deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8602
Published: 2024-10-14
Description: When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Open Worldwide Application Security Project (OWASP). An attacker could theoretically leverage this by delivering a manipulated PDF file to the target, and depending on the environment, various actions can be executed. These actions include:

  *  Reading files from the operating system
  *  Crashing the thread handling the parsing or causing it to enter an infinite loop
  *  Executing HTTP requests
  *  Loading additional DTDs or XML files
  *  Under certain conditions, executing OS commands
CWE: CWE-611
References: https://esteuer.ewv-ete.ch/fileadmin/esta/2024-10-09-update/24_09_esta_newsletter_de.pdf; https://mkiesel.ch/posts/swiss-tax-adventures-1/
CVE: CVE-2024-9936
Published: 2024-10-14
Description: When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1920381; https://www.mozilla.org/security/advisories/mfsa2024-53/
CVE: CVE-2024-40616
Published: 2024-10-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-48249
Published: 2024-10-14
Description: Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in; https://github.com/wavelog/wavelog/commit/0bf2675d93602b591850790c8fcfced886eca423; https://www.wavelog.org
CVE: CVE-2024-48251
Published: 2024-10-14
Description: Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in; https://github.com/wavelog/wavelog/commit/0bf2675d93602b591850790c8fcfced886eca423; https://www.wavelog.org
CVE: CVE-2024-48257
Published: 2024-10-14
Description: Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in; https://github.com/wavelog/wavelog/commit/0bf2675d93602b591850790c8fcfced886eca423; https://www.wavelog.org
CVE: CVE-2024-48259
Published: 2024-10-14
Description: Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in-9a3; https://github.com/magicbug/Cloudlog; https://www.magicbug.co.uk/cloudlog/
CVE: CVE-2024-48261
Published: 2024-10-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-48251. Reason: This candidate is a reservation duplicate of CVE-2024-48251. Notes: All CVE users should reference CVE-2024-48251 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-9823
Published: 2024-10-14
Description: There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/jetty/jetty.project/issues/1256; https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h; https://gitlab.eclipse.org/security/cve-assignement/-/issues/39
CVE: CVE-2023-50780
Published: 2024-10-14
Description: Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE.


Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://lists.apache.org/thread/63b78shqz312phsx7v1ryr7jv7bprg58; http://www.openwall.com/lists/oss-security/2024/10/14/2
CVE: CVE-2024-41997
Published: 2024-10-14
Description: An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02). A command injection vulnerability exists in the Docker integration functionality. An attacker can create a specially crafted hyperlink using the `warp://action/docker/open_subshell` intent that when clicked by the victim results in command execution on the victim's machine.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://docs.warp.dev/features/integrations-and-plugins#docker; https://docs.warp.dev/getting-started/changelog#id-2024.07.18-v0.2024.07.16.08.02; https://gist.github.com/bhyh/d1ee7a825fce283bf8acbdb42c8a7832
CVE: CVE-2024-48150
Published: 2024-10-14
Description: D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/fu37kola/cve/blob/main/D-Link/DIR-820L/D-Link%20DIR-820L%20Stack%20Overflow%20Vulnerability.md
CVE: CVE-2024-48153
Published: 2024-10-14
Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/tw11ty/CVE/blob/main/DrayTek/Vigor3900/Vigor3900%20command%20execution%20vulnerability.md
CVE: CVE-2024-6762
Published: 2024-10-14
Description: Jetty PushSessionCacheFilter can be exploited by unauthenticated users 
to launch remote DoS attacks by exhausting the server’s memory.
CVSS Score: 3.1 (LOW)
CWE: CWE-400, CWE-770
References: https://github.com/jetty/jetty.project/pull/10755; https://github.com/jetty/jetty.project/pull/10756; https://github.com/jetty/jetty.project/pull/9715
CVE: CVE-2024-6763
Published: 2024-10-14
Description: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.

The HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI
 differs from the common browsers in how it handles a URI that would be 
considered invalid if fully validated against the RRC.  Specifically HttpURI
 and the browser may differ on the value of the host extracted from an 
invalid URI and thus a combination of Jetty and a vulnerable browser may
 be vulnerable to a open redirect attack or to a SSRF attack if the URI 
is used after passing validation checks.
CVSS Score: 3.7 (LOW)
CWE: CWE-1286
References: https://github.com/jetty/jetty.project/pull/12012; https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh; https://gitlab.eclipse.org/security/cve-assignement/-/issues/25
CVE: CVE-2024-8184
Published: 2024-10-14
Description: There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack.  By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/jetty/jetty.project/pull/11723; https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq; https://gitlab.eclipse.org/security/cve-assignement/-/issues/30
CVE: CVE-2024-45731
Published: 2024-10-14
Description: In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive.
CVSS Score: 8.0 (HIGH)
CWE: CWE-23, CWE-22
References: https://advisory.splunk.com/advisories/SVD-2024-1001; https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/
CVE: CVE-2024-45732
Published: 2024-10-14
Description: In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://advisory.splunk.com/advisories/SVD-2024-1002; https://research.splunk.com/application/f765c3fe-c3b6-4afe-a932-11dd4f3a024f/
CVE: CVE-2024-45733
Published: 2024-10-14
Description: In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://advisory.splunk.com/advisories/SVD-2024-1003; https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/
CVE: CVE-2024-45734
Published: 2024-10-14
Description: In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the  machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://advisory.splunk.com/advisories/SVD-2024-1004; https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/
CVE: CVE-2024-45735
Published: 2024-10-14
Description: In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://advisory.splunk.com/advisories/SVD-2024-1005; https://research.splunk.com/application/0a3d6035-7bef-4dfa-b01e-84349edac3b4/
CVE: CVE-2024-45736
Published: 2024-10-14
Description: In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted  "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://advisory.splunk.com/advisories/SVD-2024-1006; https://research.splunk.com/application/08978eca-caff-44c1-84dc-53f17def4e14/
CVE: CVE-2024-45737
Published: 2024-10-14
Description: In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://advisory.splunk.com/advisories/SVD-2024-1007; https://research.splunk.com/application/34bac267-a89b-4bd7-a072-a48eef1f15b8/
CVE: CVE-2024-45738
Published: 2024-10-14
Description: In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging level.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://advisory.splunk.com/advisories/SVD-2024-1008; https://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623/
CVE: CVE-2024-45739
Published: 2024-10-14
Description: In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://advisory.splunk.com/advisories/SVD-2024-1009; https://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623/
CVE: CVE-2024-45740
Published: 2024-10-14
Description: In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.splunk.com/advisories/SVD-2024-1010; https://research.splunk.com/application/d4f55f7c-6518-4122-a197-951fe0f21b25/
CVE: CVE-2024-45741
Published: 2024-10-14
Description: In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configuration file that the "api.uri" parameter from the "/manager/search/apps/local" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.splunk.com/advisories/SVD-2024-1011; https://research.splunk.com/application/d7b5aa71-157f-4359-9c34-e35752b1d0a2/
CVE: CVE-2024-46535
Published: 2024-10-14
Description: Jepaas v7.2.8 was discovered to contain a SQL injection vulnerability via the orderSQL parameter at /homePortal/loadUserMsg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/ketr/jepaas-release/issues/IAPJ8H?from=project-issue
CVE: CVE-2024-48168
Published: 2024-10-14
Description: A stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/fu37kola/cve/blob/main/D-Link/DCS-960L/D-Link%20DCS-960L%201.09%20Stack%20overflow_1.md
CVE: CVE-2024-48796
Published: 2024-10-14
Description: An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.eques.cn/?lang=en; https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.eques.plug/com.eques.plug.md
CVE: CVE-2024-48797
Published: 2024-10-14
Description: An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive information via the firmware update process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.pcsengineering.net/; https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.prestoncinema.app/com.prestoncinema.app.md
CVE: CVE-2024-48798
Published: 2024-10-14
Description: An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive information via the firmware update process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.hubbleconnected.vervelife/com.hubbleconnected.vervelife.md; https://hubbleconnected.com/
CVE: CVE-2024-48799
Published: 2024-10-14
Description: An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware update process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.lorexcorp.lorexping/com.lorexcorp.lorexping.md; https://www.lorex.com/
CVE: CVE-2023-45817
Published: 2024-10-14
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-9823. Reason: This candidate is a reservation duplicate of CVE-2024-9823. Notes: All CVE users should reference CVE-2024-9823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-46528
Published: 2024-10-14
Description: An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/kubesphere/kubesphere/issues/6227; https://kubesphere.io/; https://okankurtulus.com.tr/2024/09/09/idor-vulnerability-in-kubesphere/
CVE: CVE-2024-46980
Published: 2024-10-14
Description: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, a site administrator could create an artifact link type with a forward label allowing them to execute uncontrolled code (or at least achieve content injection) in a mail client. Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6 fix this issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Enalean/tuleap/commit/dd94a799982cd78ab06142008d745edf9e8fd494; https://github.com/Enalean/tuleap/security/advisories/GHSA-9fc9-47h6-82jj; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=dd94a799982cd78ab06142008d745edf9e8fd494
CVE: CVE-2024-46988
Published: 2024-10-14
Description: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, users might receive email notification with information they should not have access to. Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6 fix this issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://github.com/Enalean/tuleap/security/advisories/GHSA-g76g-hc92-96xw; https://tuleap.net/plugins/tracker/?aid=39686
CVE: CVE-2024-47766
Published: 2024-10-14
Description: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictions of project they are members of but not admin via the cross tracker search widget. Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-8 fix this issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://github.com/Enalean/tuleap/commit/529d11b[PII_REDACTED]7dd27a40ebadf3eaf8f5674; https://github.com/Enalean/tuleap/security/advisories/GHSA-qfrh-fv84-93hx; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=529d11b[PII_REDACTED]7dd27a40ebadf3eaf8f5674
CVE: CVE-2024-47767
Published: 2024-10-14
Description: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.113, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, users might see tracker names they should not have access to. Tuleap Community Edition 15.13.99.113, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-8 fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://github.com/Enalean/tuleap/commit/16d9efccb2fad8e10343be2604e94c9058ef2c89; https://github.com/Enalean/tuleap/commit/e5ce[PII_REDACTED]5dc0f126a11d6b5065b5db7eec; https://github.com/Enalean/tuleap/commit/f89d7093d2c576ad5e2b35a6a096fcdaf563d1df
CVE: CVE-2024-47826
Published: 2024-10-14
Description: eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works by providing HTML code in the extended search string, which will then be displayed back to the user in the error message. This means that injected HTML will appear in a red "alert/danger" box, and be part of an error message. Due to some other security measures, it is not possible to execute arbitrary javascript from this attack. As such, this attack is deemed low impact. Users should upgrade to at least version 5.1.5 to receive a patch. No known workarounds are available.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/elabftw/elabftw/security/advisories/GHSA-cjww-pr9f-4c4w; https://www.acunetix.com/vulnerabilities/web/html-injection
CVE: CVE-2024-47831
Published: 2024-10-14
Description: Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-674
References: https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a; https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m
CVE: CVE-2024-48789
Published: 2024-10-14
Description: An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://drivedeck.de/; https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.inatronic.drivedeck.home/com.inatronic.drivedeck.home.md
CVE: CVE-2024-48790
Published: 2024-10-14
Description: An issue in ILIFE com.ilife.home.global 1.8.7 allows a remote attacker to obtain sensitive information via the firmware update process.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.ilife.home.global/com.ilife.home.global.md; https://www.iliferobot.com/
CVE: CVE-2024-48791
Published: 2024-10-14
Description: An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://www.starvedia.com/; https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.starvedia.mCamView.zwave/com.starvedia.mCamView.zwave.md