deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-52221
Published: 2024-01-24
Description: Unrestricted Upload of File with Dangerous Type vulnerability in UkrSolution Barcode Scanner and Inventory manager.This issue affects Barcode Scanner and Inventory manager: from n/a through 1.5.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://patchstack.com/database/vulnerability/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/wordpress-barcode-scanner-with-inventory-order-manager-plugin-1-5-1-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/wordpress-barcode-scanner-with-inventory-order-manager-plugin-1-5-1-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-22134
Published: 2024-01-24
Description: Server-Side Request Forgery (SSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/contact-form-7-mailchimp-extension/wordpress-contact-form-7-extension-for-mailchimp-plugin-0-5-70-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-7-mailchimp-extension/wordpress-contact-form-7-extension-for-mailchimp-plugin-0-5-70-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-22135
Published: 2024-01-24
Description: Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for WooCommerce: from n/a through 2.4.3.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/order-import-export-for-woocommerce/wordpress-order-export-order-import-for-woocommerce-plugin-2-4-3-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/order-import-export-for-woocommerce/wordpress-order-export-order-import-for-woocommerce-plugin-2-4-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-22152
Published: 2024-01-24
Description: Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a through 2.3.7.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/product-import-export-for-woo/wordpress-product-import-export-for-woocommerce-plugin-2-3-7-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/product-import-export-for-woo/wordpress-product-import-export-for-woocommerce-plugin-2-3-7-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-22284
Published: 2024-01-24
Description: Deserialization of Untrusted Data vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.7.2.
CVSS Score: 8.7 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/asgaros-forum/wordpress-asgaros-forum-plugin-2-7-2-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/asgaros-forum/wordpress-asgaros-forum-plugin-2-7-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-22294
Published: 2024-01-24
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Blocker: from n/a through 2.33.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/ip2location-country-blocker/wordpress-ip2location-country-blocker-plugin-2-33-3-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ip2location-country-blocker/wordpress-ip2location-country-blocker-plugin-2-33-3-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-22301
Published: 2024-01-24
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: from n/a through 4.6.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-276
References: https://patchstack.com/database/vulnerability/albo-pretorio-on-line/wordpress-albo-pretorio-on-line-plugin-4-6-6-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/albo-pretorio-on-line/wordpress-albo-pretorio-on-line-plugin-4-6-6-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-22308
Published: 2024-01-24
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.4.1.
CVSS Score: 3.4 (LOW)
CWE: CWE-601, CWE-601
References: https://patchstack.com/database/vulnerability/simple-membership/wordpress-simple-membership-plugin-4-4-1-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-membership/wordpress-simple-membership-plugin-4-4-1-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-22309
Published: 2024-01-24
Description: Deserialization of Untrusted Data vulnerability in QuantumCloud ChatBot with AI.This issue affects ChatBot with AI: from n/a through 5.1.0.
CVSS Score: 8.7 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/chatbot/wordpress-ai-chatbot-plugin-5-1-0-unauthenticated-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chatbot/wordpress-ai-chatbot-plugin-5-1-0-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-50943
Published: 2024-01-24
Description: Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.openwall.com/lists/oss-security/2024/01/24/4; https://github.com/apache/airflow/pull/36255; https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn
CVE: CVE-2023-50944
Published: 2024-01-24
Description: Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2024/01/24/5; https://github.com/apache/airflow/pull/36257; https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h
CVE: CVE-2023-51702
Published: 2024-01-24
Description: Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster.

This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-532
References: http://www.openwall.com/lists/oss-security/2024/01/24/3; https://github.com/apache/airflow/pull/29498; https://github.com/apache/airflow/pull/30110
CVE: CVE-2024-22154
Published: 2024-01-24
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/salesking/wordpress-salesking-plugin-1-6-15-unauthenticated-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/salesking/wordpress-salesking-plugin-1-6-15-unauthenticated-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2023-6697
Published: 2024-01-24
Description: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, and including, 9.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3022232/wp-google-maps/trunk/html/atlas-novus/map-edit-page/map-edit-page.html.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c3115b-8921-429d-b517-b946edab1cd5?source=cve; https://plugins.trac.wordpress.org/changeset/3022232/wp-google-maps/trunk/html/atlas-novus/map-edit-page/map-edit-page.html.php
CVE: CVE-2024-22141
Published: 2024-01-24
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/profile-builder-pro/wordpress-profile-builder-pro-plugin-3-10-0-totp-secret-key-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profile-builder-pro/wordpress-profile-builder-pro-plugin-3-10-0-totp-secret-key-exposure-vulnerability?_s_id=cve
CVE: CVE-2023-44281
Published: 2024-01-24
Description: 
Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability. A low privilege user with local access to the system could potentially exploit this vulnerability to delete arbitrary files and result in Denial of Service.


CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: https://www.dell.com/support/kbdoc/en-us/000219185/dsa-2023-141; https://www.dell.com/support/kbdoc/en-us/000219185/dsa-2023-141
CVE: CVE-2024-22651
Published: 2024-01-24
Description: There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/goldds96/Report/blob/main/DLink/DIR-815/CI.md; https://github.com/goldds96/Report/blob/main/DLink/DIR-815/CI.md
CVE: CVE-2024-22725
Published: 2024-01-24
Description: Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://orthanc.uclouvain.be/hg/orthanc/file/Orthanc-1.12.2/NEWS; https://orthanc.uclouvain.be/hg/orthanc/rev/505416b269a0; https://orthanc.uclouvain.be/hg/orthanc/file/Orthanc-1.12.2/NEWS
CVE: CVE-2023-51885
Published: 2024-01-24
Description: Buffer Overflow vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via the length of the LaTeX string component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/; https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/
CVE: CVE-2023-51886
Published: 2024-01-24
Description: Buffer Overflow vulnerability in the main() function in Mathtex 1.05 and before allows a remote attacker to cause a denial of service when using \convertpath.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/; https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/
CVE: CVE-2023-51887
Published: 2024-01-24
Description: Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in application URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/; https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/
CVE: CVE-2024-22229
Published: 2024-01-24
Description: 
Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vulnerability to forge log entries, create false alarms, and inject malicious content into logs that compromise logs integrity. A malicious attacker could also prevent the product from logging information while malicious actions are performed or implicate an arbitrary user for malicious activities.


CVSS Score: 3.1 (LOW)
CWE: CWE-117, CWE-116
References: https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2024-23641
Published: 2024-01-24
Description: SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/sveltejs/kit/commit/af34142631c876a7eb62ff81f71e8a3f90dafee9; https://github.com/sveltejs/kit/security/advisories/GHSA-g5m6-hxpp-fc49; https://github.com/sveltejs/kit/commit/af34142631c876a7eb62ff81f71e8a3f90dafee9
CVE: CVE-2021-42143
Published: 2024-01-24
Description: An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-835, CWE-835
References: https://seclists.org/fulldisclosure/2024/Jan/16; http://seclists.org/fulldisclosure/2024/Jan/16; https://seclists.org/fulldisclosure/2024/Jan/16
CVE: CVE-2021-42144
Published: 2024-01-24
Description: Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafted input to dtls_ccm_decrypt_message().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://seclists.org/fulldisclosure/2024/Jan/17; http://seclists.org/fulldisclosure/2024/Jan/17; https://seclists.org/fulldisclosure/2024/Jan/17
CVE: CVE-2023-51888
Published: 2024-01-24
Description: Buffer Overflow vulnerability in the nomath() function in Mathtex v.1.05 and before allows a remote attacker to cause a denial of service via a crafted string in the application URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/; https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/
CVE: CVE-2023-51889
Published: 2024-01-24
Description: Stack Overflow vulnerability in the validate() function in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in the application URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/; https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/
CVE: CVE-2023-51890
Published: 2024-01-24
Description: An infinite loop issue discovered in Mathtex 1.05 and before allows a remote attackers to consume CPU resources via crafted string in the application URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/; https://blog.yulun.ac.cn/posts/2023/fuzzing-mathtex/
CVE: CVE-2023-52038
Published: 2024-01-24
Description: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/1/1.md; https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/1/1.md
CVE: CVE-2023-52039
Published: 2024-01-24
Description: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/2/2.md; https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/2/2.md
CVE: CVE-2023-52040
Published: 2024-01-24
Description: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-253
References: https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/3/3.md; https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/3/3.md
CVE: CVE-2024-22720
Published: 2024-01-24
Description: Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cupc4k3.medium.com/html-injection-vulnerability-in-kanboard-group-management-d9fe5154bb1b; https://cupc4k3.medium.com/html-injection-vulnerability-in-kanboard-group-management-d9fe5154bb1b
CVE: CVE-2024-23648
Published: 2024-01-24
Description: Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able to retrieve it would be able to resets the user's password. Prior to version 1.2.3, the reset-password URL is crafted using the "Host" HTTP header of the request sent to request a password reset. This way, an external attacker could send password requests for users, but specify a "Host" header of a website that they control. If the user receiving the mail clicks on the link, the attacker would retrieve the reset token of the victim and perform account takeover. Version 1.2.3 fixes this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://github.com/pimcore/admin-ui-classic-bundle/commit/70f2205b5a5ea9584721d4f3e803f4d0dd5e4655; https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-mrqg-mwh7-q94j; https://github.com/pimcore/admin-ui-classic-bundle/commit/70f2205b5a5ea9584721d4f3e803f4d0dd5e4655
CVE: CVE-2024-23649
Published: 2024-01-24
Description: Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating a private message report contains the private message itself, which means any user can just iterate over message ids to (loudly) obtain all private messages of an instance. A user with instance admin privileges can also abuse this if the private message is removed from the response, as they're able to see the resulting reports.

Creating a private message report by POSTing to `/api/v3/private_message/report` does not validate whether the reporter is the recipient of the message. lemmy-ui does not allow the sender to report the message; the API method should likely be restricted to accessible to recipients only. The API response when creating a report contains the `private_message_report_view` with all the details of the report, including the private message that has been reported:

Any authenticated user can obtain arbitrary (untargeted) private message contents. Privileges required depend on the instance configuration; when registrations are enabled without application system, the privileges required are practically none. When registration applications are required, privileges required could be considered low, but this assessment heavily varies by instance.

Version 0.19.1 contains a patch for this issue. A workaround is available. If an update to a fixed Lemmy version is not immediately possible, the API route can be blocked in the reverse proxy. This will prevent anyone from reporting private messages, but it will also prevent exploitation before the update has been applied.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-285
References: https://github.com/LemmyNet/lemmy/commit/bc32b408b523b9b64aa57b8e47748f96cce0dae5; https://github.com/LemmyNet/lemmy/security/advisories/GHSA-r64r-5h43-26qv; https://github.com/LemmyNet/lemmy/commit/bc32b408b523b9b64aa57b8e47748f96cce0dae5
CVE: CVE-2024-23897
Published: 2024-01-24
Description: Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-27
References: http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html; http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html; http://www.openwall.com/lists/oss-security/2024/01/24/6
CVE: CVE-2024-23898
Published: 2024-01-24
Description: Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346, CWE-346
References: http://www.openwall.com/lists/oss-security/2024/01/24/6; https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315; https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
CVE: CVE-2024-23899
Published: 2024-01-24
Description: Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2024/01/24/6; https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3319; http://www.openwall.com/lists/oss-security/2024/01/24/6
CVE: CVE-2024-23900
Published: 2024-01-24
Description: Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/01/24/6; https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289; http://www.openwall.com/lists/oss-security/2024/01/24/6