deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7266
Published: 2024-08-07
Description: Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://cert.pl/en/posts/2024/08/CVE-2024-7265/; https://cert.pl/posts/2024/08/CVE-2024-7265/; https://www.gov.pl/web/ezd-rp
CVE: CVE-2024-7267
Published: 2024-08-07
Description: Exposure of Sensitive Information vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to retrieve information about IP infrastructure and credentials. This issue affects EZD RP all versions before 19.6
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-213
References: https://cert.pl/en/posts/2024/08/CVE-2024-7265/; https://cert.pl/posts/2024/08/CVE-2024-7265/; https://www.gov.pl/web/ezd-rp
CVE: CVE-2024-7353
Published: 2024-08-07
Description: The Accept Stripe Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's accept_stripe_payment_ng shortcode in all versions up to, and including, 2.0.86 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/stripe-payments/trunk/includes/shortcodes/class-asp-shortcode-ng.php#L715; https://portswigger.net/research/xss-in-hidden-input-fields; https://wordpress.org/plugins/stripe-payments/#developers
CVE: CVE-2024-7355
Published: 2024-08-07
Description: The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure charts can be extended to subscribers.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/organization-chart/trunk/admin/assets/js/tree_page.js#L207; https://plugins.trac.wordpress.org/browser/organization-chart/trunk/admin/assets/js/tree_page.js#L217; https://plugins.trac.wordpress.org/changeset/3131569/#file0
CVE: CVE-2024-7578
Published: 2024-08-07
Description: A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/www/cmd.php. The manipulation of the argument cmd leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-285
References: https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md; https://vuldb.com/?ctiid.273858; https://vuldb.com/?id.273858
CVE: CVE-2024-43044
Published: 2024-08-07
Description: Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
CVSS Score: 8.8 (HIGH)
CWE: CWE-754, CWE-754
References: https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3430
CVE: CVE-2024-43045
Published: 2024-08-07
Description: Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3349
CVE: CVE-2024-43199
Published: 2024-08-07
Description: Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-269
References: https://github.com/NagiosEnterprises/ndoutils/commit/18ef12037f4a68772d6840cbaa08aa2da07d2891; https://github.com/NagiosEnterprises/ndoutils/compare/ndoutils-2.1.3...ndoutils-2.1.4; https://github.com/NagiosEnterprises/ndoutils/pull/65
CVE: CVE-2024-7579
Published: 2024-08-07
Description: A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md; https://vuldb.com/?ctiid.273859; https://vuldb.com/?id.273859
CVE: CVE-2024-41989
Published: 2024-08-07
Description: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
CVE: CVE-2024-41990
Published: 2024-08-07
Description: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-130
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
CVE: CVE-2024-41991
Published: 2024-08-07
Description: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284, CWE-130
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
CVE: CVE-2024-42005
Published: 2024-08-07
Description: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
CVE: CVE-2024-7580
Published: 2024-08-07
Description: A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md; https://vuldb.com/?ctiid.273860; https://vuldb.com/?id.273860
CVE: CVE-2024-7581
Published: 2024-08-07
Description: A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/BeaCox/IoT_vuln/tree/main/tenda/A301/WifiBasicSet_bof; https://vuldb.com/?ctiid.273861; https://vuldb.com/?id.273861
CVE: CVE-2024-34479
Published: 2024-08-07
Description: SourceCodester Computer Laboratory Management System 1.0 allows classes/Master.php id SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2024-34480
Published: 2024-08-07
Description: SourceCodester Computer Laboratory Management System 1.0 allows admin/category/view_category.php id SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2024-41246
Published: 2024-08-07
Description: An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view administrator dashboard.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Broken%20Access%20Control%20-%20Admin%20Dashboard.pdf
CVE: CVE-2024-41247
Published: 2024-08-07
Description: An Incorrect Access Control vulnerability was found in /smsa/add_class.php and /smsa/add_class_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to add a new class entry.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Broken%20Access%20Control%20-%20Admin%20Master%20-%20Add%20Classes.pdf
CVE: CVE-2024-41248
Published: 2024-08-07
Description: An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to add a new subject entry.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Broken%20Access%20Control%20-%20Admin%20Master%20-%20Add%20Subject.pdf
CVE: CVE-2024-41249
Published: 2024-08-07
Description: An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view SUBJECT details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Broken%20Access%20Control%20-%20Admin%20-%20View%20Subjects.pdf
CVE: CVE-2024-41251
Published: 2024-08-07
Description: An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view and approve Teacher registration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Broken%20Access%20Control%20-%20Admin%20Dashboard%20-%20Registered%20Teacher.pdf
CVE: CVE-2024-41252
Published: 2024-08-07
Description: An Incorrect Access Control vulnerability was found in /smsa/admin_student_register_approval.php and /smsa/admin_student_register_approval_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view and approve student registration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Broken%20Access%20Control%20-%20Admin%20Dashboard%20-%20Registered%20Student.pdf; https://www.kashipara.com/project/php/12362/responsive-school-management-system-php-project-source-code
CVE: CVE-2024-41308
Published: 2024-08-07
Description: An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://the-it-wonders.blogspot.com/2024/07/enjay-crm-10-multiple-code-executions.html
CVE: CVE-2024-41309
Published: 2024-08-07
Description: An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://the-it-wonders.blogspot.com/2024/07/enjay-crm-10-multiple-code-executions.html
CVE: CVE-2024-41432
Published: 2024-08-07
Description: An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can bypass account lockout mechanisms during attempts to log into admin accounts, spoof IP addresses in requests sent to the server, and impersonate IP addresses that have logged into user accounts, etc.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://gitlab.com/c2at3/cve-2024-41432/-/blob/main/README.md
CVE: CVE-2024-42232
Published: 2024-08-07
Description: In the Linux kernel, the following vulnerability has been resolved:

libceph: fix race between delayed_work() and ceph_monc_stop()

The way the delayed work is handled in ceph_monc_stop() is prone to
races with mon_fault() and possibly also finish_hunting().  Both of
these can requeue the delayed work which wouldn't be canceled by any of
the following code in case that happens after cancel_delayed_work_sync()
runs -- __close_session() doesn't mess with the delayed work in order
to avoid interfering with the hunting interval logic.  This part was
missed in commit b5d91704f53e ("libceph: behave in mon_fault() if
cur_mon < 0") and use-after-free can still ensue on monc and objects
that hang off of it, with monc->auth and monc->monmap being
particularly susceptible to quickly being reused.

To fix this:

- clear monc->cur_mon and monc->hunting as part of closing the session
  in ceph_monc_stop()
- bail from delayed_work() if monc->cur_mon is cleared, similar to how
  it's done in mon_fault() and finish_hunting() (based on monc->hunting)
- call cancel_delayed_work_sync() after the session is closed
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1177afeca833174ba83504688eec898c6214f4bf; https://git.kernel.org/stable/c/20cf67dcb7db842f941eff1af6ee5e9dc41796d7; https://git.kernel.org/stable/c/2d33654d40a05afd91ab24c9a73ab512a0670a9a
CVE: CVE-2024-42233
Published: 2024-08-07
Description: In the Linux kernel, the following vulnerability has been resolved:

filemap: replace pte_offset_map() with pte_offset_map_nolock()

The vmf->ptl in filemap_fault_recheck_pte_none() is still set from
handle_pte_fault().  But at the same time, we did a pte_unmap(vmf->pte). 
After a pte_unmap(vmf->pte) unmap and rcu_read_unlock(), the page table
may be racily changed and vmf->ptl maybe fails to protect the actual page
table.  Fix this by replacing pte_offset_map() with
pte_offset_map_nolock().

As David said, the PTL pointer might be stale so if we continue to use
it infilemap_fault_recheck_pte_none(), it might trigger UAF.  Also, if
the PTL fails, the issue fixed by commit 58f327f2ce80 ("filemap: avoid
unnecessary major faults in filemap_fault()") might reappear.
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/24be02a42181f0707be0498045c4c4b13273b16d; https://git.kernel.org/stable/c/6a6c2aec1a[PII_REDACTED]1b4cf7e8eef035f33748
CVE: CVE-2024-42234
Published: 2024-08-07
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: fix crashes from deferred split racing folio migration

Even on 6.10-rc6, I've been seeing elusive "Bad page state"s (often on
flags when freeing, yet the flags shown are not bad: PG_locked had been
set and cleared??), and VM_BUG_ON_PAGE(page_ref_count(page) == 0)s from
deferred_split_scan()'s folio_put(), and a variety of other BUG and WARN
symptoms implying double free by deferred split and large folio migration.

6.7 commit 9bcef5973e31 ("mm: memcg: fix split queue list crash when large
folio migration") was right to fix the memcg-dependent locking broken in
85ce2c517ade ("memcontrol: only transfer the memcg data for migration"),
but missed a subtlety of deferred_split_scan(): it moves folios to its own
local list to work on them without split_queue_lock, during which time
folio->_deferred_list is not empty, but even the "right" lock does nothing
to secure the folio and the list it is on.

Fortunately, deferred_split_scan() is careful to use folio_try_get(): so
folio_migrate_mapping() can avoid the race by folio_undo_large_rmappable()
while the old folio's reference count is temporarily frozen to 0 - adding
such a freeze in the !mapping case too (originally, folio lock and
unmapping and no swap cache left an anon folio unreachable, so no freezing
was needed there: but the deferred split queue offers a way to reach it).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://git.kernel.org/stable/c/be9581ea8c058d81154251cb[PII_REDACTED]996cad; https://git.kernel.org/stable/c/fc7facce686b64201dbf0b9614cc1d0bfad70010
CVE: CVE-2024-42235
Published: 2024-08-07
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()

crst_table_free() used to work with NULL pointers before the conversion
to ptdescs.  Since crst_table_free() can be called with a NULL pointer
(error handling in crst_table_upgrade() add an explicit check.

Also add the same check to base_crst_free() for consistency reasons.

In real life this should not happen, since order two GFP_KERNEL
allocations will not fail, unless FAIL_PAGE_ALLOC is enabled and used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/794fa52b94637d6b2e8c9474fbe3983af5c9f046; https://git.kernel.org/stable/c/b5efb63acf7bddaf20eacfcac654c25c446eabe8; https://git.kernel.org/stable/c/f80bd8bb6f380bc265834c46058d38b34174813e
CVE: CVE-2024-42236
Published: 2024-08-07
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()

Userspace provided string 's' could trivially have the length zero. Left
unchecked this will firstly result in an OOB read in the form
`if (str[0 - 1] == '\n') followed closely by an OOB write in the form
`str[0 - 1] = '\0'`.

There is already a validating check to catch strings that are too long.
Let's supply an additional check for invalid strings that are too short.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/2d16f63d8030903e5031853e79d731ee5d474e70; https://git.kernel.org/stable/c/6d3c721e686ea6c59e18289b400cc95c76e927e0; https://git.kernel.org/stable/c/72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce
CVE: CVE-2024-42237
Published: 2024-08-07
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Validate payload length before processing block

Move the payload length check in cs_dsp_load() and cs_dsp_coeff_load()
to be done before the block is processed.

The check that the length of a block payload does not exceed the number
of remaining bytes in the firwmware file buffer was being done near the
end of the loop iteration. However, some code before that check used the
length field without validating it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-834
References: https://git.kernel.org/stable/c/259955eca9b7acf1299b1ac077d8cfbe12df35d8; https://git.kernel.org/stable/c/3a9cd924aec1288d675df721f244da4dd7e16cff; https://git.kernel.org/stable/c/6598afa9320b6ab[PII_REDACTED]ca5f8f938c0cf1
CVE: CVE-2024-42238
Published: 2024-08-07
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Return error if block header overflows file

Return an error from cs_dsp_power_up() if a block header is longer
than the amount of data left in the file.

The previous code in cs_dsp_load() and cs_dsp_load_coeff() would loop
while there was enough data left in the file for a valid region. This
protected against overrunning the end of the file data, but it didn't
abort the file processing with an error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://git.kernel.org/stable/c/6eabd[PII_REDACTED]5eff416c203688b7a390d4153; https://git.kernel.org/stable/c/90ab191b7d181057d71234e8632e06b5844ac38e; https://git.kernel.org/stable/c/959fe01e85b7241e3ec305d657febbe82da16a02