deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-32755
Published: 2024-07-02
Description: Under certain circumstances the web interface will accept characters unrelated to the expected input.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-04; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-04
CVE: CVE-2024-32756
Published: 2024-07-02
Description: Under certain circumstances the Linux users credentials may be recovered by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-257
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-05; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-05
CVE: CVE-2024-32757
Published: 2024-07-02
Description: Under certain circumstances unnecessary user details are provided within system logs
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-532
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-06; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-06
CVE: CVE-2024-34122
Published: 2024-07-02
Description: Acrobat for Edge versions 126.0.2592.68 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-34122; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-34122
CVE: CVE-2024-36404
Published: 2024-07-02
Description: GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-95
References: https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852; https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea; https://github.com/geotools/geotools/pull/4797
CVE: CVE-2024-38519
Published: 2024-07-02
Description: `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since `yt-dlp` and `youtube-dl` also read config from the working directory (and on Windows executables will be executed from the `yt-dlp` or `youtube-dl` directory), this could lead to arbitrary code being executed.




`yt-dlp` version 2024.07.01 fixes this issue by whitelisting the allowed extensions. `youtube-dl` fixes this issue in commit `d42a222` on the `master` branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have `.%(ext)s` at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one's user directory, `system32`, or other binaries locations. For users who are not able to upgrade, keep the default output template (`-o "%(title)s [%(id)s].%(ext)s`); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use `--ignore-config --config-location ...` to not load config from common locations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-669
References: https://github.com/dirkf/youtube-dl/security/advisories/GHSA-22fp-mf44-f2mq; https://github.com/yt-dlp/yt-dlp/commit/5ce582448ececb8d9c30c8c31f58330090ced03a; https://github.com/yt-dlp/yt-dlp/releases/tag/2024.07.01
CVE: CVE-2024-39143
Published: 2024-07-02
Description: A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content with HTML inside which acts as a stored XSS payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Coderberg/ResidenceCMS/issues/128; https://github.com/Coderberg/ResidenceCMS/issues/128
CVE: CVE-2023-51776
Published: 2024-07-02
Description: Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2023-51777
Published: 2024-07-02
Description: Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error.
CVSS Score: 5.5 (MEDIUM)
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2023-51778
Published: 2024-07-02
Description: Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-22102
Published: 2024-07-02
Description: Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-22103
Published: 2024-07-02
Description: Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-22104
Published: 2024-07-02
Description: Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-400
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-32932
Published: 2024-07-02
Description: Under certain circumstances the web interface users credentials may be recovered by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-257
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-07; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-07
CVE: CVE-2024-4897
Published: 2024-07-02
Description: parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindings_zoo' feature, specifically when processing gguf format model files.
CVSS Score: 8.4 (HIGH)
CWE: CWE-76
References: https://huntr.com/bounties/ecf386df-4b6a-40b2-9000-db0974355acc; https://huntr.com/bounties/ecf386df-4b6a-40b2-9000-db0974355acc
CVE: CVE-2024-22105
Published: 2024-07-02
Description: Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-22106
Published: 2024-07-02
Description: Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute arbitrary code, or cause a Denial of Service (DoS).
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-25086
Published: 2024-07-02
Description: Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-269
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-25087
Published: 2024-07-02
Description: Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue screen error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-25088
Published: 2024-07-02
Description: Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-26314
Published: 2024-07-02
Description: Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://jungo.com/windriver/versions/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
CVE: CVE-2024-39316
Published: 2024-07-02
Description: Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333
References: https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058; https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f; https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
CVE: CVE-2024-39323
Published: 2024-07-02
Description: aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.

CVSS Score: 7.1 (HIGH)
CWE: CWE-863, CWE-1220
References: https://github.com/aimeos/ai-admin-graphql/commit/2d89d98cdcad880a9244b50736b08c1a171379ca; https://github.com/aimeos/ai-admin-graphql/commit/54d6b7cf4530cb3b95f52775c24056c48e6d26e9; https://github.com/aimeos/ai-admin-graphql/commit/787028de0a3ecbf3e9f63ab1454eac99ce7693a9
CVE: CVE-2024-3826
Published: 2024-07-02
Description: In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On (SSO) functionality.
CWE: CWE-287
References: https://portal.perforce.com/s/detail/a91PA000001SUAfYAO; https://portal.perforce.com/s/detail/a91PA000001SUAfYAO
CVE: CVE-2024-4467
Published: 2024-07-02
Description: A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2024:4276; https://access.redhat.com/errata/RHSA-2024:4277; https://access.redhat.com/errata/RHSA-2024:4278
CVE: CVE-2024-5865
Published: 2024-07-02
Description: Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files reading outside the web publish directory. Versions 23.1-HF7 and on have the patch.
CVSS Score: 7.7 (HIGH)
CWE: CWE-26, CWE-22
References: https://github.com/klsecservices/Advisories/blob/master/K-Delinea-2023-001.md; https://github.com/klsecservices/Advisories/blob/master/K-Delinea-2023-001.md
CVE: CVE-2024-5866
Published: 2024-07-02
Description: Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing listing of arbitrary directory outside the root directory of the web application. Versions 23.1-HF7 and on have the patch.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-26, CWE-22
References: https://github.com/klsecservices/Advisories/blob/master/K-Delinea-2023-002.md; https://github.com/klsecservices/Advisories/blob/master/K-Delinea-2023-002.md
CVE: CVE-2022-32147
Published: 2024-07-02
Description: Rejected reason: reserved but not needed
CVE: CVE-2022-32191
Published: 2024-07-02
Description: Rejected reason: reserved but not needed
CVE: CVE-2022-3428
Published: 2024-07-02
Description: Rejected reason: reserved but not needed
CVE: CVE-2022-41718
Published: 2024-07-02
Description: Rejected reason: reserved but not needed
CVE: CVE-2022-41726
Published: 2024-07-02
Description: Rejected reason: reserved but not needed
CVE: CVE-2022-41728
Published: 2024-07-02
Description: Rejected reason: reserved but not needed
CVE: CVE-2022-41729
Published: 2024-07-02
Description: Rejected reason: reserved but not needed
CVE: CVE-2022-41730
Published: 2024-07-02
Description: Rejected reason: reserved but not needed
CVE: CVE-2023-39324
Published: 2024-07-02
Description: Rejected reason: reserved but not needed
CVE: CVE-2024-39206
Published: 2024-07-02
Description: An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due to enginesettings.list being encrypted with a hard coded key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://www.proactivelabs.com.au/2024/06/19/cloudberry.html; https://www.proactivelabs.com.au/2024/06/19/cloudberry.html
CVE: CVE-2024-39891
Published: 2024-07-02
Description: In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://cwe.mitre.org/data/definitions/203.html; https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/; https://www.twilio.com/docs/usage/security/reporting-vulnerabilities
CVE: CVE-2024-39894
Published: 2024-07-02
Description: OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-367
References: http://www.openwall.com/lists/oss-security/2024/07/03/6; http://www.openwall.com/lists/oss-security/2024/07/23/4; http://www.openwall.com/lists/oss-security/2024/07/23/6
CVE: CVE-2024-6341
Published: 2024-07-02
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-6381
Published: 2024-07-02
Description: The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-680
References: https://jira.mongodb.org/browse/CDRIVER-5622; https://jira.mongodb.org/browse/CDRIVER-5622; https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html
CVE: CVE-2024-6382
Published: 2024-07-02
Description: Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-228
References: https://jira.mongodb.org/browse/RUST-1881; https://jira.mongodb.org/browse/RUST-1881
CVE: CVE-2022-25477
Published: 2024-07-02
Description: Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 leaks driver logs that contain addresses of kernel mode objects, weakening KASLR.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: http://realtek.com; https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a; https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
CVE: CVE-2022-25478
Published: 2024-07-02
Description: Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 provides read and write access to the PCI configuration space of the device.
CVSS Score: 7.8 (HIGH)
References: http://realtek.com; https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a; https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
CVE: CVE-2022-25479
Published: 2024-07-02
Description: Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows for the leakage of kernel memory from both the stack and the heap.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: http://realtek.com; https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a; https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
CVE: CVE-2022-25480
Published: 2024-07-02
Description: Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows writing to kernel memory beyond the SystemBuffer of the IRP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://realtek.com; https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a; https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
CVE: CVE-2022-30636
Published: 2024-07-02
Description: httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\ vs. /), allowing a user to provide a relative path, i.e. .well-known/acme-challenge/..\..\asd becomes ..\..\asd. The extracted path is then suffixed with +http-01, joined with the cache directory, and opened. Since the controlled path is suffixed with +http-01 before opening, the impact of this is significantly limited, since it only allows reading arbitrary files on the system if and only if they have this suffix.
CVSS Score: 7.5 (HIGH)
References: https://go.dev/cl/408694; https://go.dev/issue/53082; https://pkg.go.dev/vuln/GO-2024-2961
CVE: CVE-2023-24531
Published: 2024-07-02
Description: Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
CVSS Score: 9.8 (CRITICAL)
References: https://go.dev/cl/488375; https://go.dev/cl/493535; https://go.dev/issue/58508