deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-30261
Published: 2024-04-04
Description: Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
CVSS Score: 2.6 (LOW)
CWE: CWE-284
References: https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055; https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3; https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672
CVE: CVE-2024-3116
Published: 2024-04-04
Description: pgAdmin <= 8.4 is affected by a  Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.
CVSS Score: 7.4 (HIGH)
CWE: CWE-77
References: https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98; https://github.com/pgadmin-org/pgadmin4/issues/7326; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2/
CVE: CVE-2024-3250
Published: 2024-04-04
Description: It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2, and v1.7.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/canonical/pebble/security/advisories/GHSA-4685-2x5r-65pj; https://www.cve.org/CVERecord?id=CVE-2024-3250; https://github.com/canonical/pebble/security/advisories/GHSA-4685-2x5r-65pj
CVE: CVE-2024-3298
Published: 2024-04-04
Description: Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF. NOTE: this vulnerability was SPLIT from CVE-2024-1847.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-843
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-3299
Published: 2024-04-04
Description: Out-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted SLDDRW or SLDPRT file. NOTE: this vulnerability was SPLIT from CVE-2024-1847.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787, CWE-908
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-2103
Published: 2024-04-04
Description: 
Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably:
SEL-700BT Motor Bus Transfer Relay, SEL-700G Generator Protection Relay, SEL-710-5 Motor Protection Relay, SEL-751 Feeder Protection Relay, SEL-787-2/-3/-4 Transformer Protection Relay, SEL-787Z High-Impedance Differential Relay

. See product instruction manual appendix A dated 20240308 for more details regarding the SEL-751 Feeder Protection Relay. For more information for the other affected products, see their instruction manuals dated 20240329.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1242
References: https://selinc.com/support/security-notifications/external-reports/; https://selinc.com/support/security-notifications/external-reports/
CVE: CVE-2024-30260
Published: 2024-04-04
Description: Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
CVSS Score: 3.9 (LOW)
CWE: CWE-285, CWE-863
References: https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f; https://github.com/nodejs/undici/commit/[PII_REDACTED]d27a5369d7fb67bc05f95a28247d75; https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7
CVE: CVE-2024-30266
Published: 2024-04-04
Description: wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerability has been patched in version 19.0.1.
CVSS Score: 3.3 (LOW)
CWE: CWE-843
References: https://github.com/bytecodealliance/wasmtime/commit/7f57d0bb0948fa56cc950278d0db230ed10e8664; https://github.com/bytecodealliance/wasmtime/issues/8281; https://github.com/bytecodealliance/wasmtime/pull/8018
CVE: CVE-2024-31207
Published: 2024-04-04
Description: Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0; https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48; https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67
CVE: CVE-2024-31209
Published: 2024-04-04
Description: oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388; https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c; https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649
CVE: CVE-2024-31215
Published: 2024-04-04
Description: Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile.
A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716; https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373; https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx
CVE: CVE-2023-3454
Published: 2024-04-04
Description: Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch.
CVSS Score: 8.6 (HIGH)
CWE: CWE-78, CWE-78
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.broadcom.com/external/content/SecurityAdvisories/0/23215; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-30263
Published: 2024-04-04
Description: macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can access restricted PDF attachments if they are shown on public pages where the PDF Viewer macro is called using the attachment URL instead of its reference. This vulnerability has been patched in version 2.5.1.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200
References: https://github.com/xwikisas/macro-pdfviewer/issues/49; https://github.com/xwikisas/macro-pdfviewer/security/advisories/GHSA-93qq-2h34-g29f; https://github.com/xwikisas/macro-pdfviewer/issues/49
CVE: CVE-2024-25690
Published: 2024-04-04
Description: There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE: CVE-2024-25692
Published: 2024-04-04
Description: There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote, unauthenticated attacker to trick an authorized user into executing unwanted actions via a crafted form. The impact to Confidentiality and Integrity vectors is limited and of low severity.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE: CVE-2024-25693
Published: 2024-04-04
Description: There is a path traversal in Esri Portal for ArcGIS versions <= 11.2.  Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory. 
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE: CVE-2024-25695
Published: 2024-04-04
Description: There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages.  The are no privileges required to execute this attack.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-2/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-2/
CVE: CVE-2024-25696
Published: 2024-04-04
Description: There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when accessing the page editor an image will render in the victim’s browser.  The privileges required to execute this attack are high.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE: CVE-2024-25697
Published: 2024-04-04
Description: There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which when opening an authenticated users bio page will render an image in the victims browser.  The privileges required to execute this attack are low.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE: CVE-2024-25698
Published: 2024-04-04
Description: There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linux that allows a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE: CVE-2024-25699
Published: 2024-04-04
Description: There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could allow a remote, authenticated attacker with low‑privileged access to compromise the confidentiality, integrity, and availability of the software. Successful exploitation allows the attacker to cross an authentication and authorization boundary beyond their originally assigned access, resulting in a scope change.
CVSS Score: 8.5 (HIGH)
CWE: CWE-287
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE: CVE-2024-25700
Published: 2024-04-04
Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in a web map link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-2/
CVE: CVE-2024-25703
Published: 2024-04-04
Description: Rejected reason: 
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because this item is scheduled to be patched at a future time.
CVE: CVE-2024-25704
Published: 2024-04-04
Description: Rejected reason: 
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because this item is scheduled to be patched at a future time.
CVE: CVE-2024-25705
Published: 2024-04-04
Description: There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation requires basic authenticated access but does not require elevated or administrative privileges, indicating low privileges are required.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/the-portal-for-arcgis-security-2024-update-2-is-available-install-these-patches-at-your-earliest-opportunity-to-address-these-vulnerabilities/
CVE: CVE-2024-25706
Published: 2024-04-04
Description: There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-2/
CVE: CVE-2024-25708
Published: 2024-04-04
Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE: CVE-2024-25709
Published: 2024-04-04
Description: There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScript code in a victim’s browser. Exploitation does not require any privileges and can be performed by an anonymous user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/
CVE: CVE-2024-27268
Published: 2024-04-04
Description: IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  284574.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/284574; https://www.ibm.com/support/pages/node/7145809; https://www.kb.cert.org/vuls/id/421644
CVE: CVE-2024-28787
Published: 2024-04-04
Description: IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote attacker to obtain highly sensitive private information or cause a denial of service using a specially crafted HTTP request.  IBM X-Force ID:  286584.
CVSS Score: 8.7 (HIGH)
CWE: CWE-650
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/286584; https://www.ibm.com/support/pages/node/7145828; https://exchange.xforce.ibmcloud.com/vulnerabilities/286584
CVE: CVE-2024-29192
Published: 2024-04-04
Description: gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The `/api/config` endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an attacker may be able to achieve that depending on how go2rtc is set up on the upstream application, and given that this endpoint is not protected against CSRF, it allows requests from any origin (e.g. a "drive-by" attack) . The `exec` handler allows for any stream to execute arbitrary commands. An attacker may add a custom stream through `api/config`, which may lead to arbitrary command execution. In the event of a victim visiting the server in question, their browser will execute the requests against the go2rtc instance. Commit 8793c3636493c5efdda08f3b5ed5c6e1ea594fd9 adds a warning about secure API access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/AlexxIT/go2rtc/commit/8793c3636493c5efdda08f3b5ed5c6e1ea594fd9; https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/; https://github.com/AlexxIT/go2rtc/commit/8793c3636493c5efdda08f3b5ed5c6e1ea594fd9
CVE: CVE-2024-2660
Published: 2024-04-04
Description: Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-636
References: https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573; https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-25007
Published: 2024-04-04
Description: 
Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability.


CVSS Score: 7.1 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://www.ericsson.com/en/about-us/security/psirt/security-bulletin--ericsson-network-manager-march-2024; https://www.ericsson.com/en/about-us/security/psirt/security-bulletin--ericsson-network-manager-march-2024
CVE: CVE-2024-29193
Published: 2024-04-04
Description: gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (`index.html`) shows the available streams by fetching the API in the client side. Then, it uses `Object.entries` to iterate over the result whose first item (`name`) gets appended using `innerHTML`. In the event of a victim visiting the server in question, their browser will execute the request against the go2rtc instance. After the request, the browser will be redirected to go2rtc, in which the XSS would be executed in the context of go2rtc’s origin. As of time of publication, no patch is available.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/; https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/
CVE: CVE-2024-30249
Published: 2024-04-04
Description: Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR1-20[PII_REDACTED]22-15` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to use Network as an amplification vector for a UDP denial of service attack against a third party or as an attempt to trigger service suspension of the host. All consumers of the library should upgrade to at least version `1.0.0.CR1-20[PII_REDACTED]22-15` to receive a fix. There are no known workarounds beyond updating the library.
CVSS Score: 8.6 (HIGH)
CWE: CWE-770
References: https://github.com/CloudburstMC/Network/security/advisories/GHSA-6h3m-c6fv-8hvh; https://github.com/CloudburstMC/Network/security/advisories/GHSA-6h3m-c6fv-8hvh