deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1512
Published: 2024-02-17
Description: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/3036794/masterstudy-lms-learning-management-system/trunk/_core/lms/classes/models/StmStatistics.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b6d824-51d3-4da9-a39a-b957368df4dc?source=cve; https://plugins.trac.wordpress.org/changeset/3036794/masterstudy-lms-learning-management-system/trunk/_core/lms/classes/models/StmStatistics.php
CVE: CVE-2023-50951
Published: 2024-02-17
Description: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts.  IBM X-Force ID:  275747.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275747; https://www.ibm.com/support/pages/node/7118604; https://exchange.xforce.ibmcloud.com/vulnerabilities/275747
CVE: CVE-2024-22335
Published: 2024-02-17
Description: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user.  IBM X-Force ID:  279975.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/279975; https://www.ibm.com/support/pages/node/7118642; https://exchange.xforce.ibmcloud.com/vulnerabilities/279975
CVE: CVE-2024-22336
Published: 2024-02-17
Description: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user.  IBM X-Force ID:  279976.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/279976; https://www.ibm.com/support/pages/node/7118642; https://exchange.xforce.ibmcloud.com/vulnerabilities/279976
CVE: CVE-2024-22337
Published: 2024-02-17
Description: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user.  IBM X-Force ID:  279977.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/279977; https://www.ibm.com/support/pages/node/7118642; https://exchange.xforce.ibmcloud.com/vulnerabilities/279977
CVE: CVE-2022-41737
Published: 2024-02-17
Description: IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a container outside the current namespace.  IBM X-Force ID:  237811.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237811; https://www.ibm.com/support/pages/node/7095312; https://exchange.xforce.ibmcloud.com/vulnerabilities/237811
CVE: CVE-2022-41738
Published: 2024-02-17
Description: IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks.  IBM X-Force ID:  237812.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237812; https://www.ibm.com/support/pages/node/7095312; https://exchange.xforce.ibmcloud.com/vulnerabilities/237812
CVE: CVE-2022-42443
Published: 2024-02-17
Description: An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may allow uploading of files.  IBM X-Force ID:  238535.
CVSS Score: 2.2 (LOW)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238535; https://www.ibm.com/support/pages/node/6967785; https://exchange.xforce.ibmcloud.com/vulnerabilities/238535
CVE: CVE-2024-25113
Published: 2024-02-17
Description: Rejected reason: This CVE was misassigned. See CVE-2023-47623 for the canonical reference.
CVE: CVE-2023-52097
Published: 2024-02-18
Description: Vulnerability of foreground service restrictions being bypassed in the NMS module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52357
Published: 2024-02-18
Description: Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52358
Published: 2024-02-18
Description: Vulnerability of configuration defects in some APIs of the audio module.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.2 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52360
Published: 2024-02-18
Description: Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-511
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]
CVE: CVE-2023-52361
Published: 2024-02-18
Description: The VerifiedBoot module has a vulnerability that may cause authentication errors.Successful exploitation of this vulnerability may affect integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52362
Published: 2024-02-18
Description: Permission management vulnerability in the lock screen module.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52363
Published: 2024-02-18
Description: Vulnerability of defects introduced in the design process in the Control Panel module.Successful exploitation of this vulnerability may cause app processes to be started by mistake.
CVSS Score: 5.3 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52365
Published: 2024-02-18
Description: Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52387
Published: 2024-02-18
Description: Resource reuse vulnerability in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-664
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52366
Published: 2024-02-18
Description: Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52367
Published: 2024-02-18
Description: Vulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availability and integrity.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52368
Published: 2024-02-18
Description: Input verification vulnerability in the account module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52369
Published: 2024-02-18
Description: Stack overflow vulnerability in the NFC module.Successful exploitation of this vulnerability may affect service availability and integrity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52370
Published: 2024-02-18
Description: Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vulnerability may cause unauthorized file access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52371
Published: 2024-02-18
Description: Vulnerability of null references in the motor module.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 3.5 (LOW)
CWE: CWE-476, CWE-476
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52372
Published: 2024-02-18
Description: Vulnerability of input parameter verification in the motor module.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52373
Published: 2024-02-18
Description: Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281, CWE-281
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52374
Published: 2024-02-18
Description: Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52375
Published: 2024-02-18
Description: Permission control vulnerability in the WindowManagerServices module.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52376
Published: 2024-02-18
Description: Information management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-212
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52377
Published: 2024-02-18
Description: Vulnerability of input data not being verified in the cellular data module.Successful exploitation of this vulnerability may cause out-of-bounds access.
CVSS Score: 7.4 (HIGH)
CWE: CWE-120, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2022-48621
Published: 2024-02-18
Description: Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52378
Published: 2024-02-18
Description: Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-693
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52379
Published: 2024-02-18
Description: Permission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52380
Published: 2024-02-18
Description: Vulnerability of improper access control in the email module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.3 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-52381
Published: 2024-02-18
Description: Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://consumer.huawei.com/en/support/bulletin/2024/2/; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/2/
CVE: CVE-2023-6749
Published: 2024-02-18
Description: Unchecked length coming from user input in settings shell
CVSS Score: 8.0 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-757h-rw37-66hw; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-757h-rw37-66hw
CVE: CVE-2023-5779
Published: 2024-02-18
Description: can: out of bounds in remove_rx_filter function
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7cmj-963q-jj47; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7cmj-963q-jj47
CVE: CVE-2023-6249
Published: 2024-02-18
Description: Signed to unsigned conversion esp32_ipm_send
CVSS Score: 8.0 (HIGH)
CWE: CWE-704, CWE-704
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-32f5-3p9h-2rqc; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-32f5-3p9h-2rqc
CVE: CVE-2022-48624
Published: 2024-02-19
Description: close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144; https://github.com/gwsw/less/compare/v605...v606; https://greenwoodsoftware.com/less/
CVE: CVE-2020-36774
Published: 2024-02-19
Description: plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-664
References: https://gitlab.gnome.org/GNOME/glade/-/commit/7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17; https://gitlab.gnome.org/GNOME/glade/-/issues/479; https://gitlab.gnome.org/GNOME/glade/-/commit/7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17
CVE: CVE-2024-26318
Published: 2024-02-19
Description: Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://serenity.is/docs/release-notes/6.8.0; https://serenity.is/docs/release-notes/6.8.0
CVE: CVE-2024-26327
Published: 2024-02-19
Description: An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-122
References: https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4%40daynix.com/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4%40daynix.com/
CVE: CVE-2024-26328
Published: 2024-02-19
Description: An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-787
References: https://lore.kernel.org/all/[PII_REDACTED]5345-mutt-send-email-mst%40kernel.org/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://lore.kernel.org/all/[PII_REDACTED]5345-mutt-send-email-mst%40kernel.org/
CVE: CVE-2024-24722
Published: 2024-02-19
Description: An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevated privileges via the 12d Synergy Server and/or 12d Synergy File Replication Server executable service path. This is fixed in 4.3.10.192, 5.1.5.221, and 5.1.6.235.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-428
References: https://files.12dsynergy.com/downloads/download.aspx; https://help.12dsynergy.com/v1/docs/cve-2024-24722; https://www.12dsynergy.com/security-statement/
CVE: CVE-2024-25710
Published: 2024-02-19
Description: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2024/02/19/1; https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-26308
Published: 2024-02-19
Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.

Users are recommended to upgrade to version 1.26, which fixes the issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2024/02/19/2; https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-1580
Published: 2024-02-19
Description: An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190, CWE-190
References: http://seclists.org/fulldisclosure/2024/Mar/36; http://seclists.org/fulldisclosure/2024/Mar/37; http://seclists.org/fulldisclosure/2024/Mar/38
CVE: CVE-2024-1343
Published: 2024-02-19
Description: A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfiles(x86)% LaborOfficeFree BackUp'.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree
CVE: CVE-2024-1344
Published: 2024-02-19
Description: Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the '%programfiles(x86)%\LaborOfficeFree\' directory. This user can log in remotely and has root-like privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree
CVE: CVE-2024-1345
Published: 2024-02-19
Description: Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily discover the root password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-521, CWE-307
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree
CVE: CVE-2024-1346
Published: 2024-02-19
Description: Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-521
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree