deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-42447
Published: 2024-08-05
Description: Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.

This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.  

* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)

* FAB provider 1.2.0 affected all versions of Airflow.

Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.

Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.

Also upgrading Apache Airflow to latest version available is recommended.

Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images. 

Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://github.com/apache/airflow/pull/40784; https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52; http://www.openwall.com/lists/oss-security/2024/08/04/2
CVE: CVE-2024-38856
Published: 2024-08-05
Description: Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://issues.apache.org/jira/browse/OFBIZ-13128; https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w; https://ofbiz.apache.org/download.html
CVE: CVE-2024-36448
Published: 2024-08-05
Description: ** UNSUPPORTED WHEN ASSIGNED ** Server-Side Request Forgery (SSRF) vulnerability in Apache IoTDB Workbench.

This issue affects Apache IoTDB Workbench: from 0.13.0.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918
References: https://lists.apache.org/thread/d19p0vsm7nogp43q9m3tzm5jl6mzjj1x; http://www.openwall.com/lists/oss-security/2024/08/05/1
CVE: CVE-2024-40096
Published: 2024-08-05
Description: The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log.
CVSS Score: 3.3 (LOW)
CWE: CWE-532, CWE-532
References: https://www.quokka.io/blog/critical-pii-exposure-in-who-caller-id-spam-block-app; https://www.quokka.io/critical-vulnerabilities-exploits-cve
CVE: CVE-2024-2937
Published: 2024-08-05
Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-4607
Published: 2024-08-05
Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-6472
Published: 2024-08-05
Description: Certificate Validation user interface in LibreOffice allows potential vulnerability.




Signed macros are scripts that have been digitally signed by the 
developer using a cryptographic signature. When a document with a signed
 macro is opened a warning is displayed by LibreOffice before the macro 
is executed.

Previously if verification failed the user could fail to understand the failure and choose to enable the macros anyway.


This issue affects LibreOffice: from 24.2 before 24.2.5.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://www.libreoffice.org/about-us/security/advisories/CVE-2024-6472
CVE: CVE-2024-6865
Published: 2024-08-05
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-7383
Published: 2024-08-05
Description: A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://access.redhat.com/errata/RHSA-2024:6757; https://access.redhat.com/errata/RHSA-2024:6964; https://access.redhat.com/security/cve/CVE-2024-7383
CVE: CVE-2024-7395
Published: 2024-08-05
Description: An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This issue affects JetPort 5601v3: through 1.2.
CWE: CWE-287
References: https://cyberdanube.com/de/en-multiple-vulnerabilities-in-korenix-jetport/; http://seclists.org/fulldisclosure/2024/Aug/2
CVE: CVE-2024-7396
Published: 2024-08-05
Description: Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2.
CWE: CWE-311
References: https://cyberdanube.com/de/en-multiple-vulnerabilities-in-korenix-jetport/; http://seclists.org/fulldisclosure/2024/Aug/2
CVE: CVE-2024-7397
Published: 2024-08-05
Description: Improper filering of special characters result in a command ('command injection') vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: through 1.2.
CWE: CWE-77
References: https://cyberdanube.com/de/en-multiple-vulnerabilities-in-korenix-jetport/; http://seclists.org/fulldisclosure/2024/Aug/2
CVE: CVE-2024-7409
Published: 2024-08-05
Description: A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.
CVSS Score: 7.5 (HIGH)
CWE: CWE-662
References: https://access.redhat.com/errata/RHSA-2024:10518; https://access.redhat.com/errata/RHSA-2024:10528; https://access.redhat.com/errata/RHSA-2024:10813
CVE: CVE-2024-21459
Published: 2024-08-05
Description: Information disclosure while handling beacon or probe response frame in STA.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-21467
Published: 2024-08-05
Description: Information disclosure while handling beacon probe frame during scan entry generation in client side.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-21479
Published: 2024-08-05
Description: Transient DOS during music playback of ALAC content.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-21481
Published: 2024-08-05
Description: Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23350
Published: 2024-08-05
Description: Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23352
Published: 2024-08-05
Description: Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23353
Published: 2024-08-05
Description: Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23355
Published: 2024-08-05
Description: Memory corruption when keymaster operation imports a shared key.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23356
Published: 2024-08-05
Description: Memory corruption during session sign renewal request calls in HLOS.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23357
Published: 2024-08-05
Description: Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23381
Published: 2024-08-05
Description: Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23382
Published: 2024-08-05
Description: Memory corruption while processing graphics kernel driver request to create DMA fence.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23383
Published: 2024-08-05
Description: Memory corruption when kernel driver attempts to trigger hardware fences.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-23384
Published: 2024-08-05
Description: Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33010
Published: 2024-08-05
Description: Transient DOS while parsing fragments of MBSSID IE from beacon frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33011
Published: 2024-08-05
Description: Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33012
Published: 2024-08-05
Description: Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33013
Published: 2024-08-05
Description: Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33014
Published: 2024-08-05
Description: Transient DOS while parsing ESP IE from beacon/probe response frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33015
Published: 2024-08-05
Description: Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33018
Published: 2024-08-05
Description: Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33019
Published: 2024-08-05
Description: Transient DOS while parsing the received TID-to-link mapping action frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33020
Published: 2024-08-05
Description: Transient DOS while processing TID-to-link mapping IE elements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33021
Published: 2024-08-05
Description: Memory corruption while processing IOCTL call to set metainfo.
CVSS Score: 8.4 (HIGH)
CWE: CWE-457, CWE-908
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33022
Published: 2024-08-05
Description: Memory corruption while allocating memory in HGSL driver.
CVSS Score: 8.4 (HIGH)
CWE: CWE-190, CWE-190
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33023
Published: 2024-08-05
Description: Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33024
Published: 2024-08-05
Description: Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33025
Published: 2024-08-05
Description: Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33026
Published: 2024-08-05
Description: Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33027
Published: 2024-08-05
Description: Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33028
Published: 2024-08-05
Description: Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2024-33034
Published: 2024-08-05
Description: Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
CVE: CVE-2023-31355
Published: 2024-08-05
Description: Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allowing reading of memory from a decommissioned guest.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3011.html
CVE: CVE-2024-21978
Published: 2024-08-05
Description: Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruption.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: https://https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3011.html
CVE: CVE-2024-21980
Published: 2024-08-05
Description: Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in loss of confidentiality and integrity.
CVSS Score: 7.9 (HIGH)
CWE: CWE-119, CWE-787
References: https://https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3011.html
CVE: CVE-2024-40530
Published: 2024-08-05
Description: A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-For header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://critical.lt/blog/authorization-bypass-and-mass-assignment-in-pantera-crm/
CVE: CVE-2024-40531
Published: 2024-08-05
Description: A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated users to modify any user attribute, including roles, by injecting additional parameters via profile management functions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://critical.lt/blog/authorization-bypass-and-mass-assignment-in-pantera-crm/
CVE: CVE-2024-40498
Published: 2024-08-05
Description: SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the register.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Dirac231/CVE-2024-40498
CVE: CVE-2024-41200
Published: 2024-08-05
Description: A segmentation fault in KMPlayer v4.2.2.65 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file.
CVSS Score: 5.5 (MEDIUM)
References: https://gist.github.com/SecZone-SFuzz/3cf2d8b50ffe4b4951c193d8c0cd65a9
CVE: CVE-2024-41376
Published: 2024-08-05
Description: dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-31
References: https://github.com/zyx0814/dzzoffice/issues/252
CVE: CVE-2024-41380
Published: 2024-08-05
Description: microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/issues/1111
CVE: CVE-2024-41381
Published: 2024-08-05
Description: microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/issues/1110
CVE: CVE-2024-42008
Published: 2024-08-05
Description: A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/roundcube/roundcubemail/releases; https://github.com/roundcube/roundcubemail/releases/tag/1.5.8; https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
CVE: CVE-2024-42009
Published: 2024-08-05
Description: A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/roundcube/roundcubemail/releases; https://github.com/roundcube/roundcubemail/releases/tag/1.5.8; https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
CVE: CVE-2024-42010
Published: 2024-08-05
Description: mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/roundcube/roundcubemail/releases; https://github.com/roundcube/roundcubemail/releases/tag/1.5.8; https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
CVE: CVE-2024-6361
Published: 2024-08-05
Description: Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane. The vulnerability affects all version prior to version 23.4. The vulnerability could cause remote code execution attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://portal.microfocus.com/s/article/KM000032605?language=en_US
CVE: CVE-2024-41816
Published: 2024-08-05
Description: Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/XjSv/Cooked/commit/ac7455bdccc99fb2f5b3c[PII_REDACTED]c1623c3ec; https://github.com/XjSv/Cooked/security/advisories/GHSA-3gw3-2qjq-xqjj
CVE: CVE-2024-41820
Published: 2024-08-05
Description: Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-732
References: https://github.com/kubean-io/kubean/commit/167e97329e4a27ba2f456d2846d39af20e1af7ef; https://github.com/kubean-io/kubean/issues/1326; https://github.com/kubean-io/kubean/security/advisories/GHSA-3wfj-3x8q-hrpg