deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-33309
Published: 2024-04-30
Description: An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information via an insecure API endpoint. NOTE: this is disputed as discussed in the msn-official/CVE-Evidence repository.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/aaravavi/TVS-Connect-Application-VAPT; https://github.com/aaravavi/TVS-Connect-Application-VAPT/tree/main; https://github.com/msn-official/CVE-Evidence
CVE: CVE-2024-33465
Published: 2024-04-30
Description: Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://hbzms.github.io/; https://hbzms.github.io/
CVE: CVE-2024-4340
Published: 2024-04-30
Description: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.


CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/advisories/GHSA-2m57-hf25-phgg; https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03; https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2[PII_REDACTED]92/
CVE: CVE-2024-29320
Published: 2024-04-30
Description: Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/ellite/Wallos; https://github.com/ellite/Wallos/releases/tag/v1.15.3; https://injasec.com/open-source-software-oss/cve-2024-29320-sql-injection-in-wallos/
CVE: CVE-2024-23463
Published: 2024-04-30
Description: Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zscaler Client Connector on Windows prior to 4.2.1

CVSS Score: 8.8 (HIGH)
CWE: CWE-367
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
CVE: CVE-2019-19751
Published: 2024-04-30
Description: easyMINE before 2019-12-05 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-300
References: https://blog.easymine.io; https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html; https://blog.easymine.io
CVE: CVE-2019-19752
Published: 2024-04-30
Description: nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://github.com/papampi/nvOC_by_fullzero_Community_Release/commits/release; https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html; https://github.com/papampi/nvOC_by_fullzero_Community_Release/commits/release
CVE: CVE-2019-19753
Published: 2024-04-30
Description: SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: the vendor indicated that they have no plans to fix this, and discourage deployment using public IPv4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-321
References: https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html; https://simplemining.net/page/changelog; https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html
CVE: CVE-2019-19754
Published: 2024-04-30
Description: HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-09-26, the vendor indicated that they would consider fixing this.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-321
References: https://hiveos.farm/changelog/; https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html; https://hiveos.farm/changelog/
CVE: CVE-2019-19755
Published: 2024-04-30
Description: ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated that they plan to fix this.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: http://ethosdistro.com/changelog/; https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html; http://ethosdistro.com/changelog/
CVE: CVE-2020-5200
Published: 2024-04-30
Description: Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io.
CVSS Score: 5.9 (MEDIUM)
References: https://en.minerbabe.com/pc.html/#/helps/updateLog; https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html; https://en.minerbabe.com/pc.html/#/helps/updateLog
CVE: CVE-2023-36268
Published: 2024-04-30
Description: Rejected reason: DoS issues, or unexploitable crashes, are out of scope for vulnerabilities.
CVE: CVE-2024-33101
Published: 2024-04-30
Description: A stored cross-site scripting (XSS) vulnerability in the component /action/anti.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the word parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/thinksaas/ThinkSAAS/issues/34; https://github.com/thinksaas/ThinkSAAS/issues/34
CVE: CVE-2024-33102
Published: 2024-04-30
Description: A stored cross-site scripting (XSS) vulnerability in the component /pubs/counter.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thinksaas/ThinkSAAS/issues/35; https://github.com/thinksaas/ThinkSAAS/issues/35
CVE: CVE-2024-33103
Published: 2024-04-30
Description: An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by uploading a crafted SVG file. NOTE: as noted in the 4267 issue reference, there is a position that exploitability can only occur with a misconfiguration of the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dokuwiki/dokuwiki/issues/4267; https://github.com/dokuwiki/dokuwiki/issues/4267
CVE: CVE-2024-33831
Published: 2024-04-30
Description: A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field.
CVSS Score: 7.4 (HIGH)
CWE: CWE-80
References: https://github.com/YMFE/yapi/issues/2745; https://github.com/YMFE/yapi/issues/2745
CVE: CVE-2024-33832
Published: 2024-04-30
Description: OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_info.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/helloxz/onenav/issues/186; https://github.com/helloxz/onenav/issues/186
CVE: CVE-2020-27478
Published: 2024-04-30
Description: Cross Site Scripting vulnerability found in Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 thru[PII_REDACTED]c70b[PII_REDACTED]e01b19dbf11505a7 allows a remote attacker to execute arbitrary code via a crafted script to the search bar feature.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/simplcommerce/SimplCommerce/issues/943; https://github.com/simplcommerce/SimplCommerce/issues/943
CVE: CVE-2023-49473
Published: 2024-04-30
Description: Shenzhen JF6000 Cloud Media Collaboration Processing Platform firmware version V1.2.0 and software version V2.0.0 build 6245 is vulnerable to Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/Hack404-007/cves-info/blob/main/JF6000-exp; https://github.com/Hack404-007/cves-info/blob/main/JF6000-exp
CVE: CVE-2023-50053
Published: 2024-04-30
Description: An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce (random number)
CVSS Score: 7.6 (HIGH)
CWE: CWE-359
References: https://github.com/d0scoo1/Web3AuthRA; https://github.com/d0scoo1/Web3AuthRA
CVE: CVE-2023-50059
Published: 2024-04-30
Description: An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce (random number)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-338
References: https://galxe.com/; https://galxe.com/
CVE: CVE-2024-22546
Published: 2024-04-30
Description: TRENDnet TEW-815DAP 1.0.2.0 is vulnerable to Command Injection via the do_setNTP function. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious POST request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-77
References: https://warp-desk-89d.notion.site/TEW-815DAP-94a631c20dee4f399268dbcc880f1f4c; https://www.trendnet.com/support/support-detail.asp?prod=105_TEW-815DAP; https://warp-desk-89d.notion.site/TEW-815DAP-94a631c20dee4f399268dbcc880f1f4c
CVE: CVE-2024-26331
Published: 2024-04-30
Description: ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attackers can easily modify the cookie value, within a browser or by implementing client-side code outside of a browser. Attackers can bypass the authentication mechanism by modifying the cookie to contain an expected value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/; https://www.recrystallize.com/merchant/ReCrystallize-Server-for-Crystal-Reports.htm; https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/
CVE: CVE-2024-28269
Published: 2024-04-30
Description: ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server. The file upload is not restricted, leading to the ability to upload of malicious files. This could result in a Remote Code Execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/; https://www.recrystallize.com/merchant/ReCrystallize-Server-for-Crysta; https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/
CVE: CVE-2024-34088
Published: 2024-04-30
Description: In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value, the OSPF daemon crashes, leading to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/FRRouting/frr/pull/15674/commits/34d704fb0ea60dc5063af477a2c11d4884984d4f; https://github.com/FRRouting/frr/pull/15674/commits/34d704fb0ea60dc5063af477a2c11d4884984d4f
CVE: CVE-2024-3411
Published: 2024-04-30
Description: Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-331
References: https://kb.cert.org/vuls/id/163057; https://www.dell.com/support/kbdoc/en-US/000226504/dsa-2024-295-security-update-for-dell-idrac8-ipmi-session-vulnerability; https://www.intel.la/content/dam/www/public/us/en/documents/specification-updates/ipmi-intelligent-platform-mgt-interface-spec-2nd-gen-v2-0-spec-update.pdf
CVE: CVE-2024-29384
Published: 2024-04-30
Description: An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information via the content.js and parseCSSRules functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/mlgualtieri/CSS-Exfil-Protection/issues/41; https://github.com/randshell/vulnerability-research/tree/main/CVE-2024-29384; https://github.com/mlgualtieri/CSS-Exfil-Protection/issues/41
CVE: CVE-2024-33332
Published: 2024-04-30
Description: An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/wy876/cve/issues/3; https://github.com/wy876/cve/issues/3
CVE: CVE-2024-33371
Published: 2024-04-30
Description: Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the makehtml_list_action.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/zchuanwen/cve/issues/I9HQRY; https://gitee.com/zchuanwen/cve/issues/I9HQRY
CVE: CVE-2024-33383
Published: 2024-04-30
Description: Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://juvl1ne.github.io/2024/04/18/novel-plus-vulnerability/; https://juvl1ne.github.io/2024/04/18/novel-plus-vulnerability/
CVE: CVE-2024-33436
Published: 2024-04-30
Description: An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information due to missing support for CSS variables
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/mlgualtieri/CSS-Exfil-Protection/issues/41; https://github.com/randshell/vulnerability-research/tree/main/CVE-2024-33436; https://github.com/mlgualtieri/CSS-Exfil-Protection/issues/41
CVE: CVE-2024-33437
Published: 2024-04-30
Description: An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information due to missing support for CSS Style Rules.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/mlgualtieri/CSS-Exfil-Protection/issues/41; https://github.com/randshell/vulnerability-research/tree/main/CVE-2024-33437; https://github.com/mlgualtieri/CSS-Exfil-Protection/issues/41
CVE: CVE-2024-3746
Published: 2024-04-30
Description: The entire parent directory - C:\ScadaPro and its sub-directories and 
files are configured by default to allow user, including unprivileged 
users, to write or overwrite files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-01
CVE: CVE-2024-29466
Published: 2024-04-30
Description: Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-26
References: https://gist.github.com/Xiqinger/b3cb51f390d408c3c66c66e645ba5ac0; https://gist.github.com/Xiqinger/b3cb51f390d408c3c66c66e645ba5ac0
CVE: CVE-2024-4348
Published: 2024-04-30
Description: A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262488. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://vuldb.com/?ctiid.262488; https://vuldb.com/?id.262488; https://vuldb.com/?submit.320855
CVE: CVE-2024-32970
Published: 2024-04-30
Description: Phlex is a framework for building object-oriented views in Ruby. In affected versions there is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. Since the last two vulnerabilities https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g and https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c, we have invested in extensive browser tests. It was these new tests that helped us uncover these issues. As of now the project exercises every possible attack vector the developers can think of — including enumerating every ASCII character, and we run these tests in Chrome, Firefox and Safari. Additionally, we test against a list of 6613 known XSS payloads (see: payloadbox/xss-payload-list). The reason these issues were not detected before is the escapes were working as designed. However, their design didn't take into account just how recklessly permissive browsers are when it comes to executing unsafe JavaScript via HTML attributes. If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user. If you splat user-provided attributes when rendering any HTML or SVG tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user. Patches are available on RubyGems for all minor versions released in the last year. Users are advised to upgrade. Users unable to upgrade should configure a Content Security Policy that does not allow `unsafe-inline` which would effectively prevent this vulnerability from being exploited. Users who upgrade are also advised to configure a Content Security Policy header that does not allow `unsafe-inline`.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy; https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline; https://github.com/payloadbox/xss-payload-list
CVE: CVE-2024-34149
Published: 2024-04-30
Description: In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2023-50428. NOTE: some parties oppose this new limit check (for example, because they agree with the objective but disagree with the technical mechanism, or because they have a different objective).
CVSS Score: 6.3 (MEDIUM)
References: https://github.com/bitcoin/bitcoin/pull/29769; https://github.com/bitcoin/bitcoin/pull/29769
CVE: CVE-2024-4192
Published: 2024-04-30
Description: 
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-121-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-121-01
CVE: CVE-2024-4349
Published: 2024-04-30
Description: A vulnerability has been found in SourceCodester Pisay Online E-Learning System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /lesson/controller.php. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262489 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://github.com/CveSecLook/cve/issues/19; https://vuldb.com/?ctiid.262489; https://vuldb.com/?id.262489
CVE: CVE-2024-4369
Published: 2024-05-01
Description: An information disclosure flaw was found in OpenShift's internal image registry operator. The AZURE_CLIENT_SECRET can be exposed through an environment variable defined in the pod definition, but is limited to Azure environments. An attacker controlling an account that has high enough permissions to obtain pod information from the openshift-image-registry namespace could use this obtained client secret to perform actions as the registry operator's Azure service account.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-526
References: https://access.redhat.com/errata/RHSA-2024:3881; https://access.redhat.com/errata/RHSA-2024:3889; https://access.redhat.com/security/cve/CVE-2024-4369
CVE: CVE-2024-33763
Published: 2024-05-01
Description: lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg; https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg
CVE: CVE-2024-33764
Published: 2024-05-01
Description: lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg; https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg
CVE: CVE-2024-33766
Published: 2024-05-01
Description: lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-369
References: https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg; https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg
CVE: CVE-2024-33767
Published: 2024-05-01
Description: lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg; https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg
CVE: CVE-2024-33768
Published: 2024-05-01
Description: lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-653
References: https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg; https://github.com/keepinggg/poc/tree/main/poc_of_lunasvg
CVE: CVE-2024-28978
Published: 2024-05-01
Description: Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. A high privileged remote attacker could potentially exploit this vulnerability, leading to unauthorized access to resources.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000224641/dsa-2024-201-security-update-for-dell-openmanage-enterprise-vulnerability; https://www.dell.com/support/kbdoc/en-us/000224641/dsa-2024-201-security-update-for-dell-openmanage-enterprise-vulnerability
CVE: CVE-2024-28979
Published: 2024-05-01
Description: Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000224642/dsa-2024-202-security-update-for-dell-openmanage-enterprise-vulnerability; https://www.dell.com/support/kbdoc/en-us/000224642/dsa-2024-202-security-update-for-dell-openmanage-enterprise-vulnerability