deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-46852
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

dma-buf: heaps: Fix off-by-one in CMA heap fault handler

Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps:
Don't track CMA dma-buf pages under RssFile") it was possible to obtain
a mapping larger than the buffer size via mremap and bypass the overflow
check in dma_buf_mmap_internal. When using such a mapping to attempt to
fault past the end of the buffer, the CMA heap fault handler also checks
the fault offset against the buffer size, but gets the boundary wrong by
1. Fix the boundary check so that we don't read off the end of the pages
array and insert an arbitrary page in the mapping.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193
References: https://git.kernel.org/stable/c/79cce5e81d20fa9ad553be439d665ac3302d3c95; https://git.kernel.org/stable/c/84175dc5b2c932266a50c04e5ce342c30f817a2f; https://git.kernel.org/stable/c/e79050882b857c37634baedbdcf7c2047c24cbff
CVE: CVE-2024-46854
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

net: dpaa: Pad packets to ETH_ZLEN

When sending packets under 60 bytes, up to three bytes of the buffer
following the data may be leaked. Avoid this by extending all packets to
ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be
reproduced by running

	$ ping -s 11 destination
CVSS Score: 7.1 (HIGH)
References: https://git.kernel.org/stable/c/1f31f51bfc8214a6deaac2920e6342cb9d019133; https://git.kernel.org/stable/c/34fcac26216ce17886af3eb392355b459367af1a; https://git.kernel.org/stable/c/38f5db5587c0ee53546b28c50ba128253181ac83
CVE: CVE-2024-46855
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_socket: fix sk refcount leaks

We must put 'sk' reference before returning.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/076d281e90aaf4192799ecb9a1ed82321e133ecd; https://git.kernel.org/stable/c/1f68e097e20d3c695281a9c6433acc37be47fe11; https://git.kernel.org/stable/c/33c2258bf8cb17fba9e58b111d4c4f4cf43a4896
CVE: CVE-2024-46856
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices

The probe() function is only used for DP83822 and DP83826 PHY,
leaving the private data pointer uninitialized for the DP83825 models
which causes a NULL pointer dereference in the recently introduced/changed
functions dp8382x_config_init() and dp83822_set_wol().

Add the dp8382x_probe() function, so all PHY models will have a valid
private data pointer to fix this issue and also prevent similar issues
in the future.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3f62ea572b3e8e3f10c39a9cb4f04ca9ae5f2952; https://git.kernel.org/stable/c/67b61e2f4c9c5df97a9a2ef7a1fe35eae00531f4
CVE: CVE-2024-46857
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix bridge mode operations when there are no VFs

Currently, trying to set the bridge mode attribute when numvfs=0 leads to a
crash:

bridge link set dev eth2 hwmode vepa

[  168.967392] BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
[...]
[  168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core]
[...]
[  168.976037] Call Trace:
[  168.976188]  <TASK>
[  168.978620]  _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core]
[  168.979074]  mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core]
[  168.979471]  rtnl_bridge_setlink+0xe9/0x1f0
[  168.979714]  rtnetlink_rcv_msg+0x159/0x400
[  168.980451]  netlink_rcv_skb+0x54/0x100
[  168.980675]  netlink_unicast+0x241/0x360
[  168.980918]  netlink_sendmsg+0x1f6/0x430
[  168.981162]  ____sys_sendmsg+0x3bb/0x3f0
[  168.982155]  ___sys_sendmsg+0x88/0xd0
[  168.985036]  __sys_sendmsg+0x59/0xa0
[  168.985477]  do_syscall_64+0x79/0x150
[  168.987273]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  168.987773] RIP: 0033:0x7f8f7950f917

(esw->fdb_table.legacy.vepa_fdb is null)

The bridge mode is only relevant when there are multiple functions per
port. Therefore, prevent setting and getting this setting when there are no
VFs.

Note that after this change, there are no settings to change on the PF
interface using `bridge link` when there are no VFs, so the interface no
longer appears in the `bridge link` output.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/505ae01f75f839b54329164bbfecf24cc1361b31; https://git.kernel.org/stable/c/52c4beb79e095e0631b5cac46ed48a2aefe51985; https://git.kernel.org/stable/c/65feee671e37f3b6eda0b6af28f204b5bcf7fa50
CVE: CVE-2024-46858
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: Fix uaf in __timer_delete_sync

There are two paths to access mptcp_pm_del_add_timer, result in a race
condition:

     CPU1				CPU2
     ====                               ====
     net_rx_action
     napi_poll                          netlink_sendmsg
     __napi_poll                        netlink_unicast
     process_backlog                    netlink_unicast_kernel
     __netif_receive_skb                genl_rcv
     __netif_receive_skb_one_core       netlink_rcv_skb
     NF_HOOK                            genl_rcv_msg
     ip_local_deliver_finish            genl_family_rcv_msg
     ip_protocol_deliver_rcu            genl_family_rcv_msg_doit
     tcp_v4_rcv                         mptcp_pm_nl_flush_addrs_doit
     tcp_v4_do_rcv                      mptcp_nl_remove_addrs_list
     tcp_rcv_established                mptcp_pm_remove_addrs_and_subflows
     tcp_data_queue                     remove_anno_list_by_saddr
     mptcp_incoming_options             mptcp_pm_del_add_timer
     mptcp_pm_del_add_timer             kfree(entry)

In remove_anno_list_by_saddr(running on CPU2), after leaving the critical
zone protected by "pm.lock", the entry will be released, which leads to the
occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).

Keeping a reference to add_timer inside the lock, and calling
sk_stop_timer_sync() with this reference, instead of "entry->add_timer".

Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock,
do not directly access any members of the entry outside the pm lock, which
can avoid similar "entry->x" uaf.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0e7814b028cd50b3ff79659d23dfa9da6a1e75e1; https://git.kernel.org/stable/c/12134a652b0a10064844ea235173e70246eba6dc; https://git.kernel.org/stable/c/3554482f4691571fc4b5490c17ae26896e62171c
CVE: CVE-2024-46859
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses

The panasonic laptop code in various places uses the SINF array with index
values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array
is big enough.

Not all panasonic laptops have this many SINF array entries, for example
the Toughbook CF-18 model only has 10 SINF array entries. So it only
supports the AC+DC brightness entries and mute.

Check that the SINF array has a minimum size which covers all AC+DC
brightness entries and refuse to load if the SINF array is smaller.

For higher SINF indexes hide the sysfs attributes when the SINF array
does not contain an entry for that attribute, avoiding show()/store()
accessing the array out of bounds and add bounds checking to the probe()
and resume() code accessing these.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a; https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16; https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4
CVE: CVE-2024-46860
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change

When disabling wifi mt7921_ipv6_addr_change() is called as a notifier.
At this point mvif->phy is already NULL so we cannot use it here.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3; https://git.kernel.org/stable/c/4bfee9346d8c17d928ef6da2b8bffab88fa2a553; https://git.kernel.org/stable/c/8d92bafd4c67efb692f722d73a07412b5f88c6d6
CVE: CVE-2024-46861
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

usbnet: ipheth: do not stop RX on failing RX callback

RX callbacks can fail for multiple reasons:

* Payload too short
* Payload formatted incorrecly (e.g. bad NCM framing)
* Lack of memory

None of these should cause the driver to seize up.

Make such failures non-critical and continue processing further
incoming URBs.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/08ca800b0cd56d5e26722f68b18bbbf6840bf44b; https://git.kernel.org/stable/c/4d1cfa3afb[PII_REDACTED]ecdc6d8b58bc72ee0f4c; https://git.kernel.org/stable/c/74efed51e0a4d62f998f806c307778b47fc73395
CVE: CVE-2024-46862
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item

There is no links_num in struct snd_soc_acpi_mach {}, and we test
!link->num_adr as a condition to end the loop in hda_sdw_machine_select().
So an empty item in struct snd_soc_acpi_link_adr array is required.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/01281a9e8275946aa725db0919769b8d35af3a11; https://git.kernel.org/stable/c/bf6d7a44a144aa9c476dee83c23faf3151181bab
CVE: CVE-2024-46863
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item

There is no links_num in struct snd_soc_acpi_mach {}, and we test
!link->num_adr as a condition to end the loop in hda_sdw_machine_select().
So an empty item in struct snd_soc_acpi_link_adr array is required.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/8eb57389d8ad91c67bf844f5aae4caef74b9091b; https://git.kernel.org/stable/c/c4246f1fe9f24f8dcd97887ed67d8fcfd91f4796
CVE: CVE-2024-46864
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/hyperv: fix kexec crash due to VP assist page corruption

commit 9636be85cc5b ("x86/hyperv: Fix hyperv_pcpu_input_arg handling when
CPUs go online/offline") introduces a new cpuhp state for hyperv
initialization.

cpuhp_setup_state() returns the state number if state is
CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN and 0 for all other states.
For the hyperv case, since a new cpuhp state was introduced it would
return 0. However, in hv_machine_shutdown(), the cpuhp_remove_state() call
is conditioned upon "hyperv_init_cpuhp > 0". This will never be true and
so hv_cpu_die() won't be called on all CPUs. This means the VP assist page
won't be reset. When the kexec kernel tries to setup the VP assist page
again, the hypervisor corrupts the memory region of the old VP assist page
causing a panic in case the kexec kernel is using that memory elsewhere.
This was originally fixed in commit dfe94d4086e4 ("x86/hyperv: Fix kexec
panic/hang issues").

Get rid of hyperv_init_cpuhp entirely since we are no longer using a
dynamic cpuhp state and use CPUHP_AP_HYPERV_ONLINE directly with
cpuhp_remove_state().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2ae1beb3ab4f28868cc5d1541d05e1fbee3ad825; https://git.kernel.org/stable/c/b9af6418279c4cf73ca073f8ea024992b38be8ab; https://git.kernel.org/stable/c/d6f018a3b49d0a94ddbd0e479c2af6b19724e434
CVE: CVE-2024-46865
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

fou: fix initialization of grc

The grc must be initialize first. There can be a condition where if
fou is NULL, goto out will be executed and grc would be used
uninitialized.
CVSS Score: 7.1 (HIGH)
CWE: CWE-908
References: https://git.kernel.org/stable/c/16ff[PII_REDACTED]b0f96d4fe277aa25ee096f0ea8; https://git.kernel.org/stable/c/392f6a97fcbecc64f0c00058b2db5bb0e4b8cc3e; https://git.kernel.org/stable/c/4c[PII_REDACTED]125078e6b9b90137bdf443ebaa08
CVE: CVE-2024-46866
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe/client: add missing bo locking in show_meminfo()

bo_meminfo() wants to inspect bo state like tt and the ttm resource,
however this state can change at any point leading to stuff like NPD and
UAF, if the bo lock is not held. Grab the bo lock when calling
bo_meminfo(), ensuring we drop any spinlocks first. In the case of
object_idr we now also need to hold a ref.

v2 (MattB)
  - Also add xe_bo_assert_held()

(cherry picked from commit 4f63d712fa104c3ebefcb289d1e733e86d8698c7)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/94c4aa266111262c96c98f822d1bccc494786fee; https://git.kernel.org/stable/c/abc8feacacf8fae10eecf6fea7865e8c1fee419c
CVE: CVE-2024-46867
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe/client: fix deadlock in show_meminfo()

There is a real deadlock as well as sleeping in atomic() bug in here, if
the bo put happens to be the last ref, since bo destruction wants to
grab the same spinlock and sleeping locks.  Fix that by dropping the ref
using xe_bo_put_deferred(), and moving the final commit outside of the
lock. Dropping the lock around the put is tricky since the bo can go
out of scope and delete itself from the list, making it difficult to
navigate to the next list entry.

(cherry picked from commit 0083b8e6f11d7662283a267d4ce7c966812ffd8a)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/9bd7ff293fc84792514aeafa06c5a17f05cb5f4b; https://git.kernel.org/stable/c/9d3de463e23bfb1ff1567a32b099b1b3e5286a48
CVE: CVE-2024-46868
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire()

If the __qcuefi pointer is not set, then in the original code, we would
hold onto the lock.  That means that if we tried to set it later, then
it would cause a deadlock.  Drop the lock on the error path.  That's
what all the callers are expecting.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/8c6a5a1fc02ad1d62d06897ab330693d4d27cd03; https://git.kernel.org/stable/c/db213b0cfe3268d8b1d382b3bcc999c687a2567f
CVE: CVE-2024-9281
Published: 2024-09-27
Description: A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/bg5sbk/MiniCMS/issues/51; https://vuldb.com/?ctiid.278663; https://vuldb.com/?id.278663
CVE: CVE-2024-9282
Published: 2024-09-27
Description: A vulnerability was found in bg5sbk MiniCMS 1.11. It has been classified as problematic. Affected is an unknown function of the file page-edit.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/bg5sbk/MiniCMS/issues/52; https://vuldb.com/?ctiid.278664; https://vuldb.com/?id.278664
CVE: CVE-2024-40511
Published: 2024-09-27
Description: Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmin.asmx function.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/Jansen-C-Moreira/CVE-2024-40511; https://github.com/openpetra/openpetra
CVE: CVE-2024-40512
Published: 2024-09-27
Description: Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMReporting.asmx function.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/Jansen-C-Moreira/CVE-2024-40512
CVE: CVE-2024-45773
Published: 2024-09-27
Description: A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00.
CVSS Score: 7.5 (HIGH)
References: https://www.facebook.com/security/advisories/cve-2024-45773
CVE: CVE-2024-45863
Published: 2024-09-27
Description: A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00.
CVSS Score: 5.3 (MEDIUM)
References: https://www.facebook.com/security/advisories/cve-2024-45863
CVE: CVE-2024-47182
Published: 2024-09-27
Description: Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-328, CWE-326
References: https://github.com/amir20/dozzle/commit/de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3; https://github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35
CVE: CVE-2024-47184
Published: 2024-09-27
Description: Ampache is a web based audio/video streaming application and file manager. Prior to version 6.6.0, the Democratic Playlist Name is vulnerable to a stored cross-site scripting. Version 6.6.0 fixes this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ampache/ampache/blob/ff332c9810e493fd51b258f5e53119fad86c23bf/public/templates/show_democratic.inc.php#L36; https://github.com/ampache/ampache/commit/7e64d140dafcbe0d61f1a07e94486f6ed67932d6; https://github.com/ampache/ampache/security/advisories/GHSA-f99r-gv34-v46f
CVE: CVE-2024-7149
Published: 2024-09-27
Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/wp-event-solution/trunk/widgets/events-tab/style/tab-1.php#L42; https://plugins.trac.wordpress.org/browser/wp-event-solution/trunk/widgets/events/events.php#L754; https://plugins.trac.wordpress.org/browser/wp-event-solution/trunk/widgets/schedule-list/schedule-list.php#L293
CVE: CVE-2024-9283
Published: 2024-09-27
Description: A vulnerability classified as problematic has been found in RelaxedJS ReLaXed up to 0.2.2. Affected is an unknown function of the component Pug to PDF Converter. The manipulation leads to cross site scripting. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1Ll1dRwQds8987S-l5o2iJu4MQRG-p4-A/view?usp=sharing; https://vuldb.com/?ctiid.278676; https://vuldb.com/?id.278676
CVE: CVE-2024-3373
Published: 2024-09-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection.This issue affects Website Template: before 1.2.
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1563
CVE: CVE-2024-40509
Published: 2024-09-27
Description: Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMFinDev.asmx function.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/Jansen-C-Moreira/CVE-2024-40509; https://github.com/openpetra/openpetra
CVE: CVE-2024-40510
Published: 2024-09-27
Description: Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMCommon.asmx function.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Jansen-C-Moreira/CVE-2024-405010; https://github.com/openpetra/openpetra
CVE: CVE-2024-44910
Published: 2024-09-27
Description: NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the AOS subsystem (crypto_aos.c).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/nasa/CryptoLib/issues/268; https://visionspace.com/crashing-cryptolib/
CVE: CVE-2024-44911
Published: 2024-09-27
Description: NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TC subsystem (crypto_tc.c).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/nasa/CryptoLib/issues/268; https://visionspace.com/crashing-cryptolib/
CVE: CVE-2024-44912
Published: 2024-09-27
Description: NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TM subsystem (crypto_tm.c).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/nasa/CryptoLib/issues/268; https://visionspace.com/crashing-cryptolib/
CVE: CVE-2024-46331
Published: 2024-09-27
Description: ModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability allows attackers to redirect users to an arbitrary website via a crafted URL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-601
References: https://github.com/whiteshark2k/ModStartCMS-OpenRedirect/blob/main/ModStartCMS-OpenRedirect.md
CVE: CVE-2024-46333
Published: 2024-09-27
Description: An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/whiteshark2k/Piwigo-XSS/blob/main/Piwigo-XSS.md
CVE: CVE-2024-46470
Published: 2024-09-27
Description: Cross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the membership_type field in the edit-type.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://codeastro.com/membership-management-system-in-php-with-source-code/; https://github.com/JonMoriSenpai/CVE-WriteUps/blob/main/CodeAstro%20-%20MembershipM-PHP/CVE-2024-46470/writeup.md
CVE: CVE-2024-46471
Published: 2024-09-27
Description: The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealing sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://codeastro.com/membership-management-system-in-php-with-source-code/; https://github.com/JonMoriSenpai/CVE-WriteUps/blob/main/CodeAstro%20-%20MembershipM-PHP/CVE-2024-46471/writeup.md
CVE: CVE-2024-46472
Published: 2024-09-27
Description: CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page.
CVSS Score: 8.6 (HIGH)
CWE: CWE-89
References: https://codeastro.com/membership-management-system-in-php-with-source-code/; https://github.com/JonMoriSenpai/CVE-WriteUps/blob/main/CodeAstro%20-%20MembershipM-PHP/CVE-2024-46472/writeup.md