deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-20140
Published: 2025-01-06
Description: In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09270402; Issue ID: MSV-2020.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20143
Published: 2025-01-06
Description: In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09167056; Issue ID: MSV-2069.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20144
Published: 2025-01-06
Description: In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09167056; Issue ID: MSV-2041.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20145
Published: 2025-01-06
Description: In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09290940; Issue ID: MSV-2040.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20146
Published: 2025-01-06
Description: In wlan STA driver, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389496 / ALPS09137491; Issue ID: MSV-1835.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20148
Published: 2025-01-06
Description: In wlan STA FW, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389045 / ALPS09136494; Issue ID: MSV-1796.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20149
Published: 2025-01-06
Description: In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01231341 / MOLY01263331 / MOLY01233835; Issue ID: MSV-2165.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20150
Published: 2025-01-06
Description: In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01412526; Issue ID: MSV-2018.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20151
Published: 2025-01-06
Description: In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01399339; Issue ID: MSV-1928.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20152
Published: 2025-01-06
Description: In wlan STA driver, there is a possible reachable assertion due to improper exception handling. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00389047 / ALPS09136505; Issue ID: MSV-1798.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20153
Published: 2025-01-06
Description: In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08990446 / ALPS09057442; Issue ID: MSV-1598.
CVSS Score: 7.5 (HIGH)
CWE: CWE-304
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-20154
Published: 2025-01-06
Description: In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00720348; Issue ID: MSV-2392.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/January-2025
CVE: CVE-2024-11356
Published: 2025-01-06
Description: The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d70df54e-e99e-4539-9fd9-002c0642137e/
CVE: CVE-2024-11849
Published: 2025-01-06
Description: The Pods  WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/85b25a5b-c30b-4a2a-96c1-f05b4eba8a9b/
CVE: CVE-2024-12302
Published: 2025-01-06
Description: The Icegram Engage  WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ed860dac-8c4a-482f-8826-31f1a894b6ce/
CVE: CVE-2024-12311
Published: 2025-01-06
Description: The Email Subscribers by Icegram Express  WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/5e00ba37-da7f-4703-a0b9-65237696fbdd/
CVE: CVE-2024-21464
Published: 2025-01-06
Description: Memory corruption while processing IPA statistics, when there are no active clients registered.
CVSS Score: 8.4 (HIGH)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-23366
Published: 2025-01-06
Description: Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-33041
Published: 2025-01-06
Description: Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-823, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-33055
Published: 2025-01-06
Description: Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-33059
Published: 2025-01-06
Description: Memory corruption while processing frame command IOCTL calls.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-33061
Published: 2025-01-06
Description: Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-33067
Published: 2025-01-06
Description: Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-43063
Published: 2025-01-06
Description: information disclosure while invoking the mailbox read API.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-43064
Published: 2025-01-06
Description: Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264, CWE-770
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45541
Published: 2025-01-06
Description: Memory corruption when IOCTL call is invoked from user-space to read board data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45542
Published: 2025-01-06
Description: Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45546
Published: 2025-01-06
Description: Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45547
Published: 2025-01-06
Description: Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45548
Published: 2025-01-06
Description: Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45550
Published: 2025-01-06
Description: Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45553
Published: 2025-01-06
Description: Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45555
Published: 2025-01-06
Description: Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system image.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-190
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45558
Published: 2025-01-06
Description: Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-45559
Published: 2025-01-06
Description: Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2025-bulletin.html
CVE: CVE-2024-12970
Published: 2025-01-06
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TUBITAK BILGEM Pardus OS My Computer allows OS Command Injection.This issue affects Pardus OS My Computer: before 0.7.2.
CVSS Score: 3.9 (LOW)
CWE: CWE-78
References: https://www.usom.gov.tr/bildirim/tr-24-1900
CVE: CVE-2024-5594
Published: 2025-01-06
Description: OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1287
References: https://community.openvpn.net/openvpn/wiki/CVE-2024-5594; https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00005.html
CVE: CVE-2024-12996
Published: 2025-01-06
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-12997
Published: 2025-01-06
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-8474
Published: 2025-01-06
Description: OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic
CVSS Score: 7.5 (HIGH)
CWE: CWE-212
References: https://openvpn.net/connect-docs/android-release-notes.html
CVE: CVE-2024-31913
Published: 2025-01-06
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7176081
CVE: CVE-2024-31914
Published: 2025-01-06
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7176081
CVE: CVE-2024-51111
Published: 2025-01-06
Description: Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are executed in the context of the victim's browser.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: http://pnetlab.com; https://github.com/Zehraakmanlar/Bortecine-s_CVEs/blob/main/README.md
CVE: CVE-2024-51112
Published: 2025-01-06
Description: Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a crafted script
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://pnetlab.com; https://github.com/Zehraakmanlar/Bortecine-s_CVEs/blob/main/README.md
CVE: CVE-2025-21604
Published: 2025-01-06
Description: LangChain4j-AIDeepin is a Retrieval enhancement generation (RAG) project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0.
CWE: CWE-328
References: https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a; https://github.com/moyangzhan/langchain4j-aideepin/security/advisories/GHSA-cv5r-73vf-8x7v
CVE: CVE-2025-21611
Published: 2025-01-06
Description: tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions regardless of their permissions. Notably, the WriteUsers right is unaffected so users may not use this bug to permanently elevate their account permissions. The fix is release in tgstation-server-v6.12.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://github.com/tgstation/tgstation-server/commit/e7b1189620baaf03c2d23f6e164d07c7c7d87d57; https://github.com/tgstation/tgstation-server/issues/2064; https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rf5r-q276-vrc4
CVE: CVE-2025-21612
Published: 2025-01-06
Description: TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-79, CWE-80
References: https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/d8c3db4e5935476e496d979fb01f775d3d3282e6; https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/f229cab099c69006e25d4bad3579954e481dc566; https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-4x6x-8rm8-c37j
CVE: CVE-2023-6601
Published: 2025-01-06
Description: A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-99, CWE-94
References: https://bugzilla.redhat.com/show_bug.cgi?id=2253172; https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html
CVE: CVE-2023-6604
Published: 2025-01-06
Description: A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-99, CWE-94
References: https://bugzilla.redhat.com/show_bug.cgi?id=2334337; https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html
CVE: CVE-2023-6605
Published: 2025-01-06
Description: A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
CVSS Score: 7.2 (HIGH)
CWE: CWE-99
References: https://bugzilla.redhat.com/show_bug.cgi?id=2334336; https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html
CVE: CVE-2024-47475
Published: 2025-01-06
Description: Dell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-732
References: https://www.dell.com/support/kbdoc/en-us/000242681/dsa-2024-417-security-update-for-dell-powerscale-onefs-for-security-vulnerability
CVE: CVE-2024-51472
Published: 2025-01-06
Description: IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
CVSS Score: 3.1 (LOW)
CWE: CWE-80, CWE-79
References: https://www.ibm.com/support/pages/node/7177856
CVE: CVE-2024-55605
Published: 2025-01-06
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large input buffer to the to_lowercase, to_uppercase, strip_whitespace, compress_whitespace, dotprefix, header_lowercase, strip_pseudo_headers, url_decode, or xor transform can lead to a stack overflow causing Suricata to crash. The issue has been addressed in Suricata 7.0.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/OISF/suricata/security/advisories/GHSA-x2hr-33vp-w289; https://redmine.openinfosecfoundation.org/issues/7229
CVE: CVE-2024-56757
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: mediatek: add intf release flow when usb disconnect

MediaTek claim an special usb intr interface for ISO data transmission.
The interface need to be released before unregistering hci device when
usb disconnect. Removing BT usb dongle without properly releasing the
interface may cause Kernel panic while unregister hci device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://git.kernel.org/stable/c/489304e67087abddc2666c5af0159cb95afdcf59; https://git.kernel.org/stable/c/cc569d791ab2a0de74f76e470515d25d24c9b84b