deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39487
Published: 2024-07-09
Description: In the Linux kernel, the following vulnerability has been resolved:

bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()

In function bond_option_arp_ip_targets_set(), if newval->string is an
empty string, newval->string+1 will point to the byte after the
string, causing an out-of-bound read.

BUG: KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418
Read of size 1 at addr ffff8881119c4781 by task syz-executor665/8107
CPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xc1/0x5e0 mm/kasan/report.c:475
 kasan_report+0xbe/0xf0 mm/kasan/report.c:588
 strlen+0x7d/0xa0 lib/string.c:418
 __fortify_strlen include/linux/fortify-string.h:210 [inline]
 in4_pton+0xa3/0x3f0 net/core/utils.c:130
 bond_option_arp_ip_targets_set+0xc2/0x910
drivers/net/bonding/bond_options.c:1201
 __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767
 __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792
 bond_opt_tryset_rtnl+0xda/0x160 drivers/net/bonding/bond_options.c:817
 bonding_sysfs_store_option+0xa1/0x120 drivers/net/bonding/bond_sysfs.c:156
 dev_attr_store+0x54/0x80 drivers/base/core.c:2366
 sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334
 call_write_iter include/linux/fs.h:2020 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x96a/0xd80 fs/read_write.c:584
 ksys_write+0x122/0x250 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
---[ end trace ]---

Fix it by adding a check of string length before using it.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/6a8a4fd082c439e19fede027e80c79bc4c84bb8e; https://git.kernel.org/stable/c/6b21346b399fd1336fe59233a17eb5ce73041ee1; https://git.kernel.org/stable/c/707c85ba3527ad6aa[PII_REDACTED]6b0f1ff835d7b
CVE: CVE-2023-38047
Published: 2024-07-09
Description: A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
CVSS Score: 8.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-38048
Published: 2024-07-09
Description: A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete a privileged user (provider). This results in unauthorized access and unauthorized data manipulation.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-38049
Published: 2024-07-09
Description: A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-38050
Published: 2024-07-09
Description: A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-38051
Published: 2024-07-09
Description: A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary). This results in unauthorized access and unauthorized data manipulation.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-38052
Published: 2024-07-09
Description: A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin). This results in unauthorized access and unauthorized data manipulation.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-38053
Published: 2024-07-09
Description: A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low privileged user to fetch, modify or delete the settings of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-38054
Published: 2024-07-09
Description: A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-38055
Published: 2024-07-09
Description: A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-3286
Published: 2024-07-09
Description: A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user (secretary) in the system. This results in unauthorized data manipulation.
CVSS Score: 7.7 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-3287
Published: 2024-07-09
Description: A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-3288
Published: 2024-07-09
Description: A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation.
CVSS Score: 8.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-3289
Published: 2024-07-09
Description: A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthorized data manipulation.
CVSS Score: 7.7 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2023-3290
Published: 2024-07-09
Description: A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2024-37410
Published: 2024-07-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder.This issue affects PowerPack Lite for Beaver Builder: from n/a through <= 1.3.0.3.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/powerpack-addon-for-beaver-builder/vulnerability/wordpress-powerpack-lite-for-beaver-builder-plugin-1-3-0-3-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/powerpack-addon-for-beaver-builder/wordpress-powerpack-lite-for-beaver-builder-plugin-1-3-0-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-37418
Published: 2024-07-09
Description: Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-4-4-6-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-4-4-6-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-37419
Published: 2024-07-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Codeless Cowidgets – Elementor Addons allows Path Traversal.This issue affects Cowidgets – Elementor Addons: from n/a through 1.1.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/cowidgets-elementor-addons/wordpress-cowidgets-elementor-addons-plugin-1-1-1-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cowidgets-elementor-addons/wordpress-cowidgets-elementor-addons-plugin-1-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-37420
Published: 2024-07-09
Description: Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affects Zita Elementor Site Library: from n/a through 1.6.1.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/zita-site-library/wordpress-zita-elementor-site-library-plugin-1-6-1-arbitrary-code-execution-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zita-site-library/wordpress-zita-elementor-site-library-plugin-1-6-1-arbitrary-code-execution-vulnerability?_s_id=cve
CVE: CVE-2024-37424
Published: 2024-07-09
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspack Blocks: from n/a through 3.0.8.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/newspack-blocks/wordpress-newspack-blocks-plugin-3-0-8-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/newspack-blocks/wordpress-newspack-blocks-plugin-3-0-8-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-37430
Published: 2024-07-09
Description: Authentication Bypass by Spoofing vulnerability in patreon Patreon WordPress patreon-connect.This issue affects Patreon WordPress: from n/a through <= 1.9.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://patchstack.com/database/Wordpress/Plugin/patreon-connect/vulnerability/wordpress-patreon-wordpress-plugin-1-9-0-image-protection-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/patreon-connect/wordpress-patreon-wordpress-plugin-1-9-0-image-protection-bypass-vulnerability?_s_id=cve
CVE: CVE-2024-37437
Published: 2024-07-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor.This issue affects Elementor Website Builder: from n/a through <= 3.22.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-22, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elementor/vulnerability/wordpress-elementor-website-builder-more-than-just-a-page-builder-plugin-3-22-1-arbitrary-file-download-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-website-builder-more-than-just-a-page-builder-plugin-3-22-1-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2024-37442
Published: 2024-07-09
Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1.
CVSS Score: 3.8 (LOW)
CWE: CWE-74
References: https://patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-7-1-html-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-7-1-html-injection-vulnerability?_s_id=cve
CVE: CVE-2024-37454
Published: 2024-07-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AWSM Innovations AWSM Team allows Path Traversal.This issue affects AWSM Team: from n/a through 1.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/awsm-team/wordpress-awsm-team-team-showcase-plugin-plugin-1-3-1-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/awsm-team/wordpress-awsm-team-team-showcase-plugin-plugin-1-3-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-37455
Published: 2024-07-09
Description: Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/ultimate-elementor/wordpress-ultimate-addons-for-elementor-plugin-1-36-31-privilege-escalation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-elementor/wordpress-ultimate-addons-for-elementor-plugin-1-36-31-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-37462
Published: 2024-07-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows Path Traversal.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/ultimate-bootstrap-elements-for-elementor/wordpress-ultimate-bootstrap-elements-for-elementor-plugin-1-4-2-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-bootstrap-elements-for-elementor/wordpress-ultimate-bootstrap-elements-for-elementor-plugin-1-4-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-4862
Published: 2024-07-09
Description: The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37945 may be a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/accordion.php#L868; https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/business_hours.php#L560; https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/logo_grid.php#L716
CVE: CVE-2024-5631
Published: 2024-07-09
Description: Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote control service without using any encryption. This enables an on-path attacker to eavesdrop the credentials and subsequently obtain access to the video stream. 
The credentials are being sent when a user decides to change his password in router's portal.
CWE: CWE-319
References: https://cert.pl/en/posts/2024/07/CVE-2024-5631/; https://cert.pl/posts/2024/07/CVE-2024-5631; https://zamel.com/pl/gardi/zestaw-monitoringu-bezprzewodowego-wi-fi-typ-zmb-01
CVE: CVE-2024-5632
Published: 2024-07-09
Description: Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with a default password.
A user is neither advised to change it during the installation process, nor such a need is described in the manual. As the cameras from the same kit connect automatically, it is very probable for the default password to be left unchanged.
CWE: CWE-1392
References: https://cert.pl/en/posts/2024/07/CVE-2024-5631/; https://cert.pl/posts/2024/07/CVE-2024-5631/; https://zamel.com/pl/gardi/zestaw-monitoringu-bezprzewodowego-wi-fi-typ-zmb-01
CVE: CVE-2024-5633
Published: 2024-07-09
Description: Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the same local network to an undocumented binary service CoolView on one of the ports. 
An attacker with a knowledge of the available commands is able to perform read/write operations on the device's memory, which might result in e.g. bypassing telnet login and obtaining full access to the device.
CWE: CWE-912
References: https://cert.pl/en/posts/2024/07/CVE-2024-5631/; https://cert.pl/posts/2024/07/CVE-2024-5631/; https://zamel.com/pl/gardi/zestaw-monitoringu-bezprzewodowego-wi-fi-typ-zmb-01
CVE: CVE-2024-5634
Published: 2024-07-09
Description: Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. Once the pattern is known, brute-forcing the password becomes relatively easy. 
Additionally, every camera with the same firmware version shares the same password.
CWE: CWE-1391
References: https://cert.pl/en/posts/2024/07/CVE-2024-5631/; https://cert.pl/posts/2024/07/CVE-2024-5631/; https://zamel.com/pl/gardi/zestaw-monitoringu-bezprzewodowego-wi-fi-typ-zmb-01
CVE: CVE-2024-5946
Published: 2024-07-09
Description: The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tab’ shortcode in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/squelch-tabs-and-accordions-shortcodes/trunk/squelch-tabs-and-accordions.php#L455; https://plugins.trac.wordpress.org/changeset/3114198/; https://www.wordfence.com/threat-intel/vulnerabilities/id/33f63bd9-3031-40e8-b72e-1cbbcce5b782?source=cve
CVE: CVE-2022-45147
Published: 2024-07-09
Description: A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://cert-portal.siemens.com/productcert/html/ssa-825651.html; https://cert-portal.siemens.com/productcert/html/ssa-825651.html
CVE: CVE-2023-32735
Published: 2024-07-09
Description: A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 7), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2), SIMATIC STEP 7 V16 (All versions < V16 Update 7), SIMATIC STEP 7 V17 (All versions < V17 Update 7), SIMATIC STEP 7 V18 (All versions < V18 Update 2), SIMATIC WinCC Unified V16 (All versions < V16 Update 7), SIMATIC WinCC Unified V17 (All versions < V17 Update 7), SIMATIC WinCC Unified V18 (All versions < V18 Update 2), SIMATIC WinCC V16 (All versions < V16.7), SIMATIC WinCC V17 (All versions < V17.7), SIMATIC WinCC V18 (All versions < V18 Update 2), SIMOCODE ES V16 (All versions < V16 Update 7), SIMOCODE ES V17 (All versions < V17 Update 7), SIMOCODE ES V18 (All versions < V18 Update 2), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SINAMICS Startdrive V16 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SIRIUS Safety ES V17 (All versions < V17 Update 7), SIRIUS Safety ES V18 (All versions < V18 Update 2), SIRIUS Soft Starter ES V17 (All versions < V17 Update 7), SIRIUS Soft Starter ES V18 (All versions < V18 Update 2), Soft Starter ES V16 (All versions < V16 Update 7), TIA Portal Cloud V3.0 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing hardware configuration profiles. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502
References: https://cert-portal.siemens.com/productcert/html/ssa-779936.html; https://cert-portal.siemens.com/productcert/html/ssa-779936.html
CVE: CVE-2023-32737
Published: 2024-07-09
Description: A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://cert-portal.siemens.com/productcert/html/ssa-313039.html; https://cert-portal.siemens.com/productcert/html/ssa-313039.html
CVE: CVE-2023-52238
Published: 2024-07-09
Description: A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0). The web server of the affected systems leaks the MACSEC key in clear text to a logged in user. An attacker with the credentials of a low privileged user could retrieve the MACSEC key and access (decrypt) the ethernet frames sent by authorized recipients.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://cert-portal.siemens.com/productcert/html/ssa-170375.html; https://cert-portal.siemens.com/productcert/html/ssa-170375.html