deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-52518
Published: 2024-11-15
Description: Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-287, CWE-863
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vrhf-532w-99rg; https://github.com/nextcloud/server/pull/48373; https://github.com/nextcloud/server/pull/48788
CVE: CVE-2024-52519
Published: 2024-11-15
Description: Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.
CVSS Score: 2.7 (LOW)
CWE: CWE-922
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fvpc-8hq6-jgq2; https://github.com/nextcloud/server/commit/09b8aea8f6783514bffe00df6abbf9fa542faac5; https://github.com/nextcloud/server/pull/47635
CVE: CVE-2024-52520
Published: 2024-11-15
Description: Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-400, CWE-79
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxqf-cfxw-mqmj; https://github.com/nextcloud/server/commit/873c42b0f1383d5b6f2b7a481e1d9620ed30f44a; https://github.com/nextcloud/server/pull/47627
CVE: CVE-2024-52521
Published: 2024-11-15
Description: Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0.
CVSS Score: 2.6 (LOW)
CWE: CWE-328
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2q6f-gjgj-7hp4; https://github.com/nextcloud/server/commit/a933ba1fdba77e7d8c6b8ff400e082cf853ea46d; https://github.com/nextcloud/server/pull/47769
CVE: CVE-2024-52523
Published: 2024-11-15
Description: Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200, CWE-125
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-42w6-r45m-9w9j; https://github.com/nextcloud/server/commit/8a13f284765bd4606984e7d925c32ae6e82b8a27; https://github.com/nextcloud/server/pull/49009
CVE: CVE-2024-52525
Published: 2024-11-15
Description: Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
CVSS Score: 1.8 (LOW)
CWE: CWE-312
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7v5-mgxm-v6gm; https://github.com/nextcloud/server/commit/d25a0a2896a2a981939cacb8ee0d555feef22b3b; https://github.com/nextcloud/server/pull/48915
CVE: CVE-2024-52528
Published: 2024-11-15
Description: Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2.
CWE: CWE-285
References: https://github.com/BudgetControl/Gateway/security/advisories/GHSA-jqx6-gm7f-vp7m
CVE: CVE-2024-11250
Published: 2024-11-15
Description: A vulnerability was found in code-projects Inventory Management up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /model/editProduct.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/sh3rl0ckpggp/0day/blob/main/inventory-management_authenticated_sqli.md; https://vuldb.com/?ctiid.284686
CVE: CVE-2024-11251
Published: 2024-11-15
Description: A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportController.do of the component AuthInterceptor. The manipulation of the argument begin_date leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IB2XZG; https://vuldb.com/?ctiid.284687; https://vuldb.com/?id.284687
CVE: CVE-2024-24447
Published: 2024-11-15
Description: A buffer overflow in the ngap_amf_handle_pdu_session_resource_setup_response function of oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a PDU Session Resource Setup Response with an empty Response Item list.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://cellularsecurity.org/ransacked; https://openairinterface.org/
CVE: CVE-2024-24449
Published: 2024-11-15
Description: An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted InitialUEMessage message sent to the AMF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-824
References: https://cellularsecurity.org/ransacked; https://openairinterface.org/
CVE: CVE-2024-24450
Published: 2024-11-15
Description: Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allows a remote attacker with access to the N2 interface to carry out denial of service against the AMF and potentially execute code by sending a PDU Session Resource Setup Response with a suffciently large FailedToSetupList IE.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://cellularsecurity.org/ransacked; https://openairinterface.org/
CVE: CVE-2024-40638
Published: 2024-11-15
Description: GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-8843-r3m7-gfqx
CVE: CVE-2024-41678
Published: 2024-11-15
Description: GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-xwmx-mmrf-hqf9
CVE: CVE-2024-46383
Published: 2024-11-15
Description: Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext.
CVSS Score: 2.4 (LOW)
CWE: CWE-312
References: http://skyworth.com; https://github.com/nitinronge91/Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383
CVE: CVE-2024-46462
Published: 2024-11-15
Description: By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ZEDMAIL has to be modified to prevent this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.primx.eu/en/bulletins/security-bulletin-24931936/
CVE: CVE-2024-46463
Published: 2024-11-15
Description: By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ORIZON has to be modified to prevent this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.primx.eu/en/bulletins/security-bulletin-24932297/
CVE: CVE-2024-46465
Published: 2024-11-15
Description: By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of CRYHOD has to be modified to prevent this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.primx.eu/en/bulletins/security-bulletin-24932296/
CVE: CVE-2024-46466
Published: 2024-11-15
Description: By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ZONECENTRAL has to be modified to prevent this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.primx.eu/en/bulletins/security-bulletin-24931934/
CVE: CVE-2024-46467
Published: 2024-11-15
Description: By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ZONEPOINT has to be modified to prevent this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.primx.eu/en/bulletins/security-bulletin-24932299/
CVE: CVE-2024-47759
Published: 2024-11-15
Description: GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when any user will try to see the document contents. Upgrade to 10.0.17.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-474f-9vpp-xxq5
CVE: CVE-2024-50800
Published: 2024-11-15
Description: Cross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote attacker to execute arbitrary code via the error parameter in URL
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Jellyfishxoxo/vulnerability-research/tree/main/CVE-2024-50800
CVE: CVE-2024-52507
Published: 2024-11-15
Description: Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permissions was not limited to affected users. It is recommended that the Nextcloud Tables app is upgraded to 0.8.1.
CVSS Score: 3.5 (LOW)
CWE: CWE-639
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rgvc-xr2w-qq45; https://github.com/nextcloud/tables/commit/13ca45f1b9f70f694aea81b78bc7416ec840c332; https://github.com/nextcloud/tables/pull/1406
CVE: CVE-2024-52508
Published: 2024-11-15
Description: Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7 or 4.0.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://github.com/nextcloud/mail/commit/a84c70e15d814dab6f0e8eda71bbaaf48152079b; https://github.com/nextcloud/mail/pull/9964; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vmhx-hwph-q6mc
CVE: CVE-2024-52509
Published: 2024-11-15
Description: Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/mail/commit/8d44f1ce44684022aa4e62a3e0462fdadcde6c8b; https://github.com/nextcloud/mail/pull/9592; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwpp-fvcr-w862
CVE: CVE-2024-52510
Published: 2024-11-15
Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-295
References: https://github.com/nextcloud/desktop/commit/97539218e6f63c3a3fd1694cb7d8aef27c5910d7; https://github.com/nextcloud/desktop/pull/7333; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r4qc-m9mj-452v
CVE: CVE-2024-52511
Published: 2024-11-15
Description: Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4qqp-9h2g-7qg7; https://github.com/nextcloud/tables/commit/52846ad81fe192ee977f14c82a229b0d9cdc406c; https://github.com/nextcloud/tables/pull/1351
CVE: CVE-2024-52512
Published: 2024-11-15
Description: user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0.
CVSS Score: 3.3 (LOW)
CWE: CWE-601
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-784j-x2g5-4g7q; https://github.com/nextcloud/user_oidc/commit/c923428d51972f6d04636c6accbecdec0c1b88e9; https://github.com/nextcloud/user_oidc/pull/961
CVE: CVE-2024-52513
Published: 2024-11-15
Description: Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gxph-5m4j-pfmj; https://github.com/nextcloud/text/commit/ca24b25c93b81626b4e457c260243edeab5f1548; https://github.com/nextcloud/text/pull/6485
CVE: CVE-2024-52514
Published: 2024-11-15
Description: Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 27.1.9, 28.0.5 or 29.0.0 and Nextcloud Enterprise Server is upgraded to 21.0.9.18, 22.2.10.23, 23.0.12.18, 24.0.12.14, 25.0.13.9, 26.0.13.3, 27.1.9, 28.0.5 or 29.0.0.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g8pr-g25r-58xj; https://github.com/nextcloud/server/commit/5fffbcfe8650eab75b00e8d188fbc95b0e43f3a8; https://github.com/nextcloud/server/pull/44889
CVE: CVE-2024-52522
Published: 2024-11-15
Description: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.
CWE: CWE-59, CWE-61, CWE-281
References: https://github.com/rclone/rclone/commit/01ccf204f42b4f68541b[PII_REDACTED]090a2dcf0; https://github.com/rclone/rclone/security/advisories/GHSA-hrxh-9w67-g4cv
CVE: CVE-2024-23169
Published: 2024-11-15
Description: The web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule creation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://community.netwitness.com/t5/netwitness-platform-online/tkb-p/netwitness-online-documentation; https://community.netwitness.com/t5/netwitness-platform-product/nw-2024-05-netwitness-platform-cross-site-scripting-xss/ta-p/719453
CVE: CVE-2024-24425
Published: 2024-11-15
Description: Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://cellularsecurity.org/ransacked; https://github.com/OPENAIRINTERFACE/openair-epc-fed; https://github.com/magma/magma
CVE: CVE-2024-24426
Published: 2024-11-15
Description: Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://cellularsecurity.org/ransacked; https://github.com/OPENAIRINTERFACE/openair-epc-fed; https://github.com/magma/magma
CVE: CVE-2024-24431
Published: 2024-11-15
Description: A reachable assertion in the ogs_nas_emm_decode function of Open5GS v2.7.0 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet with a zero-length EMM message length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://cellularsecurity.org/ransacked; https://open5gs.org/
CVE: CVE-2024-24446
Published: 2024-11-15
Description: An uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted InitialContextSetupResponse message sent to the AMF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://cellularsecurity.org/ransacked; https://openairinterface.org/
CVE: CVE-2024-41679
Published: 2024-11-15
Description: GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-hq9q-jfhp-qqgm
CVE: CVE-2024-43417
Published: 2024-11-15
Description: GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Software form. Upgrade to 10.0.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-p633-wfj5-8x44
CVE: CVE-2024-43418
Published: 2024-11-15
Description: GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-x8jv-fcwx-3x6m
CVE: CVE-2024-45608
Published: 2024-11-15
Description: GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-67p8-v79j-jp86
CVE: CVE-2024-45969
Published: 2024-11-15
Description: NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33 allows a malicious server to Cause a Denial-of-Service via the MMS InitiationResponse message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://encs.eu/news/critical-security-vulnerabilities-discovered-in-mz-automations-mms-client/; https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33
CVE: CVE-2024-45970
Published: 2024-11-15
Description: Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cause a stack-based buffer overflow via the MMS FileDirResponse message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://encs.eu/news/critical-security-vulnerabilities-discovered-in-mz-automations-mms-client/; https://github.com/mz-automation/libiec61850/commit/ac925fae8e281ac6defcd630e9dd756264e9c5bc
CVE: CVE-2024-45971
Published: 2024-11-15
Description: Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cause a stack-based buffer overflow via the MMS IdentifyResponse message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://encs.eu/news/critical-security-vulnerabilities-discovered-in-mz-automations-mms-client/; https://github.com/mz-automation/libiec61850/commit/1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0
CVE: CVE-2024-51037
Published: 2024-11-15
Description: An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: http://kodbox.com; https://github.com/kalcaddle/kodbox; https://www.tommonkey.cn/2024/11/13/CVE-2024-51037-Disclosed/
CVE: CVE-2024-51141
Published: 2024-11-15
Description: An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll components.
CVSS Score: 7.8 (HIGH)
CWE: CWE-354
References: https://infosecwriteups.com/dll-hijacking-in-totolink-a600ub-driver-installer-13787c4d97b4
CVE: CVE-2024-51142
Published: 2024-11-15
Description: Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute arbitrary code via the svkey parameter of the storageapi.php file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://infosecwriteups.com/chamilo-lms-authentication-bypass-and-cross-site-scripting-stored-3fcb874ac7c1