deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-44744
Published: 2024-10-01
Description: An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecified directories. NOTE: Malwarebytes argues that this issue requires admin privileges and that the contents cannot be altered by non-admin users.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-94
References: https://googleprojectzero.blogspot.com/2016/02/the-definitive-guide-on-win32-to-nt.html; https://medium.com/%40danielshaulov01/malwarebytes-premium-security-av-bypass-cve-2024-44744-97bb6192ed4a
CVE: CVE-2024-46258
Published: 2024-10-01
Description: cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_load_png_mem() function at cute_png.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_load_png_mem-cute_png-1105c15; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_load_png_mem-cute_png-1105c15/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_load_png_mem-cute_png-1105c15/poc/sample2.png
CVE: CVE-2024-46259
Published: 2024-10-01
Description: cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_unfilter() function at cute_png.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_unfilter-cute_png-1019c11; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_unfilter-cute_png-1019c11/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_unfilter-cute_png-1019c11/poc/sample6.png
CVE: CVE-2024-46261
Published: 2024-10-01
Description: cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_make32() function at cute_png.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_make32-cute_png-948c10; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_make32-cute_png-948c10/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_make32-cute_png-948c10/poc/sample4.png
CVE: CVE-2024-46263
Published: 2024-10-01
Description: cute_png v1.05 was discovered to contain a stack overflow via the cp_dynamic() function at cute_png.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/stkof-w1-cp_dynamic-cute_png-601c71; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/stkof-w1-cp_dynamic-cute_png-601c71/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/stkof-w1-cp_dynamic-cute_png-601c71/poc/sample15.png
CVE: CVE-2024-46264
Published: 2024-10-01
Description: cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_find() function at cute_png.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-122, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/poc/sample8.png
CVE: CVE-2024-46267
Published: 2024-10-01
Description: cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_block() function at cute_png.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-w98-cp_block-5c0-cute_png-642c5; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-w98-cp_block-5c0-cute_png-642c5/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-w98-cp_block-5c0-cute_png-642c5/poc/sample13.png
CVE: CVE-2024-46274
Published: 2024-10-01
Description: cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_stored() function at cute_png.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2/poc/sample10.png
CVE: CVE-2024-46276
Published: 2024-10-01
Description: cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_chunk() function at cute_png.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_chunk-cute_png-956c7; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_chunk-cute_png-956c7/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_chunk-cute_png-956c7/poc/sample7.png
CVE: CVE-2021-37577
Published: 2024-10-01
Description: Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3 may permit an unauthenticated man-in-the-middle attacker to identify the Passkey used during pairing by reflection of a crafted public key with the same X coordinate as the offered public key and by reflection of the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. This is a related issue to CVE-2020-26558.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-639
References: https://bluetooth.com; https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/passkey-impersonation/; https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
CVE: CVE-2024-25632
Published: 2024-10-01
Description: eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to manage users and content in their assigned team/teams. A user may be an administrator in one team and a regular user in another. The vulnerability allows a regular user to become administrator of a team where they are a member, under a reasonable configuration. Additionally, in eLabFTW versions subsequent to v5.0.0, the vulnerability may allow an initially unauthenticated user to gain administrative privileges over an arbitrary team. The vulnerability does not affect system administrator status. Users should upgrade to version 5.1.0. System administrators are advised to turn off local user registration, saml_team_create and not allow administrators to import users into teams, unless strictly required.
CVSS Score: 8.6 (HIGH)
CWE: CWE-266, CWE-842
References: https://github.com/elabftw/elabftw/security/advisories/GHSA-6m7p-gh9f-5mgg
CVE: CVE-2024-25658
Published: 2024-10-01
Description: Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the database or exported configuration files) to obtain SNMP users' usernames and passwords in cleartext.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25658
CVE: CVE-2024-25661
Published: 2024-10-01
Description: In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client allows guest OS administrators to obtain various users' passwords by reading memory dumps of the desktop application.
CVSS Score: 7.7 (HIGH)
CWE: CWE-312
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25661
CVE: CVE-2024-41673
Published: 2024-10-01
Description: Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/decidim/decidim/commit/8a18c8b1ee85a1b35ee0d8d5893f218695d15637; https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8
CVE: CVE-2024-44610
Published: 2024-10-01
Description: PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters in a Software Update to processing.php.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-77
References: https://cve.mahi.be/peak_pcan_dr/; https://github.com/BertoldVdb/PcanExploit
CVE: CVE-2024-45408
Published: 2024-10-01
Description: eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed (something disabled by default), this extends to anyone. Users are advised to upgrade to at least version 5.1.0.  System administrators can disable anonymous access in the System configuration panel.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/elabftw/elabftw/security/advisories/GHSA-2c83-6j74-w8r5
CVE: CVE-2024-45967
Published: 2024-10-01
Description: Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/yingning620/test123/blob/main/Pagekit%20CMS/Pagekit%20CMS%20v1.0.18%20%E5%AD%98%E5%82%A8%E5%9E%8BXSS.md
CVE: CVE-2024-25659
Published: 2024-10-01
Description: In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access files and directories outside the SFTP user home directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25659
CVE: CVE-2024-25660
Published: 2024-10-01
Description: The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of execution with unnecessary privileges.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-266
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25660; https://www.nokia.com/optical-networks/infinera/
CVE: CVE-2024-47071
Published: 2024-10-01
Description: OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://github.com/FreePBX-ContributedModules/endpointman/commit/bad70ca3de2166bbd24f273f7f212a8b2c92a719; https://github.com/FreePBX/security-reporting/security/advisories/GHSA-x9wc-qjrc-j7ww
CVE: CVE-2024-47534
Published: 2024-10-01
Description: go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.
CWE: CWE-362
References: https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580; https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d; https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819
CVE: CVE-2024-47604
Published: 2024-10-01
Description: NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability in its handling of HTML element attributes, which allows an attacker to execute arbitrary HTML or Javascript code in a victim's browser.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/NuGet/NuGetGallery/commit/3a18689dd0de856e03d081af999783f0e6e7ca70; https://github.com/NuGet/NuGetGallery/pull/10193; https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-hq63-27r7-2j64
CVE: CVE-2024-9391
Published: 2024-10-01
Description: A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode.  This may allow spoofing of other sites as the address bar is no longer visible.
*This bug only affects Firefox Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1892407; https://www.mozilla.org/security/advisories/mfsa2024-46/
CVE: CVE-2024-9392
Published: 2024-10-01
Description: A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1899154; https://bugzilla.mozilla.org/show_bug.cgi?id=1905843; https://www.mozilla.org/security/advisories/mfsa2024-46/
CVE: CVE-2024-9393
Published: 2024-10-01
Description: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin.  This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1918301; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-47/
CVE: CVE-2024-9394
Published: 2024-10-01
Description: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin.  This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1918874; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-47/
CVE: CVE-2024-9395
Published: 2024-10-01
Description: A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131.
CVSS Score: 5.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1906024; https://www.mozilla.org/security/advisories/mfsa2024-46/
CVE: CVE-2024-9396
Published: 2024-10-01
Description: It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1912471; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-47/
CVE: CVE-2024-9397
Published: 2024-10-01
Description: A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1916659; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-47/
CVE: CVE-2024-9398
Published: 2024-10-01
Description: By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1881037; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-47/
CVE: CVE-2024-9399
Published: 2024-10-01
Description: A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1907726; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-47/
CVE: CVE-2024-9400
Published: 2024-10-01
Description: A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1915249; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-47/
CVE: CVE-2024-9401
Published: 2024-10-01
Description: Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-47/
CVE: CVE-2024-9402
Published: 2024-10-01
Description: Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1913445%2C1914106%2C1914475%2C1914963%2C1915008%2C1916476; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-47/
CVE: CVE-2024-9403
Published: 2024-10-01
Description: Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131 and Thunderbird < 131.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1917807; https://www.mozilla.org/security/advisories/mfsa2024-46/; https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE: CVE-2024-47608
Published: 2024-10-01
Description: Logicytics is designed to harvest and collect data for forensic analysis. Logicytics has a basic vuln affecting compromised devices from shell injections. This vulnerability is fixed in 2.3.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/DefinetlyNotAI/Logicytics/security/advisories/GHSA-5wvr-vvqf-668m; https://www.codefactor.io/repository/github/definetlynotai/logicytics/issues/main
CVE: CVE-2024-31835
Published: 2024-10-01
Description: Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://drive.google.com/file/d/1OthtP87MduNTYur_p0RZv3moY8CrBcaM/view; https://github.com/paragbagul111/CVE-2024-31835
CVE: CVE-2024-42514
Published: 2024-10-01
Description: A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthorized access attack due to inadequate access control checks. A successful exploit requires user interaction and could allow an attacker to access sensitive information and send unauthorized messages during an active chat session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_24-0024-001-v2.pdf; https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0024
CVE: CVE-2024-46079
Published: 2024-10-01
Description: Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/
CVE: CVE-2024-46081
Published: 2024-10-01
Description: Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do List. The assigned user will trigger a stored XSS, which is particularly dangerous because tasks are assigned to various users on the platform.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/
CVE: CVE-2024-46083
Published: 2024-10-01
Description: Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, which allows the injection of malicious code into any user's account on the platform. It is important to note that regular users can trigger actions for administrator users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/
CVE: CVE-2024-9341
Published: 2024-10-01
Description: A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-59
References: https://access.redhat.com/errata/RHSA-2024:10147; https://access.redhat.com/errata/RHSA-2024:10818; https://access.redhat.com/errata/RHSA-2024:7925