVSS Score: 7.3 (HIGH)
CWE: CWE-352
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-data-poisoning-embedai.html; https://www.synopsys.com/blogs/software-security/cyrc-advisory-data-poisoning-embedai.html
CVE: CVE-2024-25975
Published: 2024-05-29
Description: The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: http://seclists.org/fulldisclosure/2024/May/34; https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1; https://r.sec-consult.com/hawki
CVE: CVE-2024-36362
Published: 2024-05-29
Description: In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-36363
Published: 2024-05-29
Description: In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-36364
Published: 2024-05-29
Description: In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-36365
Published: 2024-05-29
Description: In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-36366
Published: 2024-05-29
Description: In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/