deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-35006
Published: 2024-07-10
Description: IBM Security QRadar EDR 3.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.ibm.com/support/pages/node/7159770; https://exchange.xforce.ibmcloud.com/vulnerabilities/297165; https://www.ibm.com/support/pages/node/7159770
CVE: CVE-2024-20456
Published: 2024-07-10
Description: A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Cisco Secure Boot functionality and load unverified software on an affected device. To exploit this successfully, the attacker must have root-system privileges on the affected device.
 This vulnerability is due to an error in the software build process. An attacker could exploit this vulnerability by manipulating the system&rsquo;s configuration options to bypass some of the integrity checks that are performed during the booting process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass of the requirement to run Cisco signed images or alter the security properties of the running system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-secure-boot-quD5g8Ap; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-secure-boot-quD5g8Ap
CVE: CVE-2024-40412
Published: 2024-07-10
Description: Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121
References: https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX12/1/README.md; https://static.tenda.com.cn/tdcweb/download/uploadfile/AX12/V22.03.01.46.zip; https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX12/1/README.md
CVE: CVE-2024-40417
Published: 2024-07-10
Description: A vulnerability was found in Tenda AX1806 1.0.0.1. Affected by this issue is the function formSetRebootTimer of the file /goform/SetIpMacBind. The manipulation of the argument list leads to stack-based buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX_1806/1/SetIpMacBind.md; https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX_1806/1/SetIpMacBind.md
CVE: CVE-2024-3325
Published: 2024-07-10
Description: Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-july-9-2024-jasperreports-server-cve-2024-3325-r4/; https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-july-9-2024-jasperreports-server-cve-2024-3325-r4/
CVE: CVE-2024-4879
Published: 2024-07-10
Description: ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1287
References: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154; https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit
CVE: CVE-2024-5178
Published: 2024-07-10
Description: ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web application server. The vulnerability is addressed in the listed patches and hot fixes, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-184
References: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648312; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293
CVE: CVE-2024-5217
Published: 2024-07-10
Description: ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-184, CWE-697
References: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313; https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit
CVE: CVE-2024-6644
Published: 2024-07-10
Description: A vulnerability was found in zmops ArgusDBM up to 0.1.0. It has been classified as critical. Affected is the function getDefaultClassLoader of the file CalculateAlarm.java of the component AviatorScript Handler. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-271050 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/zmops/ArgusDBM/issues/64; https://vuldb.com/?ctiid.271050; https://vuldb.com/?id.271050
CVE: CVE-2024-6645
Published: 2024-07-10
Description: A vulnerability was found in WuKongOpenSource Wukong_nocode up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file ExpressionUtil.java of the component AviatorScript Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-271051.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/WuKongOpenSource/Wukong_nocode/issues/4; https://vuldb.com/?ctiid.271051; https://vuldb.com/?id.271051
CVE: CVE-2024-32759
Published: 2024-07-10
Description: Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials.
CWE: CWE-1391
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-04; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-04
CVE: CVE-2024-37110
Published: 2024-07-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-settings-users-data-dump-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-settings-users-data-dump-vulnerability?_s_id=cve
CVE: CVE-2024-37113
Published: 2024-07-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-database-backup-download-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-database-backup-download-vulnerability?_s_id=cve
CVE: CVE-2024-37115
Published: 2024-07-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/newspack-blocks/wordpress-newspack-blocks-plugin-3-0-8-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/newspack-blocks/wordpress-newspack-blocks-plugin-3-0-8-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-37205
Published: 2024-07-10
Description: Insertion of Sensitive Information into Log File vulnerability in SERVIT Software Solutions.This issue affects affiliate-toolkit: from n/a through 3.4.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affiliate-toolkit-plugin-3-4-4-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affiliate-toolkit-plugin-3-4-4-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-37270
Published: 2024-07-10
Description: Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/vendor/wordpress-trustedlogin-vendor-plugin-1-1-1-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/vendor/wordpress-trustedlogin-vendor-plugin-1-1-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-37498
Published: 2024-07-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.33.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/tablesome/wordpress-tablesome-plugin-1-0-33-sensitive-data-exposure-via-api-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tablesome/wordpress-tablesome-plugin-1-0-33-sensitive-data-exposure-via-api-vulnerability?_s_id=cve
CVE: CVE-2024-37504
Published: 2024-07-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library: from n/a through 2.0.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/filebird-document-library/wordpress-filebird-document-library-plugin-2-0-6-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/filebird-document-library/wordpress-filebird-document-library-plugin-2-0-6-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-37770
Published: 2024-07-10
Description: 14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://github.com/b1ackc4t/14Finger/issues/13; https://github.com/k3ppf0r/CVE-2024-37770; https://github.com/b1ackc4t/14Finger/issues/13
CVE: CVE-2024-6630
Published: 2024-07-10
Description: Rejected reason: **REJECT** This CVE ID was issued in error and is a duplicate. Please use CVE-2024-6500 instead.
CVE: CVE-2024-6646
Published: 2024-07-10
Description: A vulnerability was found in Netgear WN604 up to 20240710. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /downloadFile.php of the component Web Interface. The manipulation of the argument file with the input config leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/mikutool/vul/issues/1; https://vuldb.com/?ctiid.271052; https://vuldb.com/?id.271052
CVE: CVE-2024-6647
Published: 2024-07-10
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler. The manipulation of the argument Content-Type leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271053 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/Mirage/blob/main/CVE-1.md; https://vuldb.com/?ctiid.271053; https://vuldb.com/?id.271053
CVE: CVE-2024-27090
Published: 2024-07-10
Description: Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed. This vulnerability is fixed in 0.27.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705; https://github.com/decidim/decidim/pull/12528; https://github.com/decidim/decidim/releases/tag/v0.27.6
CVE: CVE-2024-27095
Published: 2024-07-10
Description: Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/decidim/decidim/releases/tag/v0.27.6; https://github.com/decidim/decidim/releases/tag/v0.28.1; https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3
CVE: CVE-2024-32469
Published: 2024-07-10
Description: Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. This vulnerability is fixed in 0.27.6 and 0.28.1.

CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/decidim/decidim/releases/tag/v0.27.6; https://github.com/decidim/decidim/releases/tag/v0.28.1; https://github.com/decidim/decidim/security/advisories/GHSA-7cx8-44pc-xv3q
CVE: CVE-2024-37147
Published: 2024-07-10
Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-f2cg-fc85-ffmh; https://github.com/glpi-project/glpi/security/advisories/GHSA-f2cg-fc85-ffmh
CVE: CVE-2024-5491
Published: 2024-07-10
Description: Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler
CVSS Score: 7.5 (HIGH)
References: https://support.citrix.com/article/CTX677944/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492; https://support.citrix.com/external/article?articleUrl=CTX677944-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492; https://support.citrix.com/article/CTX677944/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492
CVE: CVE-2024-5492
Published: 2024-07-10
Description: Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://support.citrix.com/article/CTX677944/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492; https://support.citrix.com/external/article?articleUrl=CTX677944-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492; https://support.citrix.com/article/CTX677944/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20245491-and-cve20245492
CVE: CVE-2024-5910
Published: 2024-07-10
Description: Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.

Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://security.paloaltonetworks.com/CVE-2024-5910; https://security.paloaltonetworks.com/CVE-2024-5910; https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise
CVE: CVE-2024-5911
Published: 2024-07-10
Description: An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which requires manual intervention to bring the Panorama back online.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-434
References: https://security.paloaltonetworks.com/CVE-2024-5911; https://security.paloaltonetworks.com/CVE-2024-5911
CVE: CVE-2024-5912
Published: 2024-07-10
Description: An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities and run untrusted executables on the device. This issue can be leveraged to execute untrusted software without being detected or blocked.
CWE: CWE-347
References: https://security.paloaltonetworks.com/CVE-2024-5912; https://security.paloaltonetworks.com/CVE-2024-5912
CVE: CVE-2024-5913
Published: 2024-07-10
Description: An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system to elevate privileges.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://security.paloaltonetworks.com/CVE-2024-5913; https://security.paloaltonetworks.com/CVE-2024-5913
CVE: CVE-2024-6235
Published: 2024-07-10
Description: Sensitive information disclosure in NetScaler Console
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://support.citrix.com/article/CTX677998; https://support.citrix.com/article/CTX677998
CVE: CVE-2024-6649
Published: 2024-07-10
Description: A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is the function save_users of the file Users.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271057 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/Xu-Mingming/cve/blob/main/csrf1.md; https://vuldb.com/?ctiid.271057; https://vuldb.com/?id.271057
CVE: CVE-2024-25076
Published: 2024-07-10
Description: An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The bootrom function responsible for validating the Flash Product Header directly uses a user-controllable size value (Length of Flash Config Section) to control a read from the QSPI device into a fixed sized buffer, resulting in a buffer overflow and execution of arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2024-0001.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2024-0001.md
CVE: CVE-2024-25077
Published: 2024-07-10
Description: An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The Nonce used for on-the-fly decryption of flash images is stored in an unsigned header, allowing its value to be modified without invalidating the signature used for secureboot image verification. Because the encryption engine for on-the-fly decryption uses AES in CTR mode without authentication, an attacker-modified Nonce can result in execution of arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2024-0001.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2024-0001.md
CVE: CVE-2024-37148
Published: 2024-07-10
Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrade to 10.0.16.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-p626-hph9-p6fj; https://github.com/glpi-project/glpi/security/advisories/GHSA-p626-hph9-p6fj
CVE: CVE-2024-37149
Published: 2024-07-10
Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16.
CVSS Score: 7.2 (HIGH)
CWE: CWE-73, CWE-94
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-cwvp-j887-m4xh; https://github.com/glpi-project/glpi/security/advisories/GHSA-cwvp-j887-m4xh
CVE: CVE-2024-37310
Published: 2024-07-10
Description: EVerest is an EV charging software stack. An integer overflow in the "v2g_incoming_v2gtp" function in the v2g_server.cpp implementation can allow a remote attacker to overflow the process' heap. This vulnerability is fixed in 2024.3.1 and 2024.6.0.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-122, CWE-190
References: https://github.com/EVerest/everest-core/commit/f73620c4c0f626e1097068a47e10cc27b369ad8e; https://github.com/EVerest/everest-core/releases/tag/2024.3.1; https://github.com/EVerest/everest-core/releases/tag/2024.6.0