deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2567
Published: 2024-03-17
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in jurecapuder AndroidWeatherApp 1.0.0 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. VDB-257070 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: The code maintainer was contacted early about this disclosure but did not respond in any way. Instead the GitHub repository got deleted after a few days. We have to assume that the product is not supported anymore.
CVSS Score: 1.8 (LOW)
CWE: CWE-530
References: https://github.com/ctflearner/Android_Findings/blob/main/AndroidWeatherApp/Android_backup.md; https://vuldb.com/?ctiid.257070; https://vuldb.com/?id.257070
CVE: CVE-2024-2568
Published: 2024-03-17
Description: A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257071.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/bigbigbigbaby/cms/blob/main/5.md; https://vuldb.com/?ctiid.257071; https://vuldb.com/?id.257071
CVE: CVE-2024-23138
Published: 2024-03-18
Description: A maliciously crafted DWG file when parsed through Autodesk DWG TrueView can be used to cause a Stack-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0006; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0006
CVE: CVE-2024-23139
Published: 2024-03-18
Description: A maliciously crafted ABC file, when parsed through Autodesk FBX, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005
CVE: CVE-2024-2569
Published: 2024-03-18
Description: A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin-manage-user.php. The manipulation leads to execution after redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257072.
CVSS Score: 7.3 (HIGH)
CWE: CWE-698
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20admin-manage-user.php.md; https://vuldb.com/?ctiid.257072; https://vuldb.com/?id.257072
CVE: CVE-2024-2570
Published: 2024-03-18
Description: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file /edit-task.php. The manipulation leads to execution after redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257073 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-698
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20edit-task.php.md; https://vuldb.com/?ctiid.257073; https://vuldb.com/?id.257073
CVE: CVE-2023-39223
Published: 2024-03-18
Description: Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://akisoftware.com/Vulnerability202301.html; https://jvn.jp/en/jp/JVN92720882/; https://akisoftware.com/Vulnerability202301.html
CVE: CVE-2023-39933
Published: 2024-03-18
Description: Insufficient verification vulnerability exists in Broadcast Mail CGI (pmc.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a user who can upload files through the product may execute an arbitrary executable file with the web server's execution privilege.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://akisoftware.com/Vulnerability202301.html; https://jvn.jp/en/jp/JVN92720882/; https://akisoftware.com/Vulnerability202301.html
CVE: CVE-2023-40160
Published: 2024-03-18
Description: Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a remote attacker may obtain arbitrary files on the server.
CVSS Score: 3.7 (LOW)
CWE: CWE-22
References: https://akisoftware.com/Vulnerability202301.html; https://jvn.jp/en/jp/JVN92720882/; https://akisoftware.com/Vulnerability202301.html
CVE: CVE-2023-40747
Published: 2024-03-18
Description: Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerability is exploited, a  remote attacker may access arbitrary files outside DocumentRoot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://akisoftware.com/Vulnerability202301.html; https://jvn.jp/en/jp/JVN92720882/; https://akisoftware.com/Vulnerability202301.html
CVE: CVE-2024-2571
Published: 2024-03-18
Description: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage-admin.php. The manipulation leads to execution after redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257074 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-698
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20manage-admin.php.md; https://vuldb.com/?ctiid.257074; https://vuldb.com/?id.257074
CVE: CVE-2024-2572
Published: 2024-03-18
Description: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /task-details.php. The manipulation leads to execution after redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257075.
CVSS Score: 7.3 (HIGH)
CWE: CWE-698
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20task-details.php.md; https://vuldb.com/?ctiid.257075; https://vuldb.com/?id.257075
CVE: CVE-2024-2573
Published: 2024-03-18
Description: A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file /task-info.php. The manipulation leads to execution after redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257076.
CVSS Score: 7.3 (HIGH)
CWE: CWE-698
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20task-info.php.md; https://vuldb.com/?ctiid.257076; https://vuldb.com/?id.257076
CVE: CVE-2023-52159
Published: 2024-03-18
Description: A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://codeberg.org/bizdelnick/gross/wiki/Known-vulnerabilities#cve-2023-52159; https://lists.debian.org/debian-lts-announce/2024/03/msg00027.html; https://codeberg.org/bizdelnick/gross/wiki/Known-vulnerabilities#cve-2023-52159
CVE: CVE-2024-24230
Published: 2024-03-18
Description: Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime().exec followed by an OS command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://blog.munz4u.de/posts/2023/11/cve-2023-xxxxx-rce-via-ssti-in-komm.one-cms-10.4.2.14/; https://blog.munz4u.de/posts/2023/11/cve-2023-xxxxx-rce-via-ssti-in-komm.one-cms-10.4.2.14/
CVE: CVE-2024-2574
Published: 2024-03-18
Description: A vulnerability classified as critical was found in SourceCodester Employee Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit-task.php. The manipulation of the argument task_id leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257077 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-639
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20edit-task.php.md; https://vuldb.com/?ctiid.257077; https://vuldb.com/?id.257077
CVE: CVE-2024-2575
Published: 2024-03-18
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Employee Task Management System 1.0. Affected by this issue is some unknown functionality of the file /task-details.php. The manipulation of the argument task_id leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257078 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-639
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20task-details.php.md; https://vuldb.com/?ctiid.257078; https://vuldb.com/?id.257078
CVE: CVE-2024-2576
Published: 2024-03-18
Description: A vulnerability, which was classified as critical, was found in SourceCodester Employee Task Management System 1.0. This affects an unknown part of the file /update-admin.php. The manipulation of the argument admin_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257079.
CVSS Score: 7.3 (HIGH)
CWE: CWE-639
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20update-admin.php.md; https://vuldb.com/?ctiid.257079; https://vuldb.com/?id.257079
CVE: CVE-2022-47036
Published: 2024-03-18
Description: Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the 2.1.1 firmware; instead, it is fixed in newer hardware, which would typically be used with firmware 2.1.1 or later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://semaja2.net/2023/06/11/siklu-tg-auth-bypass.html; https://semaja2.net/2023/06/11/siklu-tg-auth-bypass.html
CVE: CVE-2022-47037
Published: 2024-03-18
Description: Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-284
References: https://semaja2.net/2023/06/11/siklu-tg-auth-bypass.html; https://semaja2.net/2023/06/11/siklu-tg-auth-bypass.html
CVE: CVE-2024-24539
Published: 2024-03-18
Description: FusionPBX before 5.2.0 does not validate a session.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/fusionpbx/fusionpbx/commit/2f8bed375c124c1d7e36138acc6903fcfcf15a8f; https://github.com/fusionpbx/fusionpbx/commit/ee202cd61dc9a79fb2d634b1ad21ff2416d531cb; https://github.com/fusionpbx/fusionpbx/commit/2f8bed375c124c1d7e36138acc6903fcfcf15a8f
CVE: CVE-2024-2577
Published: 2024-03-18
Description: A vulnerability has been found in SourceCodester Employee Task Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /update-employee.php. The manipulation of the argument admin_id leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257080.
CVSS Score: 7.3 (HIGH)
CWE: CWE-639
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20update-employee.php.md; https://vuldb.com/?ctiid.257080; https://vuldb.com/?id.257080
CVE: CVE-2024-2581
Published: 2024-03-18
Description: A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. This issue affects the function fromSetRouteStatic of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257081 was assigned to this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10/V16.03.10.13/fromSetRouteStatic.md; https://vuldb.com/?ctiid.257081; https://vuldb.com/?id.257081
CVE: CVE-2024-27757
Published: 2024-03-18
Description: flusity CMS through 2.45 allows tools/addons_model.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jubilianite/flusity-CMS/security/advisories/GHSA-5843-5m74-7fqh; https://github.com/jubilianite/flusity-CMS/security/advisories/GHSA-5843-5m74-7fqh
CVE: CVE-2024-28745
Published: 2024-03-18
Description: Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://jvn.jp/en/jp/JVN70640802/; https://jvn.jp/en/jp/JVN70640802/
CVE: CVE-2018-25099
Published: 2024-03-18
Description: In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://github.com/DCIT/perl-CryptX/issues/47; https://github.com/libtom/libtomcrypt/pull/451; https://metacpan.org/dist/CryptX/changes
CVE: CVE-2021-47154
Published: 2024-03-18
Description: The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS Score: 6.3 (MEDIUM)
References: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/; https://github.com/stigtsp/Net-CIDR-Lite/commit/23b6ff0590dc279521863a502e890ef19a5a76fc; https://lists.debian.org/debian-lts-announce/2024/03/msg00023.html
CVE: CVE-2021-47155
Published: 2024-03-18
Description: The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/#net-ipv4addrhttpsmetacpanorgreleasenet-ipv4addr; https://metacpan.org/release/Net-IPv4Addr; https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/#net-ipv4addrhttpsmetacpanorgreleasenet-ipv4addr
CVE: CVE-2021-47156
Published: 2024-03-18
Description: The Net::IPAddress::Util module before 5.000 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/; https://metacpan.org/release/Net-IPAddress-Util; https://metacpan.org/release/PWBENNETT/Net-IPAddress-Util-5.000/changes
CVE: CVE-2021-47157
Published: 2024-03-18
Description: The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://github.com/kazeburo/Kossy/pull/16; https://metacpan.org/dist/Kossy/changes; https://github.com/kazeburo/Kossy/pull/16
CVE: CVE-2024-29151
Published: 2024-03-18
Description: Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-311
References: https://github.com/RocketChat/Rocket.Chat.Audit/blob/5ad78e8017a9e190602e8257c22500ded0d931a9/requirements.txt#L3; https://github.com/RocketChat/Rocket.Chat.Audit/blob/5ad78e8017a9e190602e8257c22500ded0d931a9/requirements.txt#L3
CVE: CVE-2024-29154
Published: 2024-03-18
Description: danielmiessler fabric through 1.3.0 allows installer/client/gui/static/js/index.js XSS because of innerHTML mishandling, such as in htmlToPlainText.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: https://sec1.io/security-advisories/cross-site-scripting-xss/; https://sec1.io/security-advisories/cross-site-scripting-xss/
CVE: CVE-2024-29156
Published: 2024-03-18
Description: In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://launchpad.net/bugs/2048114; https://opendev.org/openstack/murano/tags; https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3
CVE: CVE-2024-21824
Published: 2024-03-18
Description: Improper authentication vulnerability in exists in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. If this vulnerability is exploited, a network-adjacent user who can access the product may impersonate an administrative user. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://jvn.jp/en/jp/JVN82749078/; https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faqp00100601_000; https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faq00100823_000
CVE: CVE-2024-22475
Published: 2024-03-18
Description: Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. allows a remote unauthenticated attacker to perform unintended operations on the affected product. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN82749078/; https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faqp00100601_000; https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faq00100823_000
CVE: CVE-2024-23604
Published: 2024-03-18
Description: Cross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with specially crafted multiple parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://fitnesse.org/FitNesseDownload; https://github.com/unclebob/fitnesse; https://github.com/unclebob/fitnesse/blob/master/SECURITY.md
CVE: CVE-2024-27974
Published: 2024-03-18
Description: Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, the settings such as the administrator's ID, password, etc. may be altered. As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed under [References].
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN34328023/; https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_1_announce.html; https://jvn.jp/en/jp/JVN34328023/
CVE: CVE-2024-28125
Published: 2024-03-18
Description: FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://fitnesse.org/FitNesseDownload; https://github.com/unclebob/fitnesse; https://github.com/unclebob/fitnesse/blob/master/SECURITY.md
CVE: CVE-2024-28128
Published: 2024-03-18
Description: Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://fitnesse.org/FitNesseDownload; https://github.com/unclebob/fitnesse; https://github.com/unclebob/fitnesse/blob/master/SECURITY.md
CVE: CVE-2024-28039
Published: 2024-03-18
Description: Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-611
References: http://fitnesse.org/FitNesseDownload; https://github.com/unclebob/fitnesse; https://github.com/unclebob/fitnesse/blob/master/SECURITY.md
CVE: CVE-2024-1604
Published: 2024-03-18
Description: Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate.







Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://cert.pl/en/posts/2024/03/CVE-2024-1604; https://cert.pl/posts/2024/03/CVE-2024-1604; https://www.bmc.com/it-solutions/control-m.html