deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5996
Published: 2024-06-14
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-2472
Published: 2024-06-14
Description: The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://aramhairchitects.nl/; https://websec.nl/blog/critical-idor-vulnerability-in-latepoint-plugin-exposes-sensitive-data-666b78446e63d6dcdb0f73bf; https://wpdocs.latepoint.com/changelog/
CVE: CVE-2024-34012
Published: 2024-06-14
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.24135.272.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-276
References: https://security-advisory.acronis.com/advisories/SEC-5758; https://security-advisory.acronis.com/advisories/SEC-5758
CVE: CVE-2024-3912
Published: 2024-06-14
Description: Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-7876-396bd-2.html; https://www.twcert.org.tw/tw/cp-132-7875-872d3-1.html; https://www.twcert.org.tw/en/cp-139-7876-396bd-2.html
CVE: CVE-2024-5685
Published: 2024-06-14
Description: Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862, CWE-862
References: https://advisory.checkmarx.net/?search=CVE-2024-5685; https://devhub.checkmarx.com/cve-details/CVE-2024-5685/; https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1
CVE: CVE-2023-51376
Published: 2024-06-14
Description: Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Client Site: from n/a through 1.0.34.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/projecthuddle-child-site/wordpress-projecthuddle-client-site-plugin-1-0-34-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/projecthuddle-child-site/wordpress-projecthuddle-client-site-plugin-1-0-34-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-36459
Published: 2024-06-14
Description: A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for IIS Web Server and SiteMinder Web Agent for Domino Web Server. As a result, an attacker can execute arbitrary Javascript code in a client browser.
CWE: CWE-93
References: https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24537; https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1
CVE: CVE-2024-2023
Published: 2024-06-14
Description: The Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0 in Folders and 3.0.2 in Folders Pro via the 'handle_folders_file_upload' function. This makes it possible for authenticated attackers, with author access and above, to upload files to arbitrary locations on the server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/folders/tags/3.0/includes/media.replace.php#L1311; https://plugins.trac.wordpress.org/changeset/3070429/folders/trunk/includes/media.replace.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b4cc839c-de7a-43eb-a7fa-b1049419bfa3?source=cve
CVE: CVE-2024-2024
Published: 2024-06-14
Description: The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_folders_file_upload' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/folders/tags/3.0/includes/media.replace.php#L1311; https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1d953f-6a5c-46af-a1a5-2c4f90da679a?source=cve; https://plugins.trac.wordpress.org/browser/folders/tags/3.0/includes/media.replace.php#L1311
CVE: CVE-2024-37637
Published: 2024-06-14
Description: TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWizardCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TOTOLINK/A3700R/setWizardCfg/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TOTOLINK/A3700R/setWizardCfg/README.md
CVE: CVE-2024-37639
Published: 2024-06-14
Description: TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via eport in the function setIpPortFilterRules.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TOTOLINK/A3700R/setIpPortFilterRules/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TOTOLINK/A3700R/setIpPortFilterRules/README.md
CVE: CVE-2024-37640
Published: 2024-06-14
Description: TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWiFiEasyGuestCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/tree/main/TOTOLINK/A3700R/setWiFiEasyGuestCfg; https://github.com/s4ndw1ch136/IOT-vuln-reports/tree/main/TOTOLINK/A3700R/setWiFiEasyGuestCfg
CVE: CVE-2024-5671
Published: 2024-06-14
Description: Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://thrive.trellix.com/s/article/000013623; https://thrive.trellix.com/s/article/000013623
CVE: CVE-2024-5731
Published: 2024-06-14
Description: A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by manipulating the parameter, thereby leveraging sensitive information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-311
References: https://thrive.trellix.com/s/article/000013623; https://thrive.trellix.com/s/article/000013623
CVE: CVE-2024-23442
Published: 2024-06-14
Description: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://discuss.elastic.co/t/kibana-8-14-0-7-17-22-security-update/361502; https://discuss.elastic.co/t/kibana-8-14-0-7-17-22-security-update/361502
CVE: CVE-2024-33374
Published: 2024-06-14
Description: Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Incorrect-Access-Control-%28CVE%E2%80%902024%E2%80%9033374%29; https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-lb-link-bl-w1210m-router/; https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Incorrect-Access-Control-%28CVE%E2%80%902024%E2%80%9033374%29
CVE: CVE-2024-33375
Published: 2024-06-14
Description: LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-256
References: https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Credentials-Stored-in-Cleartext--%7C--Unencrypted-Credentials-%28CVE%E2%80%902024%E2%80%9033375%29; https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-lb-link-bl-w1210m-router/; https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Credentials-Stored-in-Cleartext--%7C--Unencrypted-Credentials-%28CVE%E2%80%902024%E2%80%9033375%29
CVE: CVE-2024-33377
Published: 2024-06-14
Description: LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1021
References: https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Clickjacking-%28CVE%E2%80%902024%E2%80%9033377%29; https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-lb-link-bl-w1210m-router/; https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Clickjacking-%28CVE%E2%80%902024%E2%80%9033377%29
CVE: CVE-2024-34539
Published: 2024-06-14
Description: Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-259
References: https://shinnai.altervista.org/exploits/SH-20240611-CVE-2024-34539.html; https://shinnai.altervista.org/exploits/SH-20240611-CVE-2024-34539.html
CVE: CVE-2024-34694
Published: 2024-06-14
Description: LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

CVSS Score: 8.1 (HIGH)
CWE: CWE-754
References: https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww; https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww
CVE: CVE-2024-36656
Published: 2024-06-14
Description: In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/minthcm/minthcm/issues/67; https://github.com/minthcm/minthcm/issues/67
CVE: CVE-2024-37312
Published: 2024-06-14
Description: user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q; https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2; https://hackerone.com/reports/2376929
CVE: CVE-2024-37313
Published: 2024-06-14
Description: Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v72-9xv5-3p7c; https://github.com/nextcloud/server/pull/44276; https://hackerone.com/reports/2419776
CVE: CVE-2024-37314
Published: 2024-06-14
Description: Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.
CVSS Score: 3.5 (LOW)
CWE: CWE-284, CWE-862
References: https://github.com/nextcloud/photos/pull/1749; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43; https://hackerone.com/reports/1946298
CVE: CVE-2024-37367
Published: 2024-06-14
Description: A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project.  This action is allowed without proper authentication verification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1675.html; https://https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1675.html
CVE: CVE-2024-37368
Published: 2024-06-14
Description: A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. Due to the lack of proper authentication, this action is allowed without proper authentication verification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-306
References: https://https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1676.html; https://https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1676.html
CVE: CVE-2024-37644
Published: 2024-06-14
Description: TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-259
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/hardcode/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/hardcode/README.md
CVE: CVE-2024-33373
Published: 2024-06-14
Description: An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. This vulnerability can allow attackers to access the router via a brute-force attack.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Password-Policy-Bypass--%7C--Inconsistent-Password-Policy-%28CVE%E2%80%902024%E2%80%9033373%29; https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-lb-link-bl-w1210m-router/; https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Password-Policy-Bypass--%7C--Inconsistent-Password-Policy-%28CVE%E2%80%902024%E2%80%9033373%29
CVE: CVE-2024-37315
Published: 2024-06-14
Description: Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5mq8-738w-5942; https://github.com/nextcloud/server/pull/43727; https://hackerone.com/reports/1356508
CVE: CVE-2024-37316
Published: 2024-06-14
Description: Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-241
References: https://github.com/nextcloud/calendar/pull/5966; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf; https://hackerone.com/reports/2457588
CVE: CVE-2024-37317
Published: 2024-06-14
Description: The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/nextcloud/notes/pull/1260; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wfqv-cx85-7rjx; https://hackerone.com/reports/2254151
CVE: CVE-2024-37641
Published: 2024-06-14
Description: TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/formNewSchedule/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/formNewSchedule/README.md
CVE: CVE-2024-37642
Published: 2024-06-14
Description: TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /formSystemCheck .
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/formSystemCheck/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/formSystemCheck/README.md
CVE: CVE-2024-37643
Published: 2024-06-14
Description: TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formPasswordAuth .
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/formPasswordAuth/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/formPasswordAuth/README.md
CVE: CVE-2024-37645
Published: 2024-06-14
Description: TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formSysLog .
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/formSysLog/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TRENDnet/TEW-814DAP/formSysLog/README.md
CVE: CVE-2024-37882
Published: 2024-06-14
Description: Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-281
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmq; https://github.com/nextcloud/server/pull/44339; https://hackerone.com/reports/2289425
CVE: CVE-2024-37883
Published: 2024-06-14
Description: Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/nextcloud/deck/pull/5423; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8; https://hackerone.com/reports/2289333
CVE: CVE-2024-37884
Published: 2024-06-14
Description: Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8c; https://github.com/nextcloud/server/pull/43727; https://hackerone.com/reports/2290680
CVE: CVE-2024-37885
Published: 2024-06-14
Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0.
CVSS Score: 3.8 (LOW)
CWE: CWE-94, CWE-94
References: https://github.com/nextcloud/desktop/pull/6378; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mf7-v63m-99p7; https://hackerone.com/reports/2307625
CVE: CVE-2024-37886
Published: 2024-06-14
Description: user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-347
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw5h-29xf-g55g; https://github.com/nextcloud/user_oidc/pull/715; https://hackerone.com/reports/1878391
CVE: CVE-2024-37887
Published: 2024-06-14
Description: Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h4xv-cjpm-j595; https://github.com/nextcloud/server/pull/45309; https://hackerone.com/reports/2479325
CVE: CVE-2024-5934
Published: 2024-06-14
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-37369
Published: 2024-06-14
Description: A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lists, and potentially gaining further access within the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1674.html; https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1674.html
CVE: CVE-2024-5659
Published: 2024-06-14
Description: Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result in a major nonrecoverable fault(MNRF/Assert). This vulnerability could be exploited by sending abnormal packets to the mDNS port. If exploited, the availability of the device would be compromised.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-670, CWE-670
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1673.html; https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1673.html