deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-38369
Published: 2024-06-24
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using `{{include reference="targetdocument"/}}` is executed with the right of the includer and not with the right of its author. This means that any user able to modify the target document can impersonate the author of the content which used the `include` macro. This vulnerability has been patched in XWiki 15.0 RC1 by making the default behavior safe.

CVSS Score: 9.9 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qcj3-wpgm-qpxh; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qcj3-wpgm-qpxh
CVE: CVE-2024-38373
Published: 2024-06-24
Description: FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-126, CWE-125
References: https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.1.1; https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-ppcp-rg65-58mv; https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.1.1
CVE: CVE-2024-6104
Published: 2024-06-24
Description: go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://discuss.hashicorp.com/c/security; https://discuss.hashicorp.com/c/security
CVE: CVE-2023-49793
Published: 2024-06-24
Description: CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`.
The attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/Ericsson/codechecker/commit/46bada41e32f3ba0f6011d5c556b579f6dddf07a; https://github.com/Ericsson/codechecker/security/advisories/GHSA-h26w-r4m5-8rrf; https://github.com/Ericsson/codechecker/commit/46bada41e32f3ba0f6011d5c556b579f6dddf07a
CVE: CVE-2021-45785
Published: 2024-06-24
Description: TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has sufficient privileges), would visit the page and the server restart would begin. The attacker must know the full URL that TruDesk is on in order to craft the webpage.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://1d8.github.io/cves/cve_2021_45785/; https://1d8.github.io/cves/cve_2021_45785/
CVE: CVE-2024-37677
Published: 2024-06-24
Description: An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/dabaizhizhu/123/issues/2; https://github.com/dabaizhizhu/123/issues/2
CVE: CVE-2024-37679
Published: 2024-06-24
Description: Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dabaizhizhu/123/issues/4; https://github.com/dabaizhizhu/123/issues/4
CVE: CVE-2024-37680
Published: 2024-06-24
Description: Hangzhou Meisoft Information Technology Co., Ltd. FineSoft <=8.0 is affected by Cross Site Scripting (XSS) which allows remote attackers to execute arbitrary code. Enter any account and password, click Login, the page will report an error, and a controllable parameter will appear at the URL:weburl.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dabaizhizhu/123/issues/5; https://github.com/dabaizhizhu/123/issues/5
CVE: CVE-2024-37732
Published: 2024-06-24
Description: Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://gitee.com/Aa272899/CHG-sec/issues/I9UO7X; https://gitee.com/Aa272899/CHG-sec/issues/I9UO7X
CVE: CVE-2024-34312
Published: 2024-06-24
Description: Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/vincentscode/CVE-2024-34312; https://github.com/vincentscode/CVE-2024-34312
CVE: CVE-2024-34313
Published: 2024-06-24
Description: An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/vincentscode/CVE-2024-34313; https://github.com/vincentscode/CVE-2024-34313
CVE: CVE-2024-37678
Published: 2024-06-24
Description: Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker to execute arbitrary code via a crafted script.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/dabaizhizhu/123/issues/3; https://github.com/dabaizhizhu/123/issues/3
CVE: CVE-2024-37681
Published: 2024-06-24
Description: An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a denial of service via the index.html component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/dabaizhizhu/123/issues/6; https://github.com/dabaizhizhu/123/issues/6
CVE: CVE-2023-45196
Published: 2024-06-24
Description: Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/adminerevo/adminerevo/pull/102/commits/23e7cdc0a32b3739e13d19ae504be0fe215142b6; https://github.com/adminerevo/adminerevo/pull/102/commits/23e7cdc0a32b3739e13d19ae504be0fe215142b6
CVE: CVE-2024-37759
Published: 2024-06-24
Description: DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/crumbledwall/CVE-2024-37759_PoC; https://github.com/datageartech/datagear/issues/32; https://github.com/crumbledwall/CVE-2024-37759_PoC
CVE: CVE-2024-38892
Published: 2024-06-24
Description: An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-202
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/Wavlink/WN551K1/ExportLogs.sh/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/Wavlink/WN551K1/ExportLogs.sh/README.md
CVE: CVE-2024-38894
Published: 2024-06-24
Description: WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/Wavlink/WN551K1/touchlist_sync.cgi/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/Wavlink/WN551K1/touchlist_sync.cgi/README.md
CVE: CVE-2024-38895
Published: 2024-06-24
Description: WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-202
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/tree/main/Wavlink/WN551K1/live_mfg.shtml; https://github.com/s4ndw1ch136/IOT-vuln-reports/tree/main/Wavlink/WN551K1/live_mfg.shtml
CVE: CVE-2024-38896
Published: 2024-06-24
Description: WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/tree/main/Wavlink/WN551K1/nightled.cgi; https://github.com/s4ndw1ch136/IOT-vuln-reports/tree/main/Wavlink/WN551K1/nightled.cgi
CVE: CVE-2024-38897
Published: 2024-06-24
Description: WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-202
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/Wavlink/WN551K1/live_check.shtml/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/Wavlink/WN551K1/live_check.shtml/README.md
CVE: CVE-2024-38902
Published: 2024-06-24
Description: H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/H3C/Magic%20R230/hardcode/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/H3C/Magic%20R230/hardcode/README.md
CVE: CVE-2024-38903
Published: 2024-06-24
Description: H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-77
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/H3C/Magic%20R230/UDPserver_97F/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/H3C/Magic%20R230/UDPserver_97F/README.md
CVE: CVE-2023-45195
Published: 2024-06-24
Description: Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc; https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc
CVE: CVE-2024-33898
Published: 2024-06-24
Description: Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypass allows remote attackers to achieve unauthenticated remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.axiros.com/2024/03/vulnerability-in-axusermanager; https://www.nsideattacklogic.de/advisories/NSIDE-SA-2024-002; https://www.axiros.com/2024/03/vulnerability-in-axusermanager
CVE: CVE-2024-34991
Published: 2024-06-24
Description: In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / postal address / email / etc. without restriction due to a lack of permissions control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://security.friendsofpresta.org/modules/2024/06/20/axepta.html; https://security.friendsofpresta.org/modules/2024/06/20/axepta.html
CVE: CVE-2024-36682
Published: 2024-06-24
Description: In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email when maintenance is enable which can lead to leak of personal information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://security.friendsofpresta.org/modules/2024/06/20/pk_themesettings.html; https://security.friendsofpresta.org/modules/2024/06/20/pk_themesettings.html
CVE: CVE-2024-6290
Published: 2024-06-24
Description: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html; https://issues.chromium.org/issues/342428008; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T6OJ65HWXYSYMH55VDO6N36EOZFUNL4O/
CVE: CVE-2024-6291
Published: 2024-06-24
Description: Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html; https://issues.chromium.org/issues/40942995; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T6OJ65HWXYSYMH55VDO6N36EOZFUNL4O/
CVE: CVE-2024-6292
Published: 2024-06-24
Description: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html; https://issues.chromium.org/issues/342545100; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T6OJ65HWXYSYMH55VDO6N36EOZFUNL4O/
CVE: CVE-2024-6293
Published: 2024-06-24
Description: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html; https://issues.chromium.org/issues/345993680; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T6OJ65HWXYSYMH55VDO6N36EOZFUNL4O/
CVE: CVE-2023-50029
Published: 2024-06-24
Description: PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate() method.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://security.friendsofpresta.org/modules/2024/06/20/m4pdf.html; https://security.friendsofpresta.org/modules/2024/06/20/m4pdf.html
CVE: CVE-2024-22168
Published: 2024-06-24
Description: A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data.
CWE: CWE-79
References: https://www.westerndigital.com/support/product-security/wdc-24003-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-web-app-update; https://www.westerndigital.com/support/product-security/wdc-24003-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-web-app-update
CVE: CVE-2024-34988
Published: 2024-06-24
Description: SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Addons for PrestaShop allows attackers to view sensitive information and cause other impacts via methods `AskforaquotemodulcustomernewquoteModuleFrontController::run()`, `AskforaquotemoduladdproductnewquoteModuleFrontController::run()`, `AskforaquotemodulCouponcodeModuleFrontController::run()`, `AskforaquotemodulgetshippingcostModuleFrontController::run()`, `AskforaquotemodulgetstateModuleFrontController::run().`
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2024/06/20/askforaquotemodul.html; https://security.friendsofpresta.org/modules/2024/06/20/askforaquotemodul.html
CVE: CVE-2024-34992
Published: 2024-06-24
Description: SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via 'Tickets::getsearchedtickets()'
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2024/06/20/helpdesk.html; https://security.friendsofpresta.org/modules/2024/06/20/helpdesk.html
CVE: CVE-2024-36681
Published: 2024-06-24
Description: SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitive information and cause other impacts via `pk_isotope::saveData` and `pk_isotope::removeData` methods.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2024/06/20/pk_isotope.html; https://security.friendsofpresta.org/modules/2024/06/20/pk_isotope.html
CVE: CVE-2024-36683
Published: 2024-06-24
Description: SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via the ProductsAlertAjaxProcessModuleFrontController::initContent method.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2024/06/20/productsalert.html; https://security.friendsofpresta.org/modules/2024/06/20/productsalert.html
CVE: CVE-2023-6198
Published: 2024-06-25
Description: Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-798
References: https://www.baicells.com; https://www.baicells.com
CVE: CVE-2024-22385
Published: 2024-06-25
Description: Incorrect Default Permissions vulnerability in Hitachi Storage Provider for VMware vCenter allows local users to read and write specific files.This issue affects Hitachi Storage Provider for VMware vCenter: from 3.1.0 before 3.7.4.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-276
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-129/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-129/index.html
CVE: CVE-2024-23140
Published: 2024-06-25
Description: A maliciously crafted 3DM and MODEL file, when parsed in opennurbs.dll and atf_api.dll through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23141
Published: 2024-06-25
Description: A maliciously crafted MODEL file, when parsed in libodxdll through Autodesk applications, can cause a double free. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23142
Published: 2024-06-25
Description: A maliciously crafted CATPART, STP, and MODEL file, when parsed in atf_dwg_consumer.dll, rose_x64_vc15.dll and libodxdll through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23143
Published: 2024-06-25
Description: A maliciously crafted 3DM, MODEL and X_B file, when parsed in ASMkern229A.dll and ASMBASE229A.dll through Autodesk applications, can force an Out-of-Bound Read and/or Out-of-Bound Write. A malicious actor can leverage this vulnerability to cause a crash,read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23144
Published: 2024-06-25
Description: A maliciously crafted CATPART file, when parsed in CC5Dll.dll and ASMBASE228A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-6294
Published: 2024-06-25
Description: udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn.
CVSS Score: 3.9 (LOW)
CWE: CWE-200
References: https://www.twcert.org.tw/en/cp-139-7893-43ecd-2.html; https://www.twcert.org.tw/tw/cp-132-7892-aafd2-1.html; https://www.twcert.org.tw/en/cp-139-7893-43ecd-2.html
CVE: CVE-2023-5038
Published: 2024-06-25
Description: badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera. An attacker runs a crafted URL, nobody can access the web management page of the camera. and must manually restart the device or re-power it. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248, CWE-703
References: https://www.hanwhavision.com/wp-content/uploads/2024/06/Camera-Vulnerability-Report-CVE-2023-5037-5038.pdf; https://www.hanwhavision.com/wp-content/uploads/2024/06/Camera-Vulnerability-Report-CVE-2023-5037-5038.pdf
CVE: CVE-2024-23145
Published: 2024-06-25
Description: A maliciously crafted PRT file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this vulnerability to cause a crash,read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009