deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-22123
Published: 2024-08-12
Description: Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.
CVSS Score: 2.7 (LOW)
CWE: CWE-94, CWE-94
References: https://support.zabbix.com/browse/ZBX-25013; https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html
CVE: CVE-2024-29082
Published: 2024-08-12
Description: Improper access control vulnerability affecting Vonets

 industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 
and prior, enables an unauthenticated remote attacker to bypass 
authentication and factory reset the device via unprotected goform 
endpoints.
CVSS Score: 8.6 (HIGH)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
CVE: CVE-2024-29831
Published: 2024-08-12
Description: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0; http://www.openwall.com/lists/oss-security/2024/08/09/6
CVE: CVE-2024-30188
Published: 2024-08-12
Description: File read and write vulnerability in Apache DolphinScheduler ,  authenticated users can illegally access additional resource files.
This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.

Users are recommended to upgrade to version 3.2.2, which fixes the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://lists.apache.org/thread/tbrt42mnr42bq6scxwt6bjr3s2pwyd07; http://www.openwall.com/lists/oss-security/2024/08/09/7
CVE: CVE-2024-32765
Published: 2024-08-12
Description: A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain access to and execute certain functions via unspecified vectors.

We have already fixed the vulnerability in the following versions:
QTS 5.1.8.2823 build 20240712 and later
QuTS hero h5.1.8.2823 build 20240712 and later
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-291, CWE-306
References: https://www.qnap.com/en/security-advisory/qsa-24-14
CVE: CVE-2024-36034
Published: 2024-08-12
Description: Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/sqlfix-8003.html
CVE: CVE-2024-36035
Published: 2024-08-12
Description: Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/sqlfix-8003.html
CVE: CVE-2024-36460
Published: 2024-08-12
Description: The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.
CVSS Score: 8.1 (HIGH)
CWE: CWE-256, CWE-522
References: https://support.zabbix.com/browse/ZBX-25017; https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html
CVE: CVE-2024-36461
Published: 2024-08-12
Description: Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-822
References: https://support.zabbix.com/browse/ZBX-25018; https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html
CVE: CVE-2024-36462
Published: 2024-08-12
Description: Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or degrade the performance of the affected system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://support.zabbix.com/browse/ZBX-25019
CVE: CVE-2024-36518
Published: 2024-08-12
Description: Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-36518.html
CVE: CVE-2024-37023
Published: 2024-08-12
Description: Multiple OS command injection vulnerabilities affecting Vonets 

 industrial wifi bridge relays and wifi bridge repeaters, software 
versions 3.3.23.6.9 and prior, enable an authenticated remote attacker 
to execute arbitrary OS commands via various endpoint parameters.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
CVE: CVE-2024-37283
Published: 2024-08-12
Description: An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By default the log level is set to info, where no leak occurs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://discuss.elastic.co/t/elastic-agent-8-15-0-security-update-esa-2024-23/364635
CVE: CVE-2024-37826
Published: 2024-08-12
Description: A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://gist.github.com/Evian-Zhang/4453e7ac0da7cfa421c76c5ab514dba4
CVE: CVE-2024-38200
Published: 2024-08-12
Description: Microsoft Office Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38200
CVE: CVE-2024-38218
Published: 2024-08-12
Description: Microsoft Edge (HTML-based) Memory Corruption Vulnerability
CVSS Score: 8.4 (HIGH)
CWE: CWE-843, CWE-787, CWE-119
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38218
CVE: CVE-2024-38219
Published: 2024-08-12
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38219
CVE: CVE-2024-38989
Published: 2024-08-12
Description: izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://gist.github.com/mestrtee/5e9830fb180a34d65f04fafb52d2b94b; https://github.com/izatop/bunt/commit/c55201a8cee03e5282f99874dead988c80d31db7
CVE: CVE-2024-39338
Published: 2024-08-12
Description: axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/axios/axios/releases; https://jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html
CVE: CVE-2024-39791
Published: 2024-08-12
Description: Stack-based buffer overflow vulnerabilities affecting Vonets



 

 industrial wifi bridge relays and wifi bridge repeaters, software versions 
3.3.23.6.9 and prior, enable an unauthenticated remote attacker to 
execute arbitrary code.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
CVE: CVE-2024-39815
Published: 2024-08-12
Description: Improper check or handling of exceptional conditions vulnerability 
affecting Vonets

 

 industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an unauthenticated 
remote attacker to cause a denial of service. A specially-crafted 
HTTP request to pre-authentication resources can crash the service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-703
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
CVE: CVE-2024-3279
Published: 2024-08-12
Description: An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of the existing `anythingllm.db` file. By exploiting this vulnerability, attackers can serve malicious data to users or collect information about them. The vulnerability stems from the application's failure to properly restrict access to the data-import functionality, allowing unauthorized database manipulation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://github.com/mintplex-labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2; https://huntr.com/bounties/303c5145-2c14-4945-914a-936be74dd04e
CVE: CVE-2024-40472
Published: 2024-08-12
Description: Sourcecodester Daily Calories Monitoring Tool v1.0 is vulnerable to SQL Injection via "delete-calorie.php."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Daily%20Calories%20Monitoring%20Tool%20v1.0/SQL%20Injection.pdf; https://www.sourcecodester.com/php/17445/daily-calories-monitoring-tool-using-php-and-mysql-source-code.html
CVE: CVE-2024-40473
Published: 2024-08-12
Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.0. It allows remote attackers to execute arbitrary code via "House_no" and "Description" parameter fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/Stored%20XSS.pdf; https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html
CVE: CVE-2024-40474
Published: 2024-08-12
Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in "edit-cate.php" in SourceCodester House Rental Management System v1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/Reflected%20XSS.pdf; https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html
CVE: CVE-2024-40475
Published: 2024-08-12
Description: SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_report.php, /rental/balance_report.php, /rental/invoices.php, /rental/tenants.php, and /rental/users.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Deep%20URL.pdf; https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html
CVE: CVE-2024-40476
Published: 2024-08-12
Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking the administrator into adding/modifying/deleting valid tenant data via a crafted HTML page, as demonstrated by a Delete Tenant action at the /rental/ajax.php?action=delete_tenant.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/CSRF.pdf; https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html
CVE: CVE-2024-40477
Published: 2024-08-12
Description: A SQL injection vulnerability in "/oahms/admin/forgot-password.php" in PHPGurukul Old Age Home Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "email" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/PHPGurukul/Old%20Age%20Home%20Mgmt%20System%20v1.0/SQL%20Injection.pdf; https://phpgurukul.com/old-age-home-management-system-using-php-and-mysql/
CVE: CVE-2024-40478
Published: 2024-08-12
Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows remote attackers to execute arbitrary code via "rname" and "email" parameter fields
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Online%20Exam%20System%20v1.0/Stored%20XSS.pdf; https://www.kashipara.com/project/php/3/online-exam-php-project-source-code-download
CVE: CVE-2024-40479
Published: 2024-08-12
Description: A SQL injection vulnerability in "/admin/quizquestion.php" in Kashipara Online Exam System v1.0 allows remote attackers to execute arbitrary SQL commands via the "eid" parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Online%20Exam%20System%20v1.0/SQL%20Injection.pdf; https://www.kashipara.com/project/php/3/online-exam-php-project-source-code-download
CVE: CVE-2024-40480
Published: 2024-08-12
Description: A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthenticated attackers to view administrator dashboard and delete valid user accounts via the direct URL access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Online%20Exam%20System%20v1.0/Broken%20Access%20Control%20-%20Admin%20Dashboard%20and%20User%20Deletion.pdf; https://www.kashipara.com/project/php/3/online-exam-php-project-source-code-download
CVE: CVE-2024-40481
Published: 2024-08-12
Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/view-enquiry.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote attackers to execute arbitrary code via the Contact Us page "message" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/takekaramey/CVE_Writeup/blob/main/PHPGurukul/Old%20Age%20Home%20Mgmt%20System%20v1.0/Stored%20XSS.pdf
CVE: CVE-2024-40482
Published: 2024-08-12
Description: An Unrestricted file upload vulnerability was found in "/Membership/edit_member.php" of Kashipara Live Membership System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Live%20Membership%20System%20v1.0/Unrestricted%20File%20Upload.pdf
CVE: CVE-2024-40484
Published: 2024-08-12
Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in "/oahms/search.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote attackers to execute arbitrary code via the "searchdata" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/takekaramey/CVE_Writeup/blob/main/PHPGurukul/Old%20Age%20Home%20Mgmt%20System%20v1.0/Reflected%20XSS.pdf
CVE: CVE-2024-40486
Published: 2024-08-12
Description: A SQL injection vulnerability in "/index.php" of Kashipara Live Membership System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email or password Login parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Live%20Membership%20System%20v1.0/SQL%20Injection.pdf; https://www.kashipara.com/project/php/12997/live-membership-system-in-php-php-project-source-code
CVE: CVE-2024-40487
Published: 2024-08-12
Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "/view_type.php" of Kashipara Live Membership System v1.0, which allows remote attackers to execute arbitrary code via membershipType parameter.
CVSS Score: 7.6 (HIGH)
CWE: CWE-94
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Live%20Membership%20System%20v1.0/Stored%20XSS.pdf; https://www.kashipara.com/project/php/12997/live-membership-system-in-php-php-project-source-code
CVE: CVE-2024-40488
Published: 2024-08-12
Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in the Kashipara Live Membership System v1.0. This could lead to an attacker tricking the administrator into deleting valid member data via a crafted HTML page, as demonstrated by a Delete Member action at the /delete_members.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://capec.mitre.org/data/definitions/62.html; https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Live%20Membership%20System%20v1.0/CSRF.pdf
CVE: CVE-2024-41332
Published: 2024-08-12
Description: Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-level privileges to arbitrarily delete categories.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://packetstormsecurity.com/files/179890/Computer-Laboratory-Management-System-1.0-Privilege-Escalation.html; https://www.linkedin.com/in/sampath-kumar-kadajari-4b18891a7
CVE: CVE-2024-41476
Published: 2024-08-12
Description: AMTT Hotel Broadband Operation System (HiBOS) V3.0.3.151204 and before is vulnerable to SQL Injection via /manager/card/card_detail.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://gist.github.com/lidy4x1/3314fbd82c3d72831c16f9c47a9bfb11; https://www.amttgroup.com/
CVE: CVE-2024-41481
Published: 2024-08-12
Description: Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.typora.io/What%27s-New-1.9/
CVE: CVE-2024-41482
Published: 2024-08-12
Description: Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.typora.io/What%27s-New-1.9/
CVE: CVE-2024-41570
Published: 2024-08-12
Description: An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating from the team server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://blog.chebuya.com/posts/server-side-request-forgery-on-havoc-c2/
CVE: CVE-2024-41577
Published: 2024-08-12
Description: An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/SENVIEL/learun-upload_file/issues/1
CVE: CVE-2024-41888
Published: 2024-08-12
Description: Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-772
References: https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4; http://www.openwall.com/lists/oss-security/2024/08/09/5
CVE: CVE-2024-41890
Published: 2024-08-12
Description: Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-772
References: https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9; http://www.openwall.com/lists/oss-security/2024/08/09/4
CVE: CVE-2024-41936
Published: 2024-08-12
Description: A directory traversal vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 
and prior, enables an unauthenticated remote attacker to read arbitrary 
files and bypass authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
CVE: CVE-2024-42001
Published: 2024-08-12
Description: An improper authentication vulnerability affecting Vonets





 

 industrial wifi bridge relays and wifi bridge repeaters, software versions 
3.3.23.6.9 and prior enables an unauthenticated remote attacker to 
bypass authentication via a specially crafted direct request when 
another user has an active session.
CVSS Score: 8.6 (HIGH)
CWE: CWE-425
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
CVE: CVE-2024-42163
Published: 2024-08-12
Description: Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link.
CVSS Score: 8.3 (HIGH)
CWE: CWE-326, CWE-326
References: https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
CVE: CVE-2024-42164
Published: 2024-08-12
Description: Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-330
References: https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
CVE: CVE-2024-42165
Published: 2024-08-12
Description: Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-330, CWE-330
References: https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
CVE: CVE-2024-42166
Published: 2024-08-12
Description: The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
CVE: CVE-2024-42167
Published: 2024-08-12
Description: The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories