deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12138
Published: 2024-12-04
Description: A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimbursement/key_result_current_value_update/create_meetings/create_skills. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://github.com/Sp1d3rL1/horilla-RCE; https://vuldb.com/?ctiid.286858; https://vuldb.com/?id.286858
CVE: CVE-2024-51465
Published: 2024-12-04
Description: IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.ibm.com/support/pages/node/7177814
CVE: CVE-2024-53125
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: sync_linked_regs() must preserve subreg_def

Range propagation must not affect subreg_def marks, otherwise the
following example is rewritten by verifier incorrectly when
BPF_F_TEST_RND_HI32 flag is set:

  0: call bpf_ktime_get_ns                   call bpf_ktime_get_ns
  1: r0 &= 0x7fffffff       after verifier   r0 &= 0x7fffffff
  2: w1 = w0                rewrites         w1 = w0
  3: if w0 < 10 goto +0     -------------->  r11 = 0x2f5674a6     (r)
  4: r1 >>= 32                               r11 <<= 32           (r)
  5: r0 = r1                                 r1 |= r11            (r)
  6: exit;                                   if w0 < 0xa goto pc+0
                                             r1 >>= 32
                                             r0 = r1
                                             exit

(or zero extension of w1 at (2) is missing for architectures that
 require zero extension for upper register half).

The following happens w/o this patch:
- r0 is marked as not a subreg at (0);
- w1 is marked as subreg at (2);
- w1 subreg_def is overridden at (3) by copy_register_state();
- w1 is read at (5) but mark_insn_zext() does not mark (2)
  for zero extension, because w1 subreg_def is not set;
- because of BPF_F_TEST_RND_HI32 flag verifier inserts random
  value for hi32 bits of (2) (marked (r));
- this random value is read at (5).
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/60fd3538d2a8fd44c41d25088c0ece3e1fd30659; https://git.kernel.org/stable/c/b57ac2d92c1f565743f6890a5b9cf317ed856b09; https://git.kernel.org/stable/c/bfe9446ea1d95f6cb7848da19dfd58d2eec6fd84
CVE: CVE-2024-7488
Published: 2024-12-04
Description: Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allows Integer Attacks.


This issue affects Online Ordering System: 8.2.1. 

NOTE: Vulnerability fixed in version 8.2.2 and does not exist before 8.2.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190, CWE-1284, CWE-190
References: https://www.usom.gov.tr/bildirim/tr-24-1877
CVE: CVE-2024-12056
Published: 2024-12-04
Description: The Client secret is not checked when using the OAuth Password grant type.

By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment.
Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.
CWE: CWE-358
References: https://www.pcvue.com/security/security/#SB2024-4
CVE: CVE-2024-40744
Published: 2024-12-04
Description: Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.tassos.gr/joomla-extensions/convert-forms
CVE: CVE-2024-40745
Published: 2024-12-04
Description: Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.tassos.gr/joomla-extensions/convert-forms
CVE: CVE-2024-53126
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

vdpa: solidrun: Fix UB bug with devres

In psnet_open_pf_bar() and snet_open_vf_bar() a string later passed to
pcim_iomap_regions() is placed on the stack. Neither
pcim_iomap_regions() nor the functions it calls copy that string.

Should the string later ever be used, this, consequently, causes
undefined behavior since the stack frame will by then have disappeared.

Fix the bug by allocating the strings on the heap through
devm_kasprintf().
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/0b364cf53b20204e92bac7c6ebd1ee7d3ec62931; https://git.kernel.org/stable/c/5bb287da2d2d5bb8f7376e223b02edb16998982e; https://git.kernel.org/stable/c/d372dd09cfbf1324f54cbffd81fcaf6cdf3e608e
CVE: CVE-2024-53127
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"

The commit 8396c793ffdf ("mmc: dw_mmc: Fix IDMAC operation with pages
bigger than 4K") increased the max_req_size, even for 4K pages, causing
various issues:
- Panic booting the kernel/rootfs from an SD card on Rockchip RK3566
- Panic booting the kernel/rootfs from an SD card on StarFive JH7100
- "swiotlb buffer is full" and data corruption on StarFive JH7110

At this stage no fix have been found, so it's probably better to just
revert the change.

This reverts commit 8396c793ffdf28bb8aee7cfe0891080f8cab7890.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/00bff71745bc3583bd5ca59be91e0ee1d27f1944; https://git.kernel.org/stable/c/1635e407a4a64d08a8517ac59ca14ad4fc785e75; https://git.kernel.org/stable/c/47693ba35bccaa16efa465159a1c12d78258349e
CVE: CVE-2024-53128
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers

When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the
object_is_on_stack() function may produce incorrect results due to the
presence of tags in the obj pointer, while the stack pointer does not have
tags.  This discrepancy can lead to incorrect stack object detection and
subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled.

Example of the warning:

ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364
Modules linked in:
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4
Hardware name: linux,dummy-virt (DT)
pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __debug_object_init+0x330/0x364
lr : __debug_object_init+0x330/0x364
sp : ffff800082ea7b40
x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534
x26: ffff800082d93ec8 x25: [PII_REDACTED] x24: 1cff0000c00172a0
x23: [PII_REDACTED] x22: ffff800082d93ed0 x21: ffff800081a24418
x20: 3eff800082ea7bb0 x19: efff[PII_REDACTED]00 x18: [PII_REDACTED]
x17:[PII_REDACTED]0000ff x16: [PII_REDACTED] x15: 206b[PII_REDACTED]6e
x14: [PII_REDACTED] x13: ffff800082ea7780 x12: 0ffff800082ea78e
x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800
x8 : 34d77febe173e800 x7 : [PII_REDACTED] x6 : [PII_REDACTED]
x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4
x2 : [PII_REDACTED] x1 : ffff[PII_REDACTED]10 x0 : [PII_REDACTED]
Call trace:
 __debug_object_init+0x330/0x364
 debug_object_init_on_stack+0x30/0x3c
 schedule_hrtimeout_range_clock+0xac/0x26c
 schedule_hrtimeout+0x1c/0x30
 wait_task_inactive+0x1d4/0x25c
 kthread_bind_mask+0x28/0x98
 init_rescuer+0x1e8/0x280
 workqueue_init+0x1a0/0x3cc
 kernel_init_freeable+0x118/0x200
 kernel_init+0x28/0x1f0
 ret_from_fork+0x10/0x20
---[ end trace [PII_REDACTED] ]---
ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated.
------------[ cut here ]------------
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2d2b19ed4169c38dc6c61a186c5f7bdafc709691; https://git.kernel.org/stable/c/397383db9c69470642ac95beb04f2150928d663b; https://git.kernel.org/stable/c/82e813b12b10ff705f3f5d600d8492fc5248618b
CVE: CVE-2024-53129
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/rockchip: vop: Fix a dereferenced before check warning

The 'state' can't be NULL, we should check crtc_state.

Fix warning:
drivers/gpu/drm/rockchip/rockchip_drm_vop.c:1096
vop_plane_atomic_async_check() warn: variable dereferenced before check
'state' (see line 1077)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1e[PII_REDACTED]1ca4d905118258b9fbd17d854174; https://git.kernel.org/stable/c/4e47b99a7764b23a431bff6a3f91dfe77d294765; https://git.kernel.org/stable/c/656dbd1c21c2c088c70059cdd43ec83e7d54ec4d
CVE: CVE-2024-53130
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint

When using the "block:block_dirty_buffer" tracepoint, mark_buffer_dirty()
may cause a NULL pointer dereference, or a general protection fault when
KASAN is enabled.

This happens because, since the tracepoint was added in
mark_buffer_dirty(), it references the dev_t member bh->b_bdev->bd_dev
regardless of whether the buffer head has a pointer to a block_device
structure.

In the current implementation, nilfs_grab_buffer(), which grabs a buffer
to read (or create) a block of metadata, including b-tree node blocks,
does not set the block device, but instead does so only if the buffer is
not in the "uptodate" state for each of its caller block reading
functions.  However, if the uptodate flag is set on a folio/page, and the
buffer heads are detached from it by try_to_free_buffers(), and new buffer
heads are then attached by create_empty_buffers(), the uptodate flag may
be restored to each buffer without the block device being set to
bh->b_bdev, and mark_buffer_dirty() may be called later in that state,
resulting in the bug mentioned above.

Fix this issue by making nilfs_grab_buffer() always set the block device
of the super block structure to the buffer head, regardless of the state
of the buffer's uptodate flag.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0a5014ad37c77ac6a2c525137c00a0e1724f6020; https://git.kernel.org/stable/c/0ce59fb1c73fdd5b6028226aeb46259a0cdc0957; https://git.kernel.org/stable/c/2026559a6c4ce34db117d2db8f710fe2a9420d5a
CVE: CVE-2024-53131
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint

Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints".

This series fixes null pointer dereference bugs that occur when using
nilfs2 and two block-related tracepoints.


This patch (of 2):

It has been reported that when using "block:block_touch_buffer"
tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a
NULL pointer dereference, or a general protection fault when KASAN is
enabled.

This happens because since the tracepoint was added in touch_buffer(), it
references the dev_t member bh->b_bdev->bd_dev regardless of whether the
buffer head has a pointer to a block_device structure.  In the current
implementation, the block_device structure is set after the function
returns to the caller.

Here, touch_buffer() is used to mark the folio/page that owns the buffer
head as accessed, but the common search helper for folio/page used by the
caller function was optimized to mark the folio/page as accessed when it
was reimplemented a long time ago, eliminating the need to call
touch_buffer() here in the first place.

So this solves the issue by eliminating the touch_buffer() call itself.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/085556bf8c70e2629e02e79268dac3016a08b8bf; https://git.kernel.org/stable/c/19c71cdd77973f99a9adc3190130bc3aa7ae5423; https://git.kernel.org/stable/c/3b2a4fd9bbee77afdd3ed5a05a0c02b6cde8d3b9
CVE: CVE-2024-53132
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe/oa: Fix "Missing outer runtime PM protection" warning

Fix the following drm_WARN:

[953.586396] xe 0000:00:02.0: [drm] Missing outer runtime PM protection
...
<4> [953.587090]  ? xe_pm_runtime_get_noresume+0x8d/0xa0 [xe]
<4> [953.587208]  guc_exec_queue_add_msg+0x28/0x130 [xe]
<4> [953.587319]  guc_exec_queue_fini+0x3a/0x40 [xe]
<4> [953.587425]  xe_exec_queue_destroy+0xb3/0xf0 [xe]
<4> [953.587515]  xe_oa_release+0x9c/0xc0 [xe]

(cherry picked from commit b107c63d[PII_REDACTED]fd0cafb0e543b3c3167b75)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/c0403e4ceecaefbeaf78263dffcd3e3f06a19f6b; https://git.kernel.org/stable/c/ed7cd3510d8da6e3578d9125a9ea4440f8adeeaa
CVE: CVE-2024-53133
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Handle dml allocation failure to avoid crash

[Why]
In the case where a dml allocation fails for any reason, the
current state's dml contexts would no longer be valid. Then
subsequent calls dc_state_copy_internal would shallow copy
invalid memory and if the new state was released, a double
free would occur.

[How]
Reset dml pointers in new_state to NULL and avoid invalid
pointer

(cherry picked from commit bcafdc61529a48f6f06355d78eb41b3aeda5296c)
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://git.kernel.org/stable/c/6825cb07b79ffeb1d90ffaa7a1227462cdca34ae; https://git.kernel.org/stable/c/874ff59cde8fc525112dda26b501a1bac17dde9f
CVE: CVE-2024-53134
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

pmdomain: imx93-blk-ctrl: correct remove path

The check condition should be 'i < bc->onecell_data.num_domains', not
'bc->onecell_data.num_domains' which will make the look never finish
and cause kernel panic.

Also disable runtime to address
"imx93-blk-ctrl 4ac10000.system-controller: Unbalanced pm_runtime_enable!"
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-670, CWE-670
References: https://git.kernel.org/stable/c/201fb9e164a1e4c5937de2cf58bcb0327c08664f; https://git.kernel.org/stable/c/8fc228ab5d38a026eae7183a5f74a4fac43d9b6a; https://git.kernel.org/stable/c/f7c7c5aa556378a2c8da72c1f7f238b6648f95fb
CVE: CVE-2024-53135
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN

Hide KVM's pt_mode module param behind CONFIG_BROKEN, i.e. disable support
for virtualizing Intel PT via guest/host mode unless BROKEN=y.  There are
myriad bugs in the implementation, some of which are fatal to the guest,
and others which put the stability and health of the host at risk.

For guest fatalities, the most glaring issue is that KVM fails to ensure
tracing is disabled, and *stays* disabled prior to VM-Enter, which is
necessary as hardware disallows loading (the guest's) RTIT_CTL if tracing
is enabled (enforced via a VMX consistency check).  Per the SDM:

  If the logical processor is operating with Intel PT enabled (if
  IA32_RTIT_CTL.TraceEn = 1) at the time of VM entry, the "load
  IA32_RTIT_CTL" VM-entry control must be 0.

On the host side, KVM doesn't validate the guest CPUID configuration
provided by userspace, and even worse, uses the guest configuration to
decide what MSRs to save/load at VM-Enter and VM-Exit.  E.g. configuring
guest CPUID to enumerate more address ranges than are supported in hardware
will result in KVM trying to passthrough, save, and load non-existent MSRs,
which generates a variety of WARNs, ToPA ERRORs in the host, a potential
deadlock, etc.
CVSS Score: 6.5 (MEDIUM)
References: https://git.kernel.org/stable/c/aa0d42cacf093a6fcca872edc954f6f812926a17; https://git.kernel.org/stable/c/b8a1d572478b6f239061ee9578b2451bf2f021c2; https://git.kernel.org/stable/c/b91bb0ce5cd7005b376eac690ec664c1b56372ec
CVE: CVE-2024-53136
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: revert "mm: shmem: fix data-race in shmem_getattr()"

Revert d949d1d14fa2 ("mm: shmem: fix data-race in shmem_getattr()") as
suggested by Chuck [1].  It is causing deadlocks when accessing tmpfs over
NFS.

As Hugh commented, "added just to silence a syzbot sanitizer splat: added
where there has never been any practical problem".
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/36b537e8f302f670c7cf35d88a3a294443e32d52; https://git.kernel.org/stable/c/57cc8d253099d1b8627f0fb487ee011d9158ccc9; https://git.kernel.org/stable/c/5874c1150e77296565ad6e495ef41fbf87570d14
CVE: CVE-2024-53137
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: fix cacheflush with PAN

It seems that the cacheflush syscall got broken when PAN for LPAE was
implemented. User access was not enabled around the cache maintenance
instructions, causing them to fault.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/ca29cfcc4a21083d671522ad384532e28a43f033; https://git.kernel.org/stable/c/e6960a2ed49c9a[PII_REDACTED]5f7cc50594a58604
CVE: CVE-2024-53138
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: kTLS, Fix incorrect page refcounting

The kTLS tx handling code is using a mix of get_page() and
page_ref_inc() APIs to increment the page reference. But on the release
path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.

This is an issue when using pages from large folios: the get_page()
references are stored on the folio page while the page_ref_inc()
references are stored directly in the given page. On release the folio
page will be dereferenced too many times.

This was found while doing kTLS testing with sendfile() + ZC when the
served file was read from NFS on a kernel with NFS large folios support
(commit 49b29a573da8 ("nfs: add support for large folios")).
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df; https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d; https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4
CVE: CVE-2024-53140
Published: 2024-12-04
Description: In the Linux kernel, the following vulnerability has been resolved:

netlink: terminate outstanding dump on socket close

Netlink supports iterative dumping of data. It provides the families
the following ops:
 - start - (optional) kicks off the dumping process
 - dump  - actual dump helper, keeps getting called until it returns 0
 - done  - (optional) pairs with .start, can be used for cleanup
The whole process is asynchronous and the repeated calls to .dump
don't actually happen in a tight loop, but rather are triggered
in response to recvmsg() on the socket.

This gives the user full control over the dump, but also means that
the user can close the socket without getting to the end of the dump.
To make sure .start is always paired with .done we check if there
is an ongoing dump before freeing the socket, and if so call .done.

The complication is that sockets can get freed from BH and .done
is allowed to sleep. So we use a workqueue to defer the call, when
needed.

Unfortunately this does not work correctly. What we defer is not
the cleanup but rather releasing a reference on the socket.
We have no guarantee that we own the last reference, if someone
else holds the socket they may release it in BH and we're back
to square one.

The whole dance, however, appears to be unnecessary. Only the user
can interact with dumps, so we can clean up when socket is closed.
And close always happens in process context. Some async code may
still access the socket after close, queue notification skbs to it etc.
but no dumps can start, end or otherwise make progress.

Delete the workqueue and flush the dump state directly from the release
handler. Note that further cleanup is possible in -next, for instance
we now always call .done before releasing the main module reference,
so dump doesn't have to take a reference of its own.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/114a61d8d94ae3a43b82446cf737fd757021b834; https://git.kernel.org/stable/c/176c41b3ca9281a9736b67c6121b03dbf0c8c08f; https://git.kernel.org/stable/c/1904fb9ebf911441f90a68e96b22aa73e4410505
CVE: CVE-2024-11643
Published: 2024-12-04
Description: The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'AllAccessible_save_settings' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/allaccessible/trunk/allaccessible.php#L249; https://plugins.trac.wordpress.org/changeset/3202017/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bb65d916-7d9e-4562-ab9b-c7ba012a08fb?source=cve
CVE: CVE-2024-37574
Published: 2024-12-04
Description: The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.iui.mobile.presentation.MobileActivity.
CVSS Score: 8.2 (HIGH)
CWE: CWE-732
References: https://github.com/actuator/com.grice.call; https://github.com/actuator/com.grice.call/blob/main/CVE-2024-37574; https://play.google.com/store/apps/details?id=com.grice.call
CVE: CVE-2024-37575
Published: 2024-12-04
Description: The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281
References: https://github.com/actuator/org.mistergroup.shouldianswer; https://github.com/actuator/org.mistergroup.shouldianswer/blob/main/CVE-2024-37575; https://play.google.com/store/apps/details?id=org.mistergroup.shouldianswer
CVE: CVE-2024-53614
Published: 2024-12-04
Description: A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive data and execute arbitrary commands with elevated privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: http://thinkware.com; https://geochen.medium.com/cve-2024-53614-61b48c3b45d6
CVE: CVE-2024-54002
Published: 2024-12-04
Description: Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same action with a username that is not known by the system. The observable difference in request duration can be leveraged by actors to enumerate valid names of managed users. LDAP and OpenID Connect users are not affected. The issue has been fixed in Dependency-Track 4.12.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-9w3m-hm36-w32w