deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4403
Published: 2024-06-10
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF forms. This issue affects the installation process, including the installation of Binding zoo and Models zoo, by unexpectedly resetting programs. The vulnerability is due to the lack of CSRF protection in the affected function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851; https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851
CVE: CVE-2024-26507
Published: 2024-06-10
Description: An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit v.7.00.6700 and before allows a local attacker to escalate privileges via the DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages components.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1286
References: https://belong2yourself.github.io/vulnerabilities/docs/AIDA/Elevation-of-Privileges/readme/; https://belong2yourself.github.io/vulnerabilities/docs/AIDA/Elevation-of-Privileges/readme/
CVE: CVE-2024-31613
Published: 2024-06-10
Description: BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/ss122-0ss/BOSSCMS/blob/main/bosscms%20csrf.md; https://github.com/ss122-0ss/BOSSCMS/blob/main/bosscms%20csrf.md
CVE: CVE-2024-34332
Published: 2024-06-10
Description: An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a crafted buffer sent to the Kernel Driver using the DeviceIoControl Windows API.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://belong2yourself.github.io/vulnerabilities/docs/SANDRA/Elevation-of-Privileges/readme/; https://belong2yourself.github.io/vulnerabilities/docs/SANDRA/Elevation-of-Privileges/readme/
CVE: CVE-2024-34761
Published: 2024-06-10
Description: Vulnerability discovered by executing a planned security audit.

Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-2-10-contributor-arbitrary-function-execution-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-2-10-contributor-arbitrary-function-execution-vulnerability?_s_id=cve
CVE: CVE-2024-34762
Published: 2024-06-10
Description: Vulnerability discovered by executing a planned security audit.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-2-10-contributor-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-2-10-contributor-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-34800
Published: 2024-06-10
Description: Missing Authorization vulnerability in Crafthemes Crafthemes Demo Import crafthemes-demo-import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crafthemes Demo Import: from n/a through <= 3.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/crafthemes-demo-import/vulnerability/wordpress-crafthemes-demo-import-plugin-3-1-arbitrary-plugin-installation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/crafthemes-demo-import/wordpress-crafthemes-demo-import-plugin-3-1-arbitrary-plugin-installation-vulnerability?_s_id=cve
CVE: CVE-2024-35474
Published: 2024-06-10
Description: A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, via setPath in ResourcePackFileServer.kt.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/apple502j/e99ca3a00e492bf1c942214b13213b46; https://gist.github.com/apple502j/e99ca3a00e492bf1c942214b13213b46
CVE: CVE-2024-35650
Published: 2024-06-10
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security melapress-login-security.This issue affects MelaPress Login Security: from n/a through <= 1.3.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-98, CWE-829
References: https://patchstack.com/database/Wordpress/Plugin/melapress-login-security/vulnerability/wordpress-melapress-login-security-plugin-1-3-0-remote-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/melapress-login-security/wordpress-melapress-login-security-plugin-1-3-0-remote-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-35658
Published: 2024-06-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Functionality Misuse, File Manipulation.This issue affects Checkout Field Editor for WooCommerce (Pro): from n/a through 3.6.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/woocommerce-checkout-field-editor-pro/wordpress-checkout-field-editor-for-woocommerce-pro-plugin-3-6-2-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-checkout-field-editor-pro/wordpress-checkout-field-editor-for-woocommerce-pro-plugin-3-6-2-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-35677
Published: 2024-06-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu allows PHP Local File Inclusion.This issue affects MegaMenu: from n/a through 2.3.12.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/stm-megamenu/wordpress-megamenu-plugin-2-3-12-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stm-megamenu/wordpress-megamenu-plugin-2-3-12-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-35680
Published: 2024-06-10
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.9.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Plugin/yith-woocommerce-product-add-ons/vulnerability/wordpress-yith-woocommerce-product-add-ons-plugin-4-9-2-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yith-woocommerce-product-add-ons/wordpress-yith-woocommerce-product-add-ons-plugin-4-9-2-content-injection-vulnerability?_s_id=cve
CVE: CVE-2024-35712
Published: 2024-06-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.This issue affects Database Cleaner: from n/a through 1.0.5.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/database-cleaner/wordpress-database-cleaner-clean-optimize-repair-plugin-1-0-5-arbitrary-file-read-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/database-cleaner/wordpress-database-cleaner-clean-optimize-repair-plugin-1-0-5-arbitrary-file-read-vulnerability?_s_id=cve
CVE: CVE-2024-37051
Published: 2024-06-10
Description: GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-522, CWE-522
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.jetbrains.com/privacy-security/issues-fixed/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-31611
Published: 2024-06-10
Description: SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-404
References: https://github.com/ss122-0ss/seacms/blob/main/readme.md; https://github.com/ss122-0ss/seacms/blob/main/readme.md
CVE: CVE-2024-35728
Published: 2024-06-10
Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Themeisle PPOM for WooCommerce allows Code Inclusion.This issue affects PPOM for WooCommerce: from n/a through 32.0.20.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://patchstack.com/database/vulnerability/woocommerce-product-addon/wordpress-product-addons-fields-for-woocommerce-plugin-32-0-20-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-product-addon/wordpress-product-addons-fields-for-woocommerce-plugin-32-0-20-content-injection-vulnerability?_s_id=cve
CVE: CVE-2024-35743
Published: 2024-06-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Siteclean SC filechecker allows Path Traversal, File Manipulation.This issue affects SC filechecker: from n/a through 0.6.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/wp-file-checker/wordpress-sc-filechecker-plugin-0-6-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-file-checker/wordpress-sc-filechecker-plugin-0-6-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-35744
Published: 2024-06-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ravidhu Dissanayake Upunzipper allows Path Traversal, File Manipulation.This issue affects Upunzipper: from n/a through 1.0.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/upunzipper/wordpress-upunzipper-plugin-1-0-0-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/upunzipper/wordpress-upunzipper-plugin-1-0-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-35745
Published: 2024-06-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Gabriel Somoza / Joseph Fitzgibbons Strategery Migrations allows Path Traversal, File Manipulation.This issue affects Strategery Migrations: from n/a through 1.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/strategery-migrations/wordpress-strategery-migrations-plugin-1-0-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/strategery-migrations/wordpress-strategery-migrations-plugin-1-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-35746
Published: 2024-06-10
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Asghar Hatampoor BuddyPress Cover allows Code Injection.This issue affects BuddyPress Cover: from n/a through 2.1.4.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/bp-cover/wordpress-buddypress-cover-plugin-2-1-4-2-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bp-cover/wordpress-buddypress-cover-plugin-2-1-4-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-35747
Published: 2024-06-10
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue affects Contact Form Builder, Contact Widget: from n/a through 2.1.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://patchstack.com/database/vulnerability/contact-forms-builder/wordpress-contact-form-builder-contact-widget-plugin-2-1-7-bypass-vulnerability-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-forms-builder/wordpress-contact-form-builder-contact-widget-plugin-2-1-7-bypass-vulnerability-vulnerability?_s_id=cve
CVE: CVE-2024-35749
Published: 2024-06-10
Description: Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6.
CVSS Score: 3.7 (LOW)
CWE: CWE-290
References: https://patchstack.com/database/vulnerability/coming-soon-maintenance-mode-from-acurax/wordpress-under-construction-maintenance-mode-from-acurax-plugin-2-6-ip-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/coming-soon-maintenance-mode-from-acurax/wordpress-under-construction-maintenance-mode-from-acurax-plugin-2-6-ip-bypass-vulnerability?_s_id=cve
CVE: CVE-2024-35754
Published: 2024-06-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affects Ovic Importer: from n/a through 1.6.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/ovic-import-demo/wordpress-ovic-importer-plugin-1-6-3-arbitrary-file-download-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ovic-import-demo/wordpress-ovic-importer-plugin-1-6-3-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2024-36407
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is also dependent on some password reset functionalities being enabled. It also requires the system using php 7, which is not an officially supported version. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 3.7 (LOW)
CWE: CWE-640, CWE-640
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-6p2f-wwx9-952r; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-6p2f-wwx9-952r
CVE: CVE-2024-36408
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in the `Alerts` controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-2g8f-gjrr-x5cg; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-2g8f-gjrr-x5cg
CVE: CVE-2024-3850
Published: 2024-06-10
Description: Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-156-01; https://github.com/r3naissance/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3850.yaml; https://www.cisa.gov/news-events/ics-advisories/icsa-24-156-01
CVE: CVE-2024-5102
Published: 2024-06-10
Description: A sym-linked file accessed via the repair function in Avast Antivirus <24.2 on Windows may allow user to elevate privilege to delete arbitrary files or run processes as NT AUTHORITY\SYSTEM. The vulnerability exists within the "Repair" (settings -> troubleshooting -> repair) feature, which attempts to delete a file in the current user's AppData directory as NT AUTHORITY\SYSTEM. A low-privileged user can make a pseudo-symlink and a junction folder and point to a file on the system. This can provide a low-privileged user an Elevation of Privilege to win a race-condition which will re-create the system files and make Windows callback to a specially-crafted file which could be used to launch a privileged shell instance.

This issue affects Avast Antivirus prior to 24.2.
CVSS Score: 7.0 (HIGH)
CWE: CWE-1284, CWE-59
References: https://support.norton.com/sp/static/external/tools/security-advisories.html; https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE: CVE-2024-5597
Published: 2024-06-10
Description: Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02
CVE: CVE-2024-31612
Published: 2024-06-10
Description: Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/ss122-0ss/cms/blob/main/emlog-csrf.md; https://github.com/ss122-0ss/cms/blob/main/emlog-csrf.md
CVE: CVE-2024-36409
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f
CVE: CVE-2024-36410
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq
CVE: CVE-2022-32897
Published: 2024-06-10
Description: A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.5. Processing a maliciously crafted tiff file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-94
References: https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-32933
Published: 2024-06-10
Description: An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.5. A website may be able to track the websites a user visited in Safari private browsing mode.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-48578
Published: 2024-06-10
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5. Processing an AppleScript may result in unexpected termination or disclosure of process memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-48683
Published: 2024-06-10
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13. An app may be able to break out of its sandbox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2023-40389
Published: 2024-06-10
Description: The issue was addressed with improved restriction of data container access. This issue is fixed in macOS Ventura 13.6.5, macOS Monterey 12.7.4. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT214083; https://support.apple.com/en-us/HT214085; https://support.apple.com/kb/HT214035
CVE: CVE-2024-22279
Published: 2024-06-10
Description: Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade
 the service availability of the Cloud Foundry deployment if performed at scale.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://www.cloudfoundry.org/blog/cve-2024-22279-gorouter-denial-of-service-attack/; https://www.cloudfoundry.org/blog/cve-2024-22279-gorouter-denial-of-service-attack/
CVE: CVE-2024-23299
Published: 2024-06-10
Description: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to break out of its sandbox.
CVSS Score: 8.6 (HIGH)
CWE: CWE-250
References: https://support.apple.com/en-us/120884; https://support.apple.com/en-us/120886; https://support.apple.com/en-us/120895
CVE: CVE-2024-27792
Published: 2024-06-10
Description: This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/120895; https://support.apple.com/en-us/HT214084; https://support.apple.com/kb/HT214084
CVE: CVE-2024-32167
Published: 2024-06-10
Description: Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting pictures to delete any files.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/ss122-0ss/cms/blob/main/omos.md; https://github.com/ss122-0ss/cms/blob/main/omos.md
CVE: CVE-2024-36411
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax displayView controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-9rvr-mcrf-p4p7; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-9rvr-mcrf-p4p7
CVE: CVE-2024-36412
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-xjx2-38hv-5hh8; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-xjx2-38hv-5hh8