deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5852
Published: 2024-11-26
Description: An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'
CVSS Score: 8.4 (HIGH)
CWE: CWE-126, CWE-191
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html
CVE: CVE-2024-11691
Published: 2024-11-26
Description: Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver.  
*This bug only affected the application on Apple M series hardware. Other platforms were unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1914707; https://bugzilla.mozilla.org/show_bug.cgi?id=1924184; https://www.mozilla.org/security/advisories/mfsa2024-63/
CVE: CVE-2024-11692
Published: 2024-11-26
Description: An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1909535; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-64/
CVE: CVE-2024-11693
Published: 2024-11-26
Description: The executable file warning was not presented when downloading .library-ms files.  
*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Score: 9.8 (CRITICAL)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1921458; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-64/
CVE: CVE-2024-11694
Published: 2024-11-26
Description: Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1924167; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-64/
CVE: CVE-2024-11695
Published: 2024-11-26
Description: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1925496; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-64/
CVE: CVE-2024-11696
Published: 2024-11-26
Description: The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed.  Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-347
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1929600; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-64/
CVE: CVE-2024-11697
Published: 2024-11-26
Description: When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1842187; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-64/
CVE: CVE-2024-11698
Published: 2024-11-26
Description: A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit fullscreen mode using standard actions like pressing "Esc" or accessing right-click menus, resulting in a disrupted browsing experience until the browser is restarted.  
*This bug only affects the application when running on macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Score: 9.8 (CRITICAL)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1916152; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-64/
CVE: CVE-2024-11699
Published: 2024-11-26
Description: Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1880582%2C1929911; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-64/
CVE: CVE-2024-11700
Published: 2024-11-26
Description: Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. This vulnerability affects Firefox < 133 and Thunderbird < 133.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1836921; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-67/
CVE: CVE-2024-11701
Published: 2024-11-26
Description: The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133 and Thunderbird < 133.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1914797; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-67/
CVE: CVE-2024-11702
Published: 2024-11-26
Description: Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. This vulnerability affects Firefox < 133 and Thunderbird < 133.
CVSS Score: 7.5 (HIGH)
CWE: CWE-838
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1918884; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-67/
CVE: CVE-2024-11703
Published: 2024-11-26
Description: On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox < 133.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-522
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1928779; https://www.mozilla.org/security/advisories/mfsa2024-63/
CVE: CVE-2024-11704
Published: 2024-11-26
Description: A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption. This vulnerability affects Firefox < 133, Thunderbird < 133, Firefox ESR < 128.7, and Thunderbird < 128.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1899402; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-67/
CVE: CVE-2024-11705
Published: 2024-11-26
Description: `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows `phKey` to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 133.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-476
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1921768; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-67/
CVE: CVE-2024-11706
Published: 2024-11-26
Description: A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Util` function, when handling malformed or improperly formatted input files. This vulnerability affects Firefox < 133 and Thunderbird < 133.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1923767; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-67/
CVE: CVE-2024-11708
Published: 2024-11-26
Description: Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 and Thunderbird < 133.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1922912; https://www.mozilla.org/security/advisories/mfsa2024-63/; https://www.mozilla.org/security/advisories/mfsa2024-67/
CVE: CVE-2024-53975
Published: 2024-11-26
Description: Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appear secure. This vulnerability affects Firefox for iOS < 133.
CVSS Score: 5.4 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1843467; https://www.mozilla.org/security/advisories/mfsa2024-66/
CVE: CVE-2024-53976
Published: 2024-11-26
Description: Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the loaded webpage. This vulnerability affects Firefox for iOS < 133.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1905749; https://www.mozilla.org/security/advisories/mfsa2024-66/
CVE: CVE-2024-8236
Published: 2024-11-26
Description: The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/elementor/tags/3.23.4/includes/widgets/icon.php#L489; https://plugins.trac.wordpress.org/changeset/3192020/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b1305be5-8267-475f-b962-62e3930116e1?source=cve
CVE: CVE-2024-9461
Published: 2024-11-26
Description: The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://plugins.trac.wordpress.org/browser/boldgrid-backup/tags/1.16.5/admin/class-boldgrid-backup-admin-settings.php#L748; https://www.wordfence.com/threat-intel/vulnerabilities/id/804b42a0-1cea-4f68-bd4a-d292a9f23fbe?source=cve
CVE: CVE-2024-9928
Published: 2024-11-26
Description: A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could
cause account takeover and unauthorized access to the system
when an attacker conducts brute-force attacks against the
equipment login. Note that the system supports only one concurrent session and implements a delay of more than a second
between failed login attempts making it difficult to automate the
attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000173&LanguageCode=en&DocumentPartId=&Action=launch
CVE: CVE-2024-9929
Published: 2024-11-26
Description: A vulnerability exists in NSD570 that allows any authenticated
user to access all device logs disclosing login information with
timestamps.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000173&LanguageCode=en&DocumentPartId=&Action=launch
CVE: CVE-2024-22117
Published: 2024-11-26
Description: When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element.
CVSS Score: 2.2 (LOW)
CWE: CWE-20
References: https://support.zabbix.com/browse/ZBX-25610
CVE: CVE-2024-36463
Published: 2024-11-26
Description: The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-767
References: https://support.zabbix.com/browse/ZBX-25611
CVE: CVE-2024-52336
Published: 2024-11-26
Description: A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://access.redhat.com/errata/RHSA-2024:10384; https://access.redhat.com/errata/RHSA-2025:0879; https://access.redhat.com/errata/RHSA-2025:0880
CVE: CVE-2024-52337
Published: 2024-11-26
Description: A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be the ' character ending the spoofed input, and the administrator can easily overlook this. This logged string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or other third-party programs that use Tuned's D-Bus interface for such operations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2024:10381; https://access.redhat.com/errata/RHSA-2024:10384; https://access.redhat.com/errata/RHSA-2024:11161
CVE: CVE-2024-11177
Published: 2024-11-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-11407
Published: 2024-11-26
Description: There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791
CVSS Score: 7.5 (HIGH)
CWE: CWE-682
References: https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791
CVE: CVE-2024-53365
Published: 2024-11-26
Description: A stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.php. This vulnerability allows authenticated users to inject malicious XSS scripts into the profile name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://phpgurukul.com; https://github.com/SCR-athif/CVE/tree/main/CVE-2024-53365
CVE: CVE-2024-53555
Published: 2024-11-26
Description: A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://drive.google.com/file/d/1M4UjoTUqlPWLYjevCuE3WhdUqQkRj0-r/view?usp=drive_link; https://gist.githubusercontent.com/Tommywarren/bb1287d17ac83f2e277c0dea798f6ff7/raw/e21132dbaf81e210c2e1cb5babfc4dcca9b2c0d8/CVE-2024-53555
CVE: CVE-2024-10878
Published: 2024-11-26
Description: The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sugar-calendar-lite/tags/3.3.0/includes/common/Features/EventTicketing/includes/admin/orders-list-table.php#L50; https://plugins.trac.wordpress.org/changeset/3188760/sugar-calendar-lite/trunk/includes/common/Features/EventTicketing/includes/admin/orders-list-table.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b06cb3cf-e2da-4e18-9a09-c30cebddf5c2?source=cve
CVE: CVE-2024-51058
Published: 2024-11-26
Description: Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through <img> src tag, potentially exposing sensitive information.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-552
References: https://github.com/saravana-hackz/vulnerability-research/tree/main/CVE-2024-51058; https://github.com/tecnickcom/TCPDF; https://github.com/tecnickcom/TCPDF/commit/bfa7d2b6d455ebf72ebe3d48fbd487ee5a1f6f3b
CVE: CVE-2024-11668
Published: 2024-11-26
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-613
References: https://gitlab.com/gitlab-org/gitlab/-/issues/456922
CVE: CVE-2024-11669
Published: 2024-11-26
Description: An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/501528
CVE: CVE-2024-11828
Published: 2024-11-26
Description: A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-407
References: https://gitlab.com/gitlab-org/gitlab/-/issues/443559; https://hackerone.com/reports/2380264
CVE: CVE-2024-32965
Published: 2024-11-26
Description: Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf; https://github.com/lobehub/lobe-chat/security/advisories/GHSA-2xcc-vm3f-m8rw
CVE: CVE-2024-52008
Published: 2024-11-26
Description: Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the creation of accounts with passwords as short as a single character. When an email messaging provider is enabled and a new user account is created in the system, an invite email containing a special link is sent to the new user's email address. This link directs the new user to a page where they can set their initial password. While the user interface implements password complexity checks, these validations are only performed client-side. The underlying `/api/v1/user/accept-invite` API endpoint does not implement the same password policy validations. This vulnerability allows an invited user to set an extremely weak password for their own account during the initial account setup process. Therefore that specific user's account can be compromised easily by an attacker guessing or brute forcing the password. The vulnerability has been patched in Fides version `2.50.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-602
References: https://github.com/ethyca/fides/security/advisories/GHSA-v7vm-rhmg-8j2r