deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-30220
Published: 2024-04-15
Description: Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port. Note that MZK-MF300N is no longer supported, therefore the update for this product is not provided.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://jvn.jp/en/vu/JVNVU91975826/; https://jvn.jp/en/vu/JVNVU91975826/
CVE: CVE-2024-30546
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Login With Ajax.This issue affects Login With Ajax: from n/a through 4.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/login-with-ajax/wordpress-login-with-ajax-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/login-with-ajax/wordpress-login-with-ajax-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31373
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/e2pdf/vulnerability/wordpress-e2pdf-plugin-1-20-27-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/e2pdf/wordpress-e2pdf-plugin-1-20-27-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31374
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Scott Bolinger AppPresser apppresser allows Cross Site Request Forgery.This issue affects AppPresser: from n/a through <= 4.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/apppresser/vulnerability/wordpress-apppresser-mobile-app-framework-plugin-4-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/apppresser/wordpress-apppresser-mobile-app-framework-plugin-4-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31376
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Andrew Dashboard To-Do List dashboard-to-do-list.This issue affects Dashboard To-Do List: from n/a through <= 1.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/dashboard-to-do-list/vulnerability/wordpress-dashboard-to-do-list-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dashboard-to-do-list/wordpress-dashboard-to-do-list-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31378
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mailchimp-forms-by-mailmunch/wordpress-mailchimp-forms-by-mailmunch-plugin-3-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mailchimp-forms-by-mailmunch/wordpress-mailchimp-forms-by-mailmunch-plugin-3-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31379
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Smash Balloon Social Post Feed.This issue affects Smash Balloon Social Post Feed: from n/a through 4.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/custom-facebook-feed/wordpress-smash-balloon-social-post-feed-plugin-4-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-facebook-feed/wordpress-smash-balloon-social-post-feed-plugin-4-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31381
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in RebelCode Spotlight Social Media Feeds.This issue affects Spotlight Social Media Feeds: from n/a through 1.6.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/spotlight-social-photo-feeds/wordpress-spotlight-social-feeds-plugin-1-6-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/spotlight-social-photo-feeds/wordpress-spotlight-social-feeds-plugin-1-6-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31382
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through <= 2.0.22.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Theme/blocksy/vulnerability/wordpress-blocksy-theme-2-0-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/blocksy/wordpress-blocksy-theme-2-0-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31383
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pagelayer PopularFX.This issue affects PopularFX: from n/a through 1.2.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/popularfx/wordpress-popularfx-theme-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/popularfx/wordpress-popularfx-theme-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31384
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Spa and Salon.This issue affects Spa and Salon: from n/a through 1.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/spa-and-salon/wordpress-spa-and-salon-theme-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/spa-and-salon/wordpress-spa-and-salon-theme-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31385
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Reservation Diary ReDi Restaurant Reservation.This issue affects ReDi Restaurant Reservation: from n/a through 24.0128.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/redi-restaurant-reservation/wordpress-redi-restaurant-reservation-plugin-24-0128-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/redi-restaurant-reservation/wordpress-redi-restaurant-reservation-plugin-24-0128-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31388
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.25.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/tablesome/wordpress-tablesome-plugin-1-0-25-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tablesome/wordpress-tablesome-plugin-1-0-25-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31389
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ertano MihanPanel.This issue affects MihanPanel: from n/a before 12.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mihanpanel-lite/wordpress-mihanpanel-plugin-12-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mihanpanel-lite/wordpress-mihanpanel-plugin-12-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31421
Published: 2024-04-15
Description: Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.This issue affects Popup by Supsystic: from n/a through <= 1.10.27.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/popup-by-supsystic/vulnerability/wordpress-popup-by-supsystic-plugin-1-10-27-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/popup-by-supsystic/wordpress-popup-by-supsystic-plugin-1-10-27-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32129
Published: 2024-04-15
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Freshworks Freshdesk (official).This issue affects Freshdesk (official): from n/a through 2.3.6.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/freshdesk-support/wordpress-freshdesk-official-plugin-2-3-4-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/freshdesk-support/wordpress-freshdesk-official-plugin-2-3-4-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-3802
Published: 2024-04-15
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-24891
Published: 2024-04-15
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C.

This issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.


CVSS Score: 6.0 (MEDIUM)
CWE: CWE-200
References: https://gitee.com/openeuler/kernel/pulls/2810; https://gitee.com/src-openeuler/kernel/pulls/1320; https://gitee.com/src-openeuler/kernel/pulls/1321
CVE: CVE-2024-24898
Published: 2024-04-15
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C.

This issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.


CVSS Score: 6.0 (MEDIUM)
CWE: CWE-200
References: https://gitee.com/src-openeuler/kernel/pulls/1320; https://gitee.com/src-openeuler/kernel/pulls/1321; https://gitee.com/src-openeuler/kernel/pulls/1322
CVE: CVE-2024-3780
Published: 2024-04-15
Description: A vulnerability of Information Exposure has been found on Technicolor CGA2121 affecting the version 1.01, this vulnerability allows a local attacker to obtain sensitive information stored on the device such as wifi network's SSID and their respective passwords.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-technicolor-cga2121; https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-technicolor-cga2121
CVE: CVE-2024-3781
Published: 2024-04-15
Description: Command injection vulnerability in the operating system. Improper neutralisation of special elements in Active Directory integration allows the intended command to be modified when sent to a downstream component in WBSAirback 21.02.04.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3782
Published: 2024-04-15
Description: Cross-Site Request Forgery vulnerability in WBSAirback 21.02.04, which could allow an attacker to create a manipulated HTML form to perform privileged actions once it is executed by a privileged user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3783
Published: 2024-04-15
Description: The Backup Agents section in WBSAirback 21.02.04 is affected by a Path Traversal vulnerability, allowing a user with low privileges to download files from the system.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3784
Published: 2024-04-15
Description: Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 Accounts (/admin/CloudAccounts). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3785
Published: 2024-04-15
Description: Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device NAS shared section (/admin/DeviceNAS). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3786
Published: 2024-04-15
Description: Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device Synchronizations (/admin/DeviceReplication). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-31576
Published: 2024-04-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-3797
Published: 2024-04-15
Description: A vulnerability was found in SourceCodester QR Code Bookmark System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-bookmark.php?bookmark=1. The manipulation of the argument bookmark leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260764.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/QR%20Code%20Bookmark%20System/QR%20Code%20Bookmark%20System%20-%20SQL%20Injection.md; https://vuldb.com/?ctiid.260764; https://vuldb.com/?id.260764
CVE: CVE-2023-38511
Published: 2024-04-15
Description: iTop is an IT service management platform.  Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7; https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab; https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm
CVE: CVE-2023-43790
Published: 2024-04-15
Description: iTop is an IT service management platform.  By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.

CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/Combodo/iTop/commit/03c9ffc0334fd44f3f0e[PII_REDACTED]7064e1c732; https://github.com/Combodo/iTop/security/advisories/GHSA-96xm-p83r-hm97; https://github.com/Combodo/iTop/commit/03c9ffc0334fd44f3f0e[PII_REDACTED]7064e1c732
CVE: CVE-2023-44396
Published: 2024-04-15
Description: iTop is an IT service management platform.  Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.

CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/Combodo/iTop/commit/9df92665e08c4bf5d4d8a5a9fe21fd3fb26fb273; https://github.com/Combodo/iTop/commit/c72cb7e70ebf469ce0ec01f5f9b524e39afe6c7f; https://github.com/Combodo/iTop/security/advisories/GHSA-gqqj-jgh6-3x35
CVE: CVE-2023-45808
Published: 2024-04-15
Description: iTop is an IT service management platform.  When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/Combodo/iTop/commit/5a434486443a2cf8b8a288475aada54d0a068ca7; https://github.com/Combodo/iTop/commit/8f61c02cbe17badff87bff9b8ada85e783c47385; https://github.com/Combodo/iTop/security/advisories/GHSA-245j-66p9-pwmh
CVE: CVE-2023-47123
Published: 2024-04-15
Description: iTop is an IT service management platform.  By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Combodo/iTop/commit/34ba4fa0ce99534f751d9f170fe0eda103e20c72; https://github.com/Combodo/iTop/security/advisories/GHSA-mx8x-693w-9hjp; https://github.com/Combodo/iTop/commit/34ba4fa0ce99534f751d9f170fe0eda103e20c72
CVE: CVE-2023-47622
Published: 2024-04-15
Description: iTop is an IT service management platform.  When dashlet are refreshed, XSS attacks are possible.  This vulnerability is fixed in 3.0.4 and 3.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Combodo/iTop/commit/09be84f69da0fe44221f63b8c2db041bdf7dd7f9; https://github.com/Combodo/iTop/security/advisories/GHSA-q9cm-q7fc-frxh; https://github.com/Combodo/iTop/commit/09be84f69da0fe44221f63b8c2db041bdf7dd7f9
CVE: CVE-2023-47626
Published: 2024-04-15
Description: iTop is an IT service management platform.  When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-vv3v-9vrv-h95h; https://github.com/Combodo/iTop/security/advisories/GHSA-vv3v-9vrv-h95h
CVE: CVE-2023-48709
Published: 2024-04-15
Description: iTop is an IT service management platform.  When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-1236, CWE-1236
References: https://github.com/Combodo/iTop/commit/083a0b79bfa2c106735b5c10eddb35a05ec7f04a; https://github.com/Combodo/iTop/commit/b10bcb976dfe8e55aa0f659bfbcdd18334a1b17c; https://github.com/Combodo/iTop/security/advisories/GHSA-9q3x-9987-53x9
CVE: CVE-2023-48710
Published: 2024-04-15
Description: iTop is an IT service management platform.  Files from the `env-production` folder can be retrieved even though they should have restricted access.  Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. 
 The `pages/exec.php` script as been fixed to limit execution of PHP files only.  Other file types won't be retrieved and exposed.  The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-552, CWE-552
References: https://github.com/Combodo/iTop/commit/3b2da39469f7a4636ed250ed0d33f4efff38be26; https://github.com/Combodo/iTop/security/advisories/GHSA-g652-q7cc-7hfc; https://github.com/Combodo/iTop/commit/3b2da39469f7a4636ed250ed0d33f4efff38be26
CVE: CVE-2023-4855
Published: 2024-04-15
Description: 
A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized commands via IPMI.


CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://support.lenovo.com/us/en/product_security/LEN-140420; https://support.lenovo.com/us/en/product_security/LEN-140420
CVE: CVE-2023-4856
Published: 2024-04-15
Description: 
A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoint. 


CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://support.lenovo.com/us/en/product_security/LEN-140420; https://support.lenovo.com/us/en/product_security/LEN-140420
CVE: CVE-2023-4857
Published: 2024-04-15
Description: 
An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead to exposure of limited system information.


CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://support.lenovo.com/us/en/product_security/LEN-140420; https://support.lenovo.com/us/en/product_security/LEN-140420
CVE: CVE-2024-22014
Published: 2024-04-15
Description: An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbolic Link Follow to Arbitrary File Delete.
CVSS Score: 8.8 (HIGH)
CWE: CWE-61
References: https://github.com/mansk1es/CVE_360TS; https://github.com/mansk1es/CVE_360TS
CVE: CVE-2024-23559
Published: 2024-04-15
Description: HCL DevOps Deploy / Launch is generating an obsolete HTTP header.

CVSS Score: 6.1 (MEDIUM)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111924; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111924
CVE: CVE-2024-23593
Published: 2024-04-15
Description: 
A vulnerability was reported

in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from 2012 to 2014

 that could allow a privileged attacker with local access to modify the boot manager and escalate privileges. 


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1284
References: https://support.lenovo.com/us/en/product_security/LEN-132277; https://support.lenovo.com/us/en/product_security/LEN-132277
CVE: CVE-2024-23594
Published: 2024-04-15
Description: 
A buffer overflow vulnerability was reported

in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from 2012 to 2014


 that could allow a privileged attacker with local access to execute arbitrary code. 


CVSS Score: 6.4 (MEDIUM)
CWE: CWE-121
References: https://support.lenovo.com/us/en/product_security/LEN-132277; https://support.lenovo.com/us/en/product_security/LEN-132277