deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-37145
Published: 2024-07-01
Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/chatflows-streaming/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups, or even redirect the user to other websites without interaction. If the chatflow ID is not found, its value is reflected in the 404 page, which has type text/html. This allows an attacker to attach arbitrary scripts to the page, allowing an attacker to steal sensitive information. This XSS may be chained with the path injection to allow an attacker without direct access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L375-L375; https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/; https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L375-L375
CVE: CVE-2024-37146
Published: 2024-07-01
Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/credentials/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups, or even redirect the user to other websites without interaction. If the chatflow ID is not found, its value is reflected in the 404 page, which has type text/html. This allows an attacker to attach arbitrary scripts to the page, allowing an attacker to steal sensitive information. This XSS may be chained with the path injection to allow an attacker without direct access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L545-L545; https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/; https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L545-L545
CVE: CVE-2024-37298
Published: 2024-07-01
Description: gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/gorilla/schema/blob/main/decoder.go#L223; https://github.com/gorilla/schema/commit/cd59f2f12cbdfa9c06aa63e425d1fe4a806967ff; https://github.com/gorilla/schema/security/advisories/GHSA-3669-72x9-r9p3
CVE: CVE-2024-38472
Published: 2024-07-01
Description: SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content 
Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2024/07/01/5; https://httpd.apache.org/security/vulnerabilities_24.html
CVE: CVE-2024-38473
Published: 2024-07-01
Description: Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-116
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.openwall.com/lists/oss-security/2024/07/01/6
CVE: CVE-2024-38474
Published: 2024-07-01
Description: Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in
directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.openwall.com/lists/oss-security/2024/07/01/7
CVE: CVE-2024-38475
Published: 2024-07-01
Description: Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. 

Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-116
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.openwall.com/lists/oss-security/2024/07/01/8
CVE: CVE-2024-38476
Published: 2024-07-01
Description: Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-829
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-38477
Published: 2024-07-01
Description: null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-38513
Published: 2024-07-01
Description: Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability. Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk: Either implement additional validation to ensure session IDs are not supplied by the user and are securely generated by the server, or regularly rotate session IDs and enforce strict session expiration policies.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-384
References: https://github.com/gofiber/fiber/commit/66a881441b27322a331f1b526cf1eb6b3358a4d8; https://github.com/gofiber/fiber/security/advisories/GHSA-98j2-3j3p-fw2v; https://github.com/gofiber/fiber/commit/66a881441b27322a331f1b526cf1eb6b3358a4d8
CVE: CVE-2024-39236
Published: 2024-07-01
Description: Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Aaron911/PoC/blob/main/Gradio.md; https://github.com/advisories/GHSA-9v2f-6vcg-3hgv; https://github.com/gradio-app/gradio/issues/8853
CVE: CVE-2024-39251
Published: 2024-07-01
Description: An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, execute arbitrary code, or escalate privileges via sending crafted IOCTL requests.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-782
References: https://github.com/Souhardya/Exploit-PoCs/tree/main/ThundeRobot_Control_center; https://github.com/Souhardya/Exploit-PoCs/tree/main/ThundeRobot_Control_center
CVE: CVE-2024-39303
Published: 2024-07-01
Description: Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-73
References: https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd; https://github.com/WeblateOrg/weblate/security/advisories/GHSA-jfgp-674x-6q4p; https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd
CVE: CVE-2024-39573
Published: 2024-07-01
Description: Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-39249
Published: 2024-07-01
Description: Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOTE: this is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L41; https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L6; https://github.com/caolan/async/issues/1975#issuecomment[PII_REDACTED]
CVE: CVE-2024-28200
Published: 2024-07-01
Description: The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2.

This vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the wild.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://documentation.n-able.com/N-central/Release_Notes/GA/Content/2024.2%20Release%20Notes.htm; https://me.n-able.com/s/security-advisory/aArVy[PII_REDACTED]KAA/cve202428200-ncentral-authentication-bypass; https://documentation.n-able.com/N-central/Release_Notes/GA/Content/2024.2%20Release%20Notes.htm
CVE: CVE-2024-32228
Published: 2024-07-01
Description: FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-120, CWE-121
References: https://trac.ffmpeg.org/ticket/10951; https://trac.ffmpeg.org/ticket/10951
CVE: CVE-2024-32229
Published: 2024-07-01
Description: FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column.
CVSS Score: 8.4 (HIGH)
CWE: CWE-122
References: https://trac.ffmpeg.org/ticket/10950; https://trac.ffmpeg.org/ticket/10950
CVE: CVE-2024-32230
Published: 2024-07-01
Description: FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://trac.ffmpeg.org/ticket/10952; https://trac.ffmpeg.org/ticket/10952
CVE: CVE-2024-38366
Published: 2024-07-01
Description: trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023; https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-the-cocoapods-trunk-server; https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-x2x4-g675-qg7c
CVE: CVE-2024-38367
Published: 2024-07-01
Description: trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023.
CVSS Score: 8.2 (HIGH)
CWE: CWE-488
References: https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023; https://evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#vulnerability-3-achieving-zero-click-account-takeover-by-defeating-email-security-boundaries; https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-52gf-m7v9-m333
CVE: CVE-2024-38368
Published: 2024-07-01
Description: trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-668
References: https://blog.cocoapods.org/Claim-Your-Pods; https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023; https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-over-orphaned-pods
CVE: CVE-2024-39305
Published: 2024-07-01
Description: Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be immediately apparent if it was configured. Memory allocated for holding attribute values is freed after configuration was parsed. During request processing Envoy will attempt to copy content of de-allocated memory into request cookie header. This can lead to arbitrary content of Envoy's memory to be sent to the upstream service or abnormal process termination. This vulnerability is fixed in Envoy versions v1.30.4, v1.29.7, v1.28.5, and v1.27.7. As a workaround, do not use cookie attributes in route action hash policy.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/envoyproxy/envoy/commit/02a06681fbe0e039b1c7a9215257a7537eddb518; https://github.com/envoyproxy/envoy/commit/50b384cb203a1f2894324cbae64b6d9bc44cce45; https://github.com/envoyproxy/envoy/commit/99b6e525fb9f6f6f19a0425f779bc776f121c7e5
CVE: CVE-2024-5322
Published: 2024-07-01
Description: The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass.
 
This vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-288
References: https://documentation.n-able.com/N-central/Release_Notes/GA/Content/2024.3%20Release%20Notes.htm; https://me.n-able.com/s/security-advisory/aArVy0000000BgDKAU/cve20245322-ncentral-authentication-bypass-via-session-rebinding; https://documentation.n-able.com/N-central/Release_Notes/GA/Content/2024.3%20Release%20Notes.htm
CVE: CVE-2024-23736
Published: 2024-07-01
Description: Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://help.savignano.net/snotify-email-encryption/sa-2023-11-28#SA-2023-11-28-CSRFbasedvulnerabilityinuserupload; https://help.savignano.net/snotify-email-encryption/sa-2023-11-28#SA-2023-11-28-CSRFbasedvulnerabilityinuserupload
CVE: CVE-2024-23737
Published: 2024-07-01
Description: Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://help.savignano.net/snotify-email-encryption/sa-2023-11-28#SA-2023-11-28-CSRFbasedvulnerabilityinuserupload; https://help.savignano.net/snotify-email-encryption/sa-2023-11-28#SA-2023-11-28-CSRFbasedvulnerabilityinuserupload
CVE: CVE-2024-37762
Published: 2024-07-01
Description: MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://github.com/Atreb92/cve-2024-37762; https://github.com/Atreb92/cve-2024-37762
CVE: CVE-2024-37763
Published: 2024-07-01
Description: MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms results.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Atreb92/cve-2024-37763; https://github.com/Atreb92/cve-2024-37763
CVE: CVE-2024-37764
Published: 2024-07-01
Description: MachForm up to version 19 is affected by an authenticated stored cross-site scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Atreb92/cve-2024-37764; https://github.com/Atreb92/cve-2024-37764
CVE: CVE-2024-37765
Published: 2024-07-01
Description: Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Atreb92/cve-2024-37765; https://github.com/Atreb92/cve-2024-37765
CVE: CVE-2024-39309
Published: 2024-07-01
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-288
References: https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3; https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b; https://github.com/parse-community/parse-server/pull/9167
CVE: CVE-2024-39310
Published: 2024-07-01
Description: The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/XjSv/Basil/commit/e2b1dbf1637d1ec2663f9aa1a563b02dc76a8146; https://github.com/XjSv/Basil/security/advisories/GHSA-cr7v-8v2h-49vx; https://github.com/XjSv/Basil/commit/e2b1dbf1637d1ec2663f9aa1a563b02dc76a8146
CVE: CVE-2024-39313
Published: 2024-07-01
Description: toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workarounds are available.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/KisaragiEffective/toy-blog/commit/f13a45f68c[PII_REDACTED]e6bb445ad441a4cf4732; https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-rf2q-5q4q-5fwr; https://github.com/KisaragiEffective/toy-blog/commit/f13a45f68c[PII_REDACTED]e6bb445ad441a4cf4732
CVE: CVE-2024-39314
Published: 2024-07-01
Description: toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200, CWE-214
References: https://github.com/KisaragiEffective/toy-blog/commit/4d003e46a944d8f44ea02c63f4beefa4cbe1f4f7; https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-q8g2-c3x5-gp89; https://github.com/KisaragiEffective/toy-blog/commit/4d003e46a944d8f44ea02c63f4beefa4cbe1f4f7
CVE: CVE-2024-2819
Published: 2024-07-02
Description: Incorrect Default Permissions, Improper Preservation of Permissions vulnerability in Hitachi Ops Center Common Services allows File Manipulation.This issue affects Hitachi Ops Center Common Services: before 11.0.2-00.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-276, CWE-281, CWE-276, CWE-281
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-132/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-132/index.html