deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-10234
Published: 2024-10-22
Description: A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHSA-2025:10924; https://access.redhat.com/errata/RHSA-2025:10925; https://access.redhat.com/errata/RHSA-2025:10926
CVE: CVE-2024-50311
Published: 2024-10-22
Description: A denial of service (DoS) vulnerability was found in OpenShift. This flaw allows attackers to exploit the GraphQL batching functionality. The vulnerability arises when multiple queries can be sent within a single request, enabling an attacker to submit a request containing thousands of aliases in one query. This issue causes excessive resource consumption, leading to application unavailability for legitimate users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://access.redhat.com/errata/RHSA-2024:6122; https://access.redhat.com/security/cve/CVE-2024-50311; https://bugzilla.redhat.com/show_bug.cgi?id=2319379
CVE: CVE-2024-50312
Published: 2024-10-22
Description: A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2025:0115; https://access.redhat.com/errata/RHSA-2025:0140; https://access.redhat.com/security/cve/CVE-2024-50312
CVE: CVE-2024-26271
Published: 2024-10-22
Description: Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26271
CVE: CVE-2024-26272
Published: 2024-10-22
Description: Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272
CVE: CVE-2024-26273
Published: 2024-10-22
Description: Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273
CVE: CVE-2024-38002
Published: 2024-10-22
Description: The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-862, CWE-863
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002
CVE: CVE-2024-43173
Published: 2024-10-22
Description: IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute.
CVSS Score: 3.7 (LOW)
CWE: CWE-1275
References: https://www.ibm.com/support/pages/node/7173596
CVE: CVE-2024-43177
Published: 2024-10-22
Description: IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://www.ibm.com/support/pages/node/7173596
CVE: CVE-2024-8980
Published: 2024-10-22
Description: The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173
 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352, CWE-352
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980
CVE: CVE-2022-23861
Published: 2024-10-22
Description: Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be leveraged to perform XSS attacks on legitimate users accessing the SafeQ web interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/mbadanoiu/CVE-2022-23861; https://github.com/mbadanoiu/CVE-2022-23861/blob/main/SafeQ%20-%20CVE-2022-23861.pdf; https://ysoft.com
CVE: CVE-2022-23862
Published: 2024-10-22
Description: A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the vulnerability to execute arbitrary code and elevate to the system user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://github.com/mbadanoiu/CVE-2022-23862; https://github.com/mbadanoiu/CVE-2022-23862/blob/main/SafeQ%20-%20CVE-2022-23862.pdf; https://ysoft.com
CVE: CVE-2024-46240
Published: 2024-10-22
Description: Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under action=system and the company/contact parameters under action=addcust within admin.php file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anoncoder01/Collabtive_StoredXSS/blob/master/vulnerabilities/XSS1.md
CVE: CVE-2024-47819
Published: 2024-10-22
Description: Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Versions 14.3.1 and 15.0.0 contain a patch. As a workaround, ensure that access to the Dictionary section is only granted to trusted users.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79
References: https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-c5g6-6xf7-qxp3
CVE: CVE-2024-48605
Published: 2024-10-22
Description: An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow64log.dll file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/; https://github.com/surajhacx/HelakuruV.1.1-DLLHijack; https://medium.com/%40xNEED/dll-hijacking-jagexlauncher[PII_REDACTED]22
CVE: CVE-2024-48925
Published: 2024-10-22
Description: Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. The issue allows low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to the settings section. Version 14.3.0 contains a patch.
CVSS Score: 0.0 (NONE)
CWE: CWE-284, CWE-863
References: https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4gp9-ff99-j6vj
CVE: CVE-2024-48926
Published: 2024-10-22
Description: Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds before they actually are. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-613
References: https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fp6q-gccw-7qqm
CVE: CVE-2024-48927
Published: 2024-10-22
Description: Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue. As a workaround, derver-side file validation is available to strip script tags from file's content during the file upload process.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-5955-cwv4-h7qh
CVE: CVE-2024-48929
Published: 2024-10-22
Description: Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-384
References: https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wxw9-6pv9-c3xc
CVE: CVE-2024-49373
Published: 2024-10-22
Description: No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects within organizations they are not apart of. Version 1.2.1 fixes the problem.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-653
References: https://github.com/nofusscomputing/centurion_erp/commit/c3a4685200faa060167d4fde86e806dc91eddcae; https://github.com/nofusscomputing/centurion_erp/pull/358; https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-5qmx-pr2f-qhj5
CVE: CVE-2024-45518
Published: 2024-10-22
Description: An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).
CVSS Score: 8.8 (HIGH)
CWE: CWE-918, CWE-918
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
CVE: CVE-2024-46538
Published: 2024-10-22
Description: A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/physicszq/web_issue/blob/main/pfsense/interfaces_groups_edit_file.md_xss.md; https://redmine.pfsense.org/issues/15778
CVE: CVE-2024-48570
Published: 2024-10-22
Description: Client Management System 1.0 was discovered to contain a SQL injection vulnerability via the Between Dates Reports parameter at /admin/bwdates-reports-ds.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Luc1f3r066/Client-Management-System-v1.0-
CVE: CVE-2024-48706
Published: 2024-10-22
Description: Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the title parameter with action=add or action=editform within the (a) managemessage.php file and (b) managetask.php file respectively.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anoncoder01/Collabtive_StoredXSS/blob/master/vulnerabilities/XSS2.md
CVE: CVE-2024-48707
Published: 2024-10-22
Description: Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone.php file and (b) action=addpro within admin.php file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anoncoder01/Collabtive_StoredXSS/blob/master/vulnerabilities/XSS3.md
CVE: CVE-2024-48708
Published: 2024-10-22
Description: Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b) file admin.php under action = adduser/edituser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anoncoder01/Collabtive_StoredXSS/blob/master/vulnerabilities/XSS4.md
CVE: CVE-2024-49208
Published: 2024-10-22
Description: Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and delete system icons.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/747545; https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb
CVE: CVE-2024-49209
Published: 2024-10-22
Description: Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and upload additional system icons.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/747545; https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb
CVE: CVE-2024-49210
Published: 2024-10-22
Description: Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/747545; https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb
CVE: CVE-2024-49211
Published: 2024-10-22
Description: Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/747545; https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb
CVE: CVE-2024-9129
Published: 2024-10-22
Description: In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. 

Reported by Dylan Marino
CWE: CWE-134
References: https://portal.perforce.com/s/detail/a91PA000001SYZFYA4
CVE: CVE-2024-9287
Published: 2024-10-22
Description: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-77
References: https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7; https://github.com/python/cpython/commit/8450b[PII_REDACTED]d689b6658f08de9c8179af7db; https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8
CVE: CVE-2024-10183
Published: 2024-10-22
Description: A vulnerability in Jamf Pro's Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems.
CWE: CWE-276
References: https://learn.jamf.com/en-US/bundle/jamf-remote-assist-release-notes/page/Jamf_Remote_Assist_Release_History.html#ariaid-title4
CVE: CVE-2024-39753
Published: 2024-10-22
Description: An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://success.trendmicro.com/en-US/solution/ka-0016669; https://www.zerodayinitiative.com/advisories/ZDI-24-897/
CVE: CVE-2024-41183
Published: 2024-10-22
Description: Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-73
References: https://helpcenter.trendmicro.com/en-us/article/tmka-14460; https://www.zerodayinitiative.com/advisories/ZDI-24-1022/; https://www.zerodayinitiative.com/advisories/ZDI-24-1023/
CVE: CVE-2024-45334
Published: 2024-10-22
Description: Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthorized access to product configurations and functions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-14461
CVE: CVE-2024-45335
Published: 2024-10-22
Description: Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted virus to allow itself to bypass and evade a virus scan detection.
CVSS Score: 8.4 (HIGH)
CWE: CWE-1037
References: https://helpcenter.trendmicro.com/en-us/article/tmka-07255
CVE: CVE-2024-46902
Published: 2024-10-22
Description: A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive information affected installations.

Please note: an attacker must first obtain the ability to execute high-privileged code (admin user rights) on the target system in order to exploit this vulnerability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-89, CWE-89
References: https://success.trendmicro.com/en-US/solution/KA-0017793; https://www.zerodayinitiative.com/advisories/ZDI-24-1227/
CVE: CVE-2024-46903
Published: 2024-10-22
Description: A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive information affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://success.trendmicro.com/en-US/solution/KA-0017793; https://www.zerodayinitiative.com/advisories/ZDI-24-1228/
CVE: CVE-2024-48903
Published: 2024-10-22
Description: An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/en-US/solution/KA-0017997; https://www.zerodayinitiative.com/advisories/ZDI-24-1419/
CVE: CVE-2024-48904
Published: 2024-10-22
Description: An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.

Please note: authentication is not required in order to exploit this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://success.trendmicro.com/en-US/solution/KA-0017998; https://www.zerodayinitiative.com/advisories/ZDI-24-1418/
CVE: CVE-2024-45526
Published: 2024-10-22
Description: An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-45526.pdf