deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-24746
Published: 2024-04-06
Description: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. 

Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device.

This issue affects Apache NimBLE: through 1.6.0.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: http://www.openwall.com/lists/oss-security/2024/04/05/2; https://github.com/apache/mynewt-nimble/commit/d42a0ebe6632bd0c318560e4293a522634f60594; https://lists.apache.org/thread/bptkzc0o2ymjk8qqzqdmy39kcmh27078
CVE: CVE-2024-25029
Published: 2024-04-06
Description: IBM Personal Communications 14.0.6 through 15.0.1 includes a Windows service that is vulnerable to remote code execution (RCE) and local privilege escalation (LPE). The vulnerability allows any unprivileged user with network access to a target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to move laterally to affected systems and to escalate their privileges.  IBM X-Force ID:  281619.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-119
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/281619; https://www.ibm.com/support/pages/node/7147672; https://exchange.xforce.ibmcloud.com/vulnerabilities/281619
CVE: CVE-2024-3376
Published: 2024-04-06
Description: A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file config.php. The manipulation of the argument url leads to execution after redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259497 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-698, CWE-670
References: https://github.com/Sospiro014/zday1/blob/main/Execution_After_Redirect.md; https://vuldb.com/?ctiid.259497; https://vuldb.com/?id.259497
CVE: CVE-2024-3377
Published: 2024-04-06
Description: A vulnerability classified as problematic was found in SourceCodester Computer Laboratory Management System 1.0. This vulnerability affects unknown code of the file /classes/SystemSettings.php?f=update_settings. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259498 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/Sospiro014/zday1/blob/main/ear_stord_xss.md; https://vuldb.com/?ctiid.259498; https://vuldb.com/?id.259498
CVE: CVE-2024-3378
Published: 2024-04-06
Description: A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.2.0.160 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259501 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/modrnProph3t/CVE/blob/main/CVE-2024-3378.md; https://vuldb.com/?ctiid.259501; https://vuldb.com/?id.259501
CVE: CVE-2024-3156
Published: 2024-04-06
Description: Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/329130358; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVEJEW7UCSUSK2J2FYQRZZPI74P2D3JP/
CVE: CVE-2024-3158
Published: 2024-04-06
Description: Use after free in Bookmarks in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/329965696; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVEJEW7UCSUSK2J2FYQRZZPI74P2D3JP/
CVE: CVE-2024-3159
Published: 2024-04-06
Description: Out of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-125
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/330760873; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVEJEW7UCSUSK2J2FYQRZZPI74P2D3JP/
CVE: CVE-2024-0406
Published: 2024-04-06
Description: A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-22
References: https://access.redhat.com/errata/RHSA-2025:2449; https://access.redhat.com/security/cve/CVE-2024-0406; https://bugzilla.redhat.com/show_bug.cgi?id=2257749
CVE: CVE-2024-27620
Published: 2024-04-06
Description: An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: http://ladder.com; https://everywall.github.io/; https://packetstormsecurity.com/files/177506/Ladder-0.0.21-Server-Side-Request-Forgery.html
CVE: CVE-2024-28741
Published: 2024-04-06
Description: Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://blog.chebuya.com/posts/discovering-cve-2024-28741-remote-code-execution-on-northstar-c2-agents-via-pre-auth-stored-xss/; https://github.com/EnginDemirbilek/NorthStarC2; https://packetstormsecurity.com/files/177542/NorthStar-C2-Agent-1.0-Cross-Site-Scripting-Remote-Command-Execution.html
CVE: CVE-2024-3413
Published: 2024-04-06
Description: A vulnerability has been found in SourceCodester Human Resource Information System 1.0 and classified as critical. This vulnerability affects unknown code of the file initialize/login_process.php. The manipulation of the argument hr_email/hr_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259582 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Human-Resource-Information-System/Human-Resource-Information-System-01.md; https://vuldb.com/?ctiid.259582; https://vuldb.com/?id.259582
CVE: CVE-2024-3414
Published: 2024-04-06
Description: A vulnerability was found in SourceCodester Human Resource Information System 1.0 and classified as problematic. This issue affects some unknown processing of the file Superadmin_Dashboard/process/addcorporate_process.php. The manipulation of the argument corporate_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259583.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/thisissuperann/Vul/blob/Human-Resource-Information-System/Human-Resource-Information-System-02.md; https://vuldb.com/?ctiid.259583; https://vuldb.com/?id.259583
CVE: CVE-2024-3415
Published: 2024-04-06
Description: A vulnerability was found in SourceCodester Human Resource Information System 1.0. It has been classified as problematic. Affected is an unknown function of the file Superadmin_Dashboard/process/addbranches_process.php. The manipulation of the argument branches_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259584.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/thisissuperann/Vul/blob/Human-Resource-Information-System/Human-Resource-Information-System-03.md; https://vuldb.com/?ctiid.259584; https://vuldb.com/?id.259584
CVE: CVE-2023-6877
Published: 2024-04-07
Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping on the Content-Type field of error messages when retrieving an invalid RSS feed. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3012849/feedzy-rss-feeds; https://www.wordfence.com/threat-intel/vulnerabilities/id/7d25e85f-28f7-4cc5-9856-25cc5aaf1418?source=cve; https://plugins.trac.wordpress.org/changeset/3012849/feedzy-rss-feeds
CVE: CVE-2024-3416
Published: 2024-04-07
Description: A vulnerability classified as critical was found in SourceCodester Online Courseware 1.0. This vulnerability affects unknown code of the file admin/editt.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259588.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-01.md; https://vuldb.com/?ctiid.259588; https://vuldb.com/?id.259588
CVE: CVE-2024-3417
Published: 2024-04-07
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Courseware 1.0. This issue affects some unknown processing of the file admin/saveeditt.php. The manipulation of the argument contact leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259589 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-02.md; https://vuldb.com/?ctiid.259589; https://vuldb.com/?id.259589
CVE: CVE-2024-30413
Published: 2024-04-07
Description: Vulnerability of improper permission control in the window management module.
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2024-30414
Published: 2024-04-07
Description: Command injection vulnerability in the AccountManager module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2024-30415
Published: 2024-04-07
Description: Vulnerability of improper permission control in the window management module.
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2021-4438
Published: 2024-04-07
Description: A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentModule.kt. The manipulation leads to improper export of android application components. Attacking locally is a requirement. Upgrading to version 1.1.5 is able to address this issue. The name of the patch is 5423dcb0cd3e4d573b5520a71fa08aa279e4c3c7. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-259508.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/kyivstarteam/react-native-sms-user-consent/commit/5423dcb0cd3e4d573b5520a71fa08aa279e4c3c7; https://github.com/kyivstarteam/react-native-sms-user-consent/pull/4; https://github.com/kyivstarteam/react-native-sms-user-consent/releases/tag/1.1.5
CVE: CVE-2023-52382
Published: 2024-04-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52713
Published: 2024-04-07
Description: Vulnerability of improper permission control in the window management module.
Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
CVSS Score: 7.7 (HIGH)
CWE: CWE-862
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2023-52714
Published: 2024-04-07
Description: Vulnerability of defects introduced in the design process in the hwnff module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-657
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2023-52715
Published: 2024-04-07
Description: The SystemUI module has a vulnerability in permission management.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2023-52716
Published: 2024-04-07
Description: Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module.
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2023-52717
Published: 2024-04-07
Description: Permission verification vulnerability in the lock screen module.
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2024-30416
Published: 2024-04-07
Description: Use After Free (UAF) vulnerability in the underlying driver module.
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2024-30417
Published: 2024-04-07
Description: Path traversal vulnerability in the Bluetooth-based sharing module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2024-30418
Published: 2024-04-07
Description: Vulnerability of insufficient permission verification in the app management module.
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-280, CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2024/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2024/4/
CVE: CVE-2024-3418
Published: 2024-04-07
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file admin/deactivateteach.php. The manipulation of the argument selector leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-259590 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-03.md; https://vuldb.com/?ctiid.259590; https://vuldb.com/?id.259590
CVE: CVE-2024-3419
Published: 2024-04-07
Description: A vulnerability has been found in SourceCodester Online Courseware 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/edit.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259591.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-04.md; https://vuldb.com/?ctiid.259591; https://vuldb.com/?id.259591
CVE: CVE-2024-3420
Published: 2024-04-07
Description: A vulnerability was found in SourceCodester Online Courseware 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/saveedit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259592.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-05.md; https://vuldb.com/?ctiid.259592; https://vuldb.com/?id.259592
CVE: CVE-2024-3421
Published: 2024-04-07
Description: A vulnerability was found in SourceCodester Online Courseware 1.0. It has been classified as critical. This affects an unknown part of the file admin/deactivatestud.php. The manipulation of the argument selector leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259593 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-06.md; https://vuldb.com/?ctiid.259593; https://vuldb.com/?id.259593
CVE: CVE-2024-3422
Published: 2024-04-07
Description: A vulnerability was found in SourceCodester Online Courseware 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/activatestud.php. The manipulation of the argument selector leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259594 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-07.md; https://vuldb.com/?ctiid.259594; https://vuldb.com/?id.259594
CVE: CVE-2024-3423
Published: 2024-04-07
Description: A vulnerability was found in SourceCodester Online Courseware 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/activateteach.php. The manipulation of the argument selector leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259595.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-08.md; https://vuldb.com/?ctiid.259595; https://vuldb.com/?id.259595
CVE: CVE-2024-3424
Published: 2024-04-07
Description: A vulnerability classified as critical has been found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file admin/listscore.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259596.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-09.md; https://vuldb.com/?ctiid.259596; https://vuldb.com/?id.259596
CVE: CVE-2024-3425
Published: 2024-04-07
Description: A vulnerability classified as critical was found in SourceCodester Online Courseware 1.0. Affected by this vulnerability is an unknown functionality of the file admin/activateall.php. The manipulation of the argument selector leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259597 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-10.md; https://vuldb.com/?ctiid.259597; https://vuldb.com/?id.259597
CVE: CVE-2024-3426
Published: 2024-04-07
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Online Courseware 1.0. Affected by this issue is some unknown functionality of the file editt.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259598 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-11.md; https://vuldb.com/?ctiid.259598; https://vuldb.com/?id.259598
CVE: CVE-2024-3427
Published: 2024-04-07
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Courseware 1.0. This affects an unknown part of the file addq.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259599.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-12.md; https://vuldb.com/?ctiid.259599; https://vuldb.com/?id.259599