deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3875
Published: 2024-04-16
Description: A vulnerability was found in Tenda F1202 1.2.0.20(408). It has been rated as critical. This issue affects the function fromNatlimit of the file /goform/Natlimit. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260909 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromNatlimit.md; https://vuldb.com/?ctiid.260909; https://vuldb.com/?id.260909
CVE: CVE-2024-3876
Published: 2024-04-16
Description: A vulnerability classified as critical has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-260910 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromVirtualSer.md; https://vuldb.com/?ctiid.260910; https://vuldb.com/?id.260910
CVE: CVE-2024-25911
Published: 2024-04-16
Description: Missing Authorization vulnerability in Skymoon Labs MoveTo.This issue affects MoveTo: from n/a through 6.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/moveto/wordpress-moveto-plugin-6-2-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/moveto/wordpress-moveto-plugin-6-2-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-32455
Published: 2024-04-16
Description: Missing Authorization vulnerability in Very Good Plugins Fatal Error Notify.This issue affects Fatal Error Notify: from n/a through 1.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/fatal-error-notify/wordpress-fatal-error-notify-plugin-1-5-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fatal-error-notify/wordpress-fatal-error-notify-plugin-1-5-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-3877
Published: 2024-04-16
Description: A vulnerability classified as critical was found in Tenda F1202 1.2.0.20(408). Affected by this vulnerability is the function fromqossetting of the file /goform/fromqossetting. The manipulation of the argument qos leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260911. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromqossetting.md; https://vuldb.com/?ctiid.260911; https://vuldb.com/?id.260911
CVE: CVE-2024-3878
Published: 2024-04-16
Description: A vulnerability, which was classified as critical, has been found in Tenda F1202 1.2.0.20(408). Affected by this issue is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260912. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromwebExcptypemanFilter.md; https://vuldb.com/?ctiid.260912; https://vuldb.com/?id.260912
CVE: CVE-2024-3879
Published: 2024-04-16
Description: A vulnerability, which was classified as critical, was found in Tenda W30E 1.0.1.25(633). This affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260913 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/formSetCfm.md; https://vuldb.com/?ctiid.260913; https://vuldb.com/?id.260913
CVE: CVE-2024-3880
Published: 2024-04-16
Description: A vulnerability has been found in Tenda W30E 1.0.1.25(633) and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260914 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/formWriteFacMac.md; https://vuldb.com/?ctiid.260914; https://vuldb.com/?id.260914
CVE: CVE-2022-24805
Published: 2024-04-16
Description: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of             `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://bugzilla.redhat.com/show_bug.cgi?id=2103225; https://bugzilla.redhat.com/show_bug.cgi?id=2105238; https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937
CVE: CVE-2022-24806
Published: 2024-04-16
Description: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an Improper Input Validation vulnerability when SETing malformed OIDs in master agent and subagent simultaneously. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=2103225; https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775; https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html
CVE: CVE-2022-24807
Published: 2024-04-16
Description: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds memory access. A user with read-write credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://bugzilla.redhat.com/show_bug.cgi?id=2103225; https://bugzilla.redhat.com/show_bug.cgi?id=2105239; https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937
CVE: CVE-2022-24808
Published: 2024-04-16
Description: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a `SET` request to `NET-SNMP-AGENT-MIB::nsLogTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2103225; https://bugzilla.redhat.com/show_bug.cgi?id=2105240; https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937
CVE: CVE-2022-24809
Published: 2024-04-16
Description: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2103225; https://bugzilla.redhat.com/show_bug.cgi?id=2105242; https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775
CVE: CVE-2022-24810
Published: 2024-04-16
Description: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a SET to the nsVacmAccessTable to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2103225; https://bugzilla.redhat.com/show_bug.cgi?id=2105241; https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775
CVE: CVE-2023-51391
Published: 2024-04-16
Description: A bug in Micrium OS Network HTTP Server permits an invalid pointer dereference during header processing - potentially allowing a device crash and Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-476
References: https://community.silabs.com/068Vm000004688g; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1945; https://community.silabs.com/068Vm000004688g
CVE: CVE-2024-30378
Published: 2024-04-16
Description: A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition.  The process crashes and restarts automatically.

When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash.  This process manages and controls the configuration of broadband subscriber sessions and services.  While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition.

This issue only occurs if Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled.
This issue affects Junos OS:


  *  All versions before 20.4R3-S5, 
  *  from 21.1 before 21.1R3-S4, 
  *  from 21.2 before 21.2R3-S3, 
  *  from 21.3 before 21.3R3-S5, 
  *  from 21.4 before 21.4R3-S5, 
  *  from 22.1 before 22.1R3, 
  *  from 22.2 before 22.2R3, 
  *  from 22.3 before 22.3R2;
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://supportportal.juniper.net/JSA79109; https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L; https://supportportal.juniper.net/JSA79109
CVE: CVE-2024-30380
Published: 2024-04-16
Description: An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS), which causes the l2cpd process to crash by sending a specific TLV.

The l2cpd process is responsible for layer 2 control protocols, such as STP, RSTP, MSTP, VSTP, ERP, and LLDP.  The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP, leading to a Denial of Service.  Continued receipt and processing of this specific TLV will create a sustained Denial of Service (DoS) condition.
This issue affects:

Junos OS: 
all versions before 20.4R3-S9, 
from 21.2 before 21.2R3-S7, 
from 21.3 before 21.3R3-S5, 
from 21.4 before 21.4R3-S4, 
from 22.1 before 22.1R3-S4, 
from 22.2 before 22.2R3-S2, 
from 22.3 before 22.3R2-S2, 22.3R3-S1, 
from 22.4 before 22.4R2-S2, 22.4R3, 
from 23.2 before 23.2R1-S1, 23.2R2;

Junos OS Evolved: 
all versions before 21.2R3-S7,

 
from 21.3 before 21.3R3-S5-EVO, 
from 21.4 before 21.4R3-S5-EVO, 
from 22.1 before 22.1R3-S4-EVO, 
from 22.2 before 22.2R3-S2-EVO, 
from 22.3 before 22.3R2-S2-EVO, 22.3R3-S1-EVO, 
from 22.4 before 22.4R2-S2-EVO, 22.4R3-EVO, 
from 23.2 before 23.2R1-S1-EVO, 23.2R2-EVO.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://supportportal.juniper.net/JSA79171; https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L; https://supportportal.juniper.net/JSA79171
CVE: CVE-2024-31446
Published: 2024-04-16
Description: OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. A user can use OpenComputers to get a Computer thread stuck in the Lua VM, which eventually blocks the Server thread, requiring the server to be forcibly shut down. This can be accomplished using any device in the mod and can be performed by anyone who can execute Lua code on them. This occurs while using the native Lua library. LuaJ appears to not have this issue. This vulnerability is fixed in 1.8.4. The GregTech: New Horizons modpack uses its own modified version of OpenComputers. They have applied the relevant patch in version 1.10.10-GTNH.
CVSS Score: 7.7 (HIGH)
CWE: CWE-770
References: https://github.com/MightyPirates/OpenComputers/commit/9d4f7ea297953c2fd8ccfd24fe549d5e9576400f; https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-54j4-xpgj-cq4g; https://github.com/MightyPirates/OpenComputers/commit/9d4f7ea297953c2fd8ccfd24fe549d5e9576400f
CVE: CVE-2024-3881
Published: 2024-04-16
Description: A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical. This issue affects the function frmL7PlotForm of the file /goform/frmL7ProtForm. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260915. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/frmL7ProtForm.md; https://vuldb.com/?ctiid.260915; https://vuldb.com/?id.260915
CVE: CVE-2024-3882
Published: 2024-04-16
Description: A vulnerability was found in Tenda W30E 1.0.1.25(633). It has been classified as critical. Affected is the function fromRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260916. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromRouteStatic.md; https://vuldb.com/?ctiid.260916; https://vuldb.com/?id.260916
CVE: CVE-2024-3660
Published: 2024-04-16
Description: A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://kb.cert.org/vuls/id/253266; https://www.kb.cert.org/vuls/id/253266; https://kb.cert.org/vuls/id/253266
CVE: CVE-2024-20954
Published: 2024-04-16
Description: Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and  21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 3.7 (LOW)
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-20989
Published: 2024-04-16
Description: Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony POS).  Supported versions that are affected are 19.1.0-19.5.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data as well as  unauthorized update, insert or delete access to some of Oracle Hospitality Simphony accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality Simphony. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).
CVSS Score: 7.0 (HIGH)
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-20990
Published: 2024-04-16
Description: Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Templates).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Applications Technology accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-20991
Published: 2024-04-16
Description: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle HTTP Server accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-20992
Published: 2024-04-16
Description: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Content integration).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebCenter Portal accessible data as well as  unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-20993
Published: 2024-04-16
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuapr2024.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-20994
Published: 2024-04-16
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).  Supported versions that are affected are 8.0.36 and prior and  8.3.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 5.3 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuapr2024.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-20995
Published: 2024-04-16
Description: Vulnerability in the Oracle Database Sharding component of Oracle Database Server.  Supported versions that are affected are 19.3-19.22 and  21.3-21.13. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Oracle Database Sharding.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Sharding. CVSS 3.1 Base Score 2.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L).
CVSS Score: 2.4 (LOW)
CWE: CWE-404
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html