deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4034
Published: 2024-05-02
Description: The Virtue theme for WordPress is vulnerable to Stored Cross-Site Scripting via a Post Author's name in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping when the latest posts feature is enabled on the homepage. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/virtue/3.4.8/templates/home/blog-home.php#L87; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=225592%40virtue&new=225592%40virtue&sfp_email=&sfph_mail=#file18; https://www.wordfence.com/threat-intel/vulnerabilities/id/d8272233-afb3-46f1-ab85-189a3923e29d?source=cve
CVE: CVE-2024-4036
Published: 2024-05-02
Description: The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/sydney-toolbox/trunk/inc/elementor/block-employee.php#L346; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3075394%40sydney-toolbox%2Ftrunk&old=3064481%40sydney-toolbox%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c6d5275d-43d0-41f6-96c7-e7646eac4534?source=cve
CVE: CVE-2024-4083
Published: 2024-05-02
Description: The Easy Restaurant Table Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/fd-elementor-imagebox/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1492440d-c6c8-46c0-bc88-c9e3f9933ad4?source=cve; https://wordpress.org/plugins/fd-elementor-imagebox/
CVE: CVE-2024-4085
Published: 2024-05-02
Description: The Tabellen von faustball.com plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078169%40docollipics-faustball-de%2Ftrunk&old=3076848%40docollipics-faustball-de%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b7417e25-be35-4134-9d38-f8ee91f0d1cf?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078169%40docollipics-faustball-de%2Ftrunk&old=3076848%40docollipics-faustball-de%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-4086
Published: 2024-05-02
Description: The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings or reset them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3076616/enhanced-tooltipglossary/trunk/settings/CMTT_Settings.php?contextall=1&old=3029791&old_path=%2Fenhanced-tooltipglossary%2Ftrunk%2Fsettings%2FCMTT_Settings.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e2ddde-1421-4352-b93a-1492574f624e?source=cve; https://plugins.trac.wordpress.org/changeset/3076616/enhanced-tooltipglossary/trunk/settings/CMTT_Settings.php?contextall=1&old=3029791&old_path=%2Fenhanced-tooltipglossary%2Ftrunk%2Fsettings%2FCMTT_Settings.php
CVE: CVE-2024-4092
Published: 2024-05-02
Description: The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmltag’ parameter in all versions up to, and including, 6.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Slider Revolution can be extended to authors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.sliderrevolution.com/documentation/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8437abcc-3e34-4a8a-bfe2-2ff7c9f41164?source=cve; https://www.sliderrevolution.com/documentation/changelog/
CVE: CVE-2024-4097
Published: 2024-05-02
Description: The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 3.1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version; https://www.wordfence.com/threat-intel/vulnerabilities/id/526add70-4fcf-44d1-b4d8-4cc35652b1f0?source=cve; https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version
CVE: CVE-2024-4133
Published: 2024-05-02
Description: The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.0.30. This is due to insufficient validation on the redirect url supplied via the redirect_to parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078683%40armember-membership%2Ftrunk&old=3069538%40armember-membership%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/80d113aa-7401-4b58-a755-f64146d9fb08?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078683%40armember-membership%2Ftrunk&old=3069538%40armember-membership%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-4156
Published: 2024-05-02
Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_event_text_color’ parameter in versions up to, and including, 5.9.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Event_Calendar.php#L3125; https://plugins.trac.wordpress.org/changeset/3079406/; https://www.wordfence.com/threat-intel/vulnerabilities/id/23a66e6b-cec0-4110-9bef-a5d41ce1c954?source=cve
CVE: CVE-2024-4203
Published: 2024-05-02
Description: The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions up to, and including, 4.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only affects sites running the premium version of the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3078006/premium-addons-for-elementor/trunk/widgets/premium-maps.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/51fab95e-336d-4544-8b8e-c4e9002321ec?source=cve; https://plugins.trac.wordpress.org/changeset/3078006/premium-addons-for-elementor/trunk/widgets/premium-maps.php
CVE: CVE-2024-4265
Published: 2024-05-02
Description: The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 2.0.5.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35688 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-image-carousel/ma-image-carousel.php#L915; https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-logo-slider/ma-logo-slider.php#L825; https://plugins.trac.wordpress.org/changeset/3078134/
CVE: CVE-2024-4324
Published: 2024-05-02
Description: The WP Video Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-video-lightbox/trunk/misc_functions.php#L60; https://www.wordfence.com/threat-intel/vulnerabilities/id/da2d8494-aea3-4a1e-9eca-946c0bd390cd?source=cve; https://plugins.trac.wordpress.org/browser/wp-video-lightbox/trunk/misc_functions.php#L60
CVE: CVE-2024-4334
Published: 2024-05-02
Description: The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the ‘typing_cursor’ parameter in versions up to, and including, 2.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/supreme-modules-for-divi/trunk/includes/modules/TypingEffect/TypingEffect.php#L744; https://plugins.trac.wordpress.org/browser/supreme-modules-for-divi/trunk/includes/modules/TypingEffect/frontend.min.js; https://plugins.trac.wordpress.org/changeset/3079965/#file203
CVE: CVE-2024-33394
Published: 2024-05-02
Description: An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-94
References: https://gist.github.com/HouqiyuA/1b75e23ece7ad98490aec1c887bdf49b; https://gist.github.com/HouqiyuA/1b75e23ece7ad98490aec1c887bdf49b
CVE: CVE-2024-4215
Published: 2024-05-02
Description: pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.
CVSS Score: 7.4 (HIGH)
CWE: CWE-89
References: https://github.com/pgadmin-org/pgadmin4/issues/7425; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/; https://github.com/pgadmin-org/pgadmin4/issues/7425
CVE: CVE-2024-4216
Published: 2024-05-02
Description: pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: https://github.com/pgadmin-org/pgadmin4/issues/7282; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/; https://github.com/pgadmin-org/pgadmin4/issues/7282
CVE: CVE-2024-33396
Published: 2024-05-02
Description: An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284
References: https://gist.github.com/HouqiyuA/2b56a893c[PII_REDACTED]2836abb77ba50; https://gist.github.com/HouqiyuA/2b56a893c[PII_REDACTED]2836abb77ba50
CVE: CVE-2024-34391
Published: 2024-05-02
Description: libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled).
CVSS Score: 8.1 (HIGH)
CWE: CWE-843, CWE-843
References: https://github.com/libxmljs/libxmljs/issues/645; https://research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2[PII_REDACTED]88/; https://github.com/libxmljs/libxmljs/issues/645
CVE: CVE-2024-34392
Published: 2024-05-02
Description: libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes _wrap__xmlNode_nsDef_get()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-843, CWE-843
References: https://github.com/libxmljs/libxmljs/issues/646; https://research.jfrog.com/vulnerabilities/libxmljs-namespaces-type-confusion-rce-jfsa-2[PII_REDACTED]96/; https://github.com/libxmljs/libxmljs/issues/646
CVE: CVE-2024-34393
Published: 2024-05-02
Description: libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled).
CVSS Score: 8.1 (HIGH)
CWE: CWE-843
References: https://github.com/marudor/libxmljs2/issues/204; https://research.jfrog.com/vulnerabilities/libxmljs2-attrs-type-confusion-rce-jfsa-2[PII_REDACTED]97/; https://github.com/marudor/libxmljs2/issues/204
CVE: CVE-2024-34394
Published: 2024-05-02
Description: libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes XmlNode::get_local_namespaces()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-843
References: https://github.com/marudor/libxmljs2/issues/205; https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2[PII_REDACTED]98/; https://github.com/marudor/libxmljs2/issues/205
CVE: CVE-2024-4140
Published: 2024-05-02
Description: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://bugs.debian.org/960062; https://github.com/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2; https://github.com/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8
CVE: CVE-2024-25047
Published: 2024-05-02
Description: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system.  IBM X-Force ID:  282956.
CVSS Score: 8.6 (HIGH)
CWE: CWE-117
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/282956; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7149874
CVE: CVE-2024-30301
Published: 2024-05-02
Description: Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb24-07.html; https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
CVE: CVE-2024-30302
Published: 2024-05-02
Description: Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb24-07.html; https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
CVE: CVE-2024-30303
Published: 2024-05-02
Description: Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb24-07.html; https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
CVE: CVE-2024-30304
Published: 2024-05-02
Description: Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb24-07.html; https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
CVE: CVE-2024-30305
Published: 2024-05-02
Description: Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb24-07.html; https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
CVE: CVE-2024-30306
Published: 2024-05-02
Description: Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb24-07.html; https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
CVE: CVE-2024-34031
Published: 2024-05-03
Description: 
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-02
CVE: CVE-2024-34032
Published: 2024-05-03
Description: 
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-02
CVE: CVE-2024-34033
Published: 2024-05-03
Description: 
Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.


CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-02
CVE: CVE-2024-34401
Published: 2024-05-03
Description: Savsoft Quiz 6.0 allows stored XSS via the index.php/quiz/insert_quiz/ quiz_name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/51988; https://www.exploit-db.com/exploits/51988
CVE: CVE-2024-34402
Published: 2024-05-03
Description: An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.
CVSS Score: 8.6 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2024/05/06/1; http://www.openwall.com/lists/oss-security/2024/05/06/3; https://github.com/uriparser/uriparser/issues/183
CVE: CVE-2024-34403
Published: 2024-05-03
Description: An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2024/05/06/1; http://www.openwall.com/lists/oss-security/2024/05/06/3; https://github.com/uriparser/uriparser/issues/183
CVE: CVE-2024-34404
Published: 2024-05-03
Description: A vulnerability was discovered in the Alta Recovery Vault feature of Veritas NetBackup before 10.4 and NetBackup Appliance before 5.4. By design, only the cloud administrator should be able to disable the retention lock of Governance mode images. This vulnerability allowed a NetBackup administrator to modify the expiration of backups under Governance mode (which could cause premature deletion).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://www.veritas.com/support/en_US/security/VTS24-004; https://www.veritas.com/support/en_US/security/VTS24-004