deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43803
Published: 2024-09-03
Description: The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the `userData`, `metaData`, and `networkData` for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the `Name` and `Namespace` of the Secret, meaning that versions of the baremetal-operator prior to 0.8.0, 0.6.2, and 0.5.2 will read a `Secret` from any namespace. A user with access to create or edit a `BareMetalHost` can thus exfiltrate a `Secret` from another namespace by using it as e.g. the `userData` for provisioning some host (note that this need not be a real host, it could be a VM somewhere).

BMO will only read a key with the name `value` (or `userData`, `metaData`, or `networkData`), so that limits the exposure somewhat. `value` is probably a pretty common key though. Secrets used by _other_ `BareMetalHost`s in different namespaces are always vulnerable. It is probably relatively unusual for anyone other than cluster administrators to have RBAC access to create/edit a `BareMetalHost`. This vulnerability is only meaningful, if the cluster has users other than administrators and users' privileges are limited to their respective namespaces.

The patch prevents BMO from accepting links to Secrets from other namespaces as BMH input. Any BMH configuration is only read from the same namespace only. The problem is patched in BMO releases v0.7.0, v0.6.2 and v0.5.2 and users should upgrade to those versions. Prior upgrading, duplicate the BMC Secrets to the namespace where the corresponding BMH is. After upgrade, remove the old Secrets. As a workaround, an operator can configure BMO RBAC to be namespace scoped for Secrets, instead of cluster scoped, to prevent BMO from accessing Secrets from other namespaces.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-653
References: https://github.com/metal3-io/baremetal-operator/commit/3af4882e9c5fadc1a7550f53daea21dccd271f74; https://github.com/metal3-io/baremetal-operator/commit/bedae7b997d16f36e[PII_REDACTED]69bb8eb4dadbb; https://github.com/metal3-io/baremetal-operator/commit/c2b5a557641bc[PII_REDACTED]24047d6c958aa15f7
CVE: CVE-2024-45307
Published: 2024-09-03
Description: SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the `-config` command in versions prior to 9.26.7. Anyone is theoretically able to update any configuration of the bot and potentially gain control over the bot's settings. Every version of v9 before v9.26.7 is affected. Other versions (e.g. v8) are not affected. Users should upgrade to version 9.26.7 to receive a patch. A workaround would be to create a command permission overwrite in the Database. A SQL statement provided in the GitHub Security Advisor can be executed to create a overwrite that disallows users without `ManageGuild` permission to run the `-config` command. Run the SQL statement for every server the bot is in, and replace `<guild_id>` with the appropriate Guild ID each time.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285, CWE-862, CWE-862
References: https://github.com/onesoft-sudo/sudobot/commit/ef46ca98562f3c1abef4ff7dd94d8f7b8155ee50; https://github.com/onesoft-sudo/sudobot/security/advisories/GHSA-crgg-w3rr-r9h4
CVE: CVE-2024-45310
Published: 2024-09-03
Description: runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3.

Some workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual
user on the host (such as with rootless containers that don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.
CVSS Score: 3.6 (LOW)
CWE: CWE-61, CWE-363
References: https://github.com/opencontainers/runc/commit/63c2908164f3a1daea455bf5bcd8d363d70328c7; https://github.com/opencontainers/runc/commit/[PII_REDACTED]fd964ac723ff5f360b6f259e809a3e; https://github.com/opencontainers/runc/commit/f0b652ea61ff6750a8fcc69865d45a7abf37accf
CVE: CVE-2024-41434
Published: 2024-09-03
Description: PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal. This allows attackers to cause a Denial of Service (DoS) via a crafted input to the 'RemoveUnnecessaryFirstRow', it will check the expression between 'Agg' and 'GroupBy', but does not check the return type. NOTE: PingCAP disputes this, arguing that reproduction did not cause the security impact of service interruption to other users. They maintain it is a complex query bug in the product but not a DoS.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://gist.github.com/ycybfhb/4aa6809695b9e8a1cd1429e597c17517; https://github.com/pingcap/tidb/issues/53733
CVE: CVE-2024-45180
Published: 2024-09-03
Description: SquaredUp DS for SCOM 6.2.1.11104 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://scomsupport.squaredup.com/reference/security-advisory/cve-2024-45180-stored-cross-site-scripting-knowledge-editor-tile; https://squaredup.com
CVE: CVE-2024-45389
Published: 2024-09-03
Description: Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script the user loads. This information is gathered by looking up the value of `document.currentScript.src`. Prior to Pagefind version 1.1.1, it is possible to "clobber" this lookup with otherwise benign HTML on the page. This will cause `document.currentScript.src` to resolve as an external domain, which will then be used by Pagefind to load dependencies. This exploit would only work in the case that an attacker could inject HTML to a live, hosted, website. In these cases, this would act as a way to escalate the privilege available to an attacker. This assumes they have the ability to add some elements to the page (for example, `img` tags with a `name` attribute), but not others, as adding a `script` to the page would itself be the cross-site scripting vector. Pagefind has tightened this resolution in version 1.1.1 by ensuring the source is loaded from a valid script element. There are no reports of this being exploited in the wild via Pagefind.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/CloudCannon/pagefind/commit/14ec96864eabaf1d7d809d5da0186a8856261eeb; https://github.com/CloudCannon/pagefind/security/advisories/GHSA-gprj-6m2f-j9hx; https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
CVE: CVE-2024-45390
Published: 2024-09-03
Description: @blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or don't use the display name feature.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa; https://github.com/blakeembrey/js-template/security/advisories/GHSA-q765-wm9j-66qj
CVE: CVE-2024-45391
Published: 2024-09-03
Description: Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search token may be vulnerable to the search token being leaked via lock file (tina-lock.json). Administrators of Tina-enabled websites with search setup should rotate their key immediately. This issue has been patched in @tinacms/cli version 1.6.2. Upgrading and rotating the search token is required for the proper fix.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-312
References: https://github.com/tinacms/tinacms/commit/110f1ceea4574d636a64526648f7c8bf6539b26a; https://github.com/tinacms/tinacms/pull/4758; https://github.com/tinacms/tinacms/security/advisories/GHSA-4qrm-9h4r-v2fx
CVE: CVE-2024-45678
Published: 2024-09-03
Description: Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/; https://news.ycombinator.com/item?id=41434500; https://ninjalab.io/eucleak/
CVE: CVE-2024-4629
Published: 2024-09-03
Description: A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-837
References: https://access.redhat.com/errata/RHSA-2024:6493; https://access.redhat.com/errata/RHSA-2024:6494; https://access.redhat.com/errata/RHSA-2024:6495
CVE: CVE-2024-8399
Published: 2024-09-03
Description: Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1863838; https://www.mozilla.org/security/advisories/mfsa2024-42/
CVE: CVE-2024-41433
Published: 2024-09-03
Description: PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component expression.ExplainExpressionList. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. NOTE: PingCAP maintains that the actual reproduction of this issue did not cause the security impact of service interruption to other users. They argue that this is a complex query bug and not a DoS vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://gist.github.com/ycybfhb/eec3a1eefe4c85eb22f1bca6114359a1; https://github.com/pingcap/tidb/issues/53796
CVE: CVE-2024-45394
Published: 2024-09-03
Description: Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the user's encryption key. Users on version 8.0.0 and above are automatically migrated away from the weak encoding on first login. Users should destroy encrypted backups made with versions prior to 8.0.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-261, CWE-327, CWE-326, CWE-327
References: https://github.com/Authenticator-Extension/Authenticator/commit/17aa2068553db3c3aac081c9ffe393536f33b28b; https://github.com/Authenticator-Extension/Authenticator/security/advisories/GHSA-gv8m-vgp8-q2xr
CVE: CVE-2024-44809
Published: 2024-09-03
Description: A remote code execution (RCE) vulnerability exists in the Pi Camera project, version 1.0, maintained by RECANTHA. The issue arises from improper sanitization of user input passed to the "position" GET parameter in the tilt.php script. An attacker can exploit this by sending crafted input data that includes malicious command sequences, allowing arbitrary commands to be executed on the server with the privileges of the web server user. This vulnerability is exploitable remotely and poses significant risk if the application is exposed to untrusted networks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/recantha/camera-pi/blob/ef018d212288cb16404f0b050593d20f0dc0467b/www/tilt.php#L4; https://jacobmasse.medium.com/cve-2024-44809-remote-code-execution-in-raspberry-pi-camera-project-4b8e3486a628
CVE: CVE-2024-45615
Published: 2024-09-03
Description: A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. 
The problem is missing  initialization of variables expected to be initialized (as arguments to other functions, etc.).
CVSS Score: 3.9 (LOW)
CWE: CWE-457, CWE-908
References: https://access.redhat.com/security/cve/CVE-2024-45615; https://bugzilla.redhat.com/show_bug.cgi?id=2309285; https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
CVE: CVE-2024-45616
Published: 2024-09-03
Description: A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. 

The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card.
CVSS Score: 3.9 (LOW)
CWE: CWE-457, CWE-908
References: https://access.redhat.com/security/cve/CVE-2024-45616; https://bugzilla.redhat.com/show_bug.cgi?id=2309290; https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
CVE: CVE-2024-45617
Published: 2024-09-03
Description: A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. 

Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized.
CVSS Score: 3.9 (LOW)
CWE: CWE-457, CWE-908
References: https://access.redhat.com/security/cve/CVE-2024-45617; https://bugzilla.redhat.com/show_bug.cgi?id=2309286; https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
CVE: CVE-2024-45618
Published: 2024-09-03
Description: A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. 

Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized.
CVSS Score: 3.9 (LOW)
CWE: CWE-457, CWE-908
References: https://access.redhat.com/security/cve/CVE-2024-45618; https://bugzilla.redhat.com/show_bug.cgi?id=2309287; https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
CVE: CVE-2024-45619
Published: 2024-09-03
Description: A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-120
References: https://access.redhat.com/security/cve/CVE-2024-45619; https://bugzilla.redhat.com/show_bug.cgi?id=2309288; https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
CVE: CVE-2024-45620
Published: 2024-09-03
Description: A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.
CVSS Score: 3.9 (LOW)
CWE: CWE-120
References: https://access.redhat.com/security/cve/CVE-2024-45620; https://bugzilla.redhat.com/show_bug.cgi?id=2309289; https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
CVE: CVE-2024-7970
Published: 2024-09-03
Description: Out of bounds write in V8 in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/358485426
CVE: CVE-2024-8362
Published: 2024-09-03
Description: Use after free in WebAudio in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/357391257
CVE: CVE-2024-41716
Published: 2024-09-04
Description: Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the product's project file may obtain user credentials of the PLC or Operator Interfaces. As a result, an attacker may be able to manipulate and/or suspend the PLC and Operator Interfaces by accessing or hijacking them.
CVSS Score: 8.1 (HIGH)
CWE: CWE-312, CWE-312
References: https://jvn.jp/en/jp/JVN08342147/; https://us.idec.com/media/24-RD-0219-EN.pdf
CVE: CVE-2024-41927
Published: 2024-09-04
Description: Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communication port, user credentials may be obtained. As a result, the program of the PLC may be obtained, and the PLC may be manipulated.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-319, CWE-319, CWE-319
References: https://jvn.jp/en/vu/JVNVU96959731/; https://us.idec.com/media/24-RD-0256-EN-b.pdf
CVE: CVE-2024-42039
Published: 2024-09-04
Description: Access control vulnerability in the SystemUI module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-45441
Published: 2024-09-04
Description: Input verification vulnerability in the system service module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-45442
Published: 2024-09-04
Description: Vulnerability of permission verification for APIs in the DownloadProviderMain module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-45450
Published: 2024-09-04
Description: Permission control vulnerability in the software update module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-39921
Published: 2024-09-04
Description: Observable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V02L21NF0301, and IPCOM VE2 Series V01L04NF0001 to V01L06NF0112. If this vulnerability is exploited, some of the encrypted communication may be decrypted by an attacker who can obtain the contents of the communication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203, CWE-203
References: https://jvn.jp/en/jp/JVN29238389/; https://www.fujitsu.com/jp/products/network/support/2024/ipcom-04/
CVE: CVE-2024-45443
Published: 2024-09-04
Description: Directory traversal vulnerability in the cust module
Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-45444
Published: 2024-09-04
Description: Access permission verification vulnerability in the WMS module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-45445
Published: 2024-09-04
Description: Vulnerability of resources not being closed or released in the keystore module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-459, CWE-459
References: https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-45446
Published: 2024-09-04
Description: Access permission verification vulnerability in the camera driver module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-45447
Published: 2024-09-04
Description: Access control vulnerability in the camera framework module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-45448
Published: 2024-09-04
Description: Page table protection configuration vulnerability in the trusted firmware module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-1259
References: https://consumer.huawei.com/en/support/bulletin/2024/11/; https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-45449
Published: 2024-09-04
Description: Access permission verification vulnerability in the ringtone setting module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE: CVE-2024-7950
Published: 2024-09-04
Description: The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Attackers can also update arbitrary settings and create user accounts even when registration is disabled, leading to user creation with a default role of Administrator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.1.5/includes/formhandler.php; https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.1.5/includes/includer.php; https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.1.5/includes/wpjobportal-hooks.php