deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-36819
Published: 2024-06-25
Description: MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee dashboards, resulting in unauthorized script execution whenever the dashboard is loaded.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/RamonSilva20/mapos/commit/3559bae4782162faab94670f503fd35b0f331929; https://github.com/RamonSilva20/mapos/tree/master; https://github.com/RamonSilva20/mapos/commit/3559bae4782162faab94670f503fd35b0f331929
CVE: CVE-2024-37820
Published: 2024-06-25
Description: A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/ycybfhb/a9c1e14ce281f2f553adca84d384b761; https://github.com/pingcap/tidb/issues/53580; https://gist.github.com/ycybfhb/a9c1e14ce281f2f553adca84d384b761
CVE: CVE-2024-37167
Published: 2024-06-25
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see. This issue has been patched in Tuleap Community Edition version 15.9.99.97.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/Enalean/tuleap/commit/13eec93a353d2daf47bb8b9c548cc02f78b93a5e; https://github.com/Enalean/tuleap/security/advisories/GHSA-4c9f-284j-phvj; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=13eec93a353d2daf47bb8b9c548cc02f78b93a5e
CVE: CVE-2024-37894
Published: 2024-06-25
Description: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787
References: https://github.com/squid-cache/squid/commit/f411fe7d75197852f0e5ee85027a06d58dd8df4c.patch; https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-4498
Published: 2024-06-25
Description: A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the `/apply_settings` function, allowing an attacker to manipulate the `discussion_db_name` parameter to traverse the file system and include arbitrary files. This issue is compounded by the bypass of input filtering in the `install_binding`, `reinstall_binding`, and `unInstall_binding` endpoints, despite the presence of a `sanitize_path_from_endpoint(data.name)` filter. Successful exploitation enables an attacker to upload and execute malicious code on the victim's system, leading to Remote Code Execution (RCE).
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/9238e88a-a6ca-4915-9b5d-6cdb4148d3f4; https://huntr.com/bounties/9238e88a-a6ca-4915-9b5d-6cdb4148d3f4
CVE: CVE-2024-4883
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78, CWE-94
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-4884
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The Apm.UI.Areas.APM.Controllers.CommunityController

 allows execution of commands with iisapppool\nmconsole privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78, CWE-94, CWE-77
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-4885
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The 

WhatsUp.ExportUtilities.Export.GetFileWithoutZip



 allows execution of commands with iisapppool\nmconsole privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-5008
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, 

an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-5009
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-5010
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality.  A specially crafted 

unauthenticated

HTTP request can lead to a disclosure of sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1933
CVE: CVE-2024-5011
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request to the TestController Chart functionality can lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1934
CVE: CVE-2024-5276
Published: 2024-06-25
Description: A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-89, CWE-89
References: https://support.fortra.com/filecatalyst/kb-articles/advisory-6-24-2024-filecatalyst-workflow-sql-injection-vulnerability-YmYwYWY4OTYtNTUzMi1lZjExLTg0MGEtNjA0NWJkMDg3MDA0; https://www.fortra.com/security/advisory/fi-2024-008; https://www.tenable.com/security/research/tra-2024-25
CVE: CVE-2024-6206
Published: 2024-06-25
Description: A security vulnerability has been identified in HPE Athonet Mobile Core software. The core application contains a code injection vulnerability where a threat actor could execute arbitrary commands with the privilege of the underlying container leading to complete takeover of the target system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04659en_us&docLocale=en_US; https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04659en_us&docLocale=en_US
CVE: CVE-2024-21739
Published: 2024-06-25
Description: Geehy APM32F103CCT6, APM32F103RCT6, APM32F103RCT7, and APM32F103VCT6 devices have Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
References: https://tches.iacr.org/index.php/TCHES/article/view/11422/10927; https://tches.iacr.org/index.php/TCHES/article/view/11422/10927
CVE: CVE-2024-21740
Published: 2024-06-25
Description: Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284
References: https://tches.iacr.org/index.php/TCHES/article/view/11422/10927; https://tches.iacr.org/index.php/TCHES/article/view/11422/10927
CVE: CVE-2024-21741
Published: 2024-06-25
Description: GigaDevice GD32E103C8T6 devices have Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://tches.iacr.org/index.php/TCHES/article/view/11422/10927; https://tches.iacr.org/index.php/TCHES/article/view/11422/10927
CVE: CVE-2024-34400
Published: 2024-06-25
Description: An issue was discovered in VirtoSoftware Virto Kanban Board Web Part before 5.3.5.1 for SharePoint 2019. There is /_layouts/15/Virto.KanbanTaskManager/api/KanbanData.ashx LinkTitle2 XSS.
CVSS Score: 6.1 (MEDIUM)
References: https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_kanban_board_5.3.3_pt_disclosure.pdf; https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_kanban_board_5.3.3_pt_disclosure.pdf
CVE: CVE-2024-35526
Published: 2024-06-25
Description: An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-922
References: https://bastionsecurity.co.nz/advisories/farcry-core-multiple.html; https://bastionsecurity.co.nz/advisories/farcry-core-multiple.html
CVE: CVE-2024-37843
Published: 2024-06-25
Description: Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphql; https://blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphql
CVE: CVE-2024-37855
Published: 2024-06-25
Description: An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute arbitrary code via the router's Telnet port 2345 without requiring authentication credentials.
CVSS Score: 8.4 (HIGH)
CWE: CWE-94
References: https://github.com/sudo-subho/nepstech-xpon-router-rce; https://github.com/sudo-subho/nepstech-xpon-router-rce
CVE: CVE-2024-38516
Published: 2024-06-25
Description: ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1295
References: https://github.com/aimeos/ai-client-html/commit/bb389620ffc3cf4a2f29c11a1e5f512049e0c132; https://github.com/aimeos/ai-client-html/security/advisories/GHSA-ppm5-jv84-2xg2; https://github.com/aimeos/ai-client-html/commit/bb389620ffc3cf4a2f29c11a1e5f512049e0c132
CVE: CVE-2024-5012
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unauthenticated attackers to disclose Windows Credentials stored in the product Credential Library.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-287
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-5013
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service 

vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-5014
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form.
CVSS Score: 7.1 (HIGH)
CWE: CWE-918, CWE-918
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-5015
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to Admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-918, CWE-918
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-5016
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. 
The vulnerability exists in the main message processing routines NmDistributed.DistributedServiceBehavior.OnMessage for server and NmDistributed.DistributedClient.OnMessage for clients.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-5017
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. A specially crafted unauthenticated HTTP request to AppProfileImport can lead can lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1932
CVE: CVE-2024-5018
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNMScript. This allows allows reading of any file from the applications web-root directory .
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-5019
Published: 2024-06-25
Description: In WhatsUp Gold versions released before 2023.1.3, 

an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS. This vulnerability allows reading of any file with iisapppool\NmConsole privileges.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE: CVE-2024-30112
Published: 2024-06-25
Description: HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0114148; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0114148
CVE: CVE-2024-30931
Published: 2024-06-25
Description: Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via the notifications.html component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://happy-little-accidents.pages.dev/posts/CVE-2024-30931/; https://happy-little-accidents.pages.dev/posts/CVE-2024-30931/
CVE: CVE-2024-35527
Published: 2024-06-25
Description: An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://bastionsecurity.co.nz/advisories/farcry-core-multiple.html; https://bastionsecurity.co.nz/advisories/farcry-core-multiple.html
CVE: CVE-2024-37742
Published: 2024-06-25
Description: Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode and the underlying system, compromising exam integrity. By exploiting this flaw, an attacker can bypass exam controls and gain an unfair advantage during exams.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://github.com/Eteblue/CVE-2024-37742; https://youtu.be/SOm0Hgny_3U; https://github.com/Eteblue/CVE-2024-37742
CVE: CVE-2024-6060
Published: 2024-06-25
Description: An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP requests that contain user passwords or other sensitive information.
CWE: CWE-532
References: https://www.sonatype.com/security-advisories/cve-2024-6060; https://sites.google.com/sonatype.com/vulnerabilities/cve-2024-6060
CVE: CVE-2024-29953
Published: 2024-06-26
Description: A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual Fabric platforms. 
This could allow an authenticated user to view other users' session encoded passwords.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23227; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23227
CVE: CVE-2024-29954
Published: 2024-06-26
Description: A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp.

Detail.
When the firmwaredownload command is incorrectly entered or points to an erroneous file, the firmware download log captures the failed command, including any password entered in the command line.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-312, CWE-532
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23226; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23226
CVE: CVE-2024-38364
Published: 2024-06-26
Description: DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://github.com/DSpace/DSpace/commit/f1059b4340857cca3dc4c45b1ebbadce6bb61c0b; https://github.com/DSpace/DSpace/pull/8891; https://github.com/DSpace/DSpace/pull/9638
CVE: CVE-2024-38526
Published: 2024-06-26
Description: pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.
CVSS Score: 7.2 (HIGH)
References: https://github.com/mitmproxy/pdoc/pull/703; https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62; https://sansec.io/research/polyfill-supply-chain-attack
CVE: CVE-2024-4869
Published: 2024-06-26
Description: The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/3.2.0/public/class-gdpr-cookie-consent-public.php#L793; https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/3.2.0/public/modules/consent-logs/class-wpl-cookie-consent-consent-logs.php#L570; https://www.wordfence.com/threat-intel/vulnerabilities/id/507b2e65-987b-4d4a-8a99-5366048d925e?source=cve
CVE: CVE-2024-5460
Published: 2024-06-26
Description: A vulnerability in the default configuration of the Simple Network 
Management Protocol (SNMP) feature of Brocade Fabric OS versions before 
v9.0.0 could allow an authenticated, remote attacker to read data from 
an affected device via SNMP. The vulnerability is due to hard-coded, 
default community string in the configuration file for the SNMP daemon. 
An attacker could exploit this vulnerability by using the static 
community string in SNMP version 1 queries to an affected device.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798, CWE-798
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24409; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24409
CVE: CVE-2024-24764
Published: 2024-06-26
Description: October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema.  The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15.
CVSS Score: 3.5 (LOW)
CWE: CWE-601, CWE-601
References: https://github.com/octobercms/october/security/advisories/GHSA-v2vf-jv88-3fp5; https://github.com/octobercms/october/security/advisories/GHSA-v2vf-jv88-3fp5