deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45041
Published: 2024-09-09
Description: External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It also has path/update verb of validatingwebhookconfigurations resources.  This can be used to abuse the SA token of the deployment to retrieve or get ALL secrets in the whole cluster, capture and log all data from requests attempting to update Secrets, or make a webhook deny all Pod create and update requests. This vulnerability is fixed in 0.10.2.
CVSS Score: 8.3 (HIGH)
CWE: CWE-269, CWE-732
References: https://github.com/external-secrets/external-secrets/commit/428a452fd2ad45935312f2c2c0d40bc37ce6e67c; https://github.com/external-secrets/external-secrets/security/advisories/GHSA-qwgc-rr35-h4x9
CVE: CVE-2024-8042
Published: 2024-09-09
Description: Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect customer. This vulnerability is remediated as of August 14, 2024.
CVSS Score: 2.4 (LOW)
CWE: CWE-862, CWE-862
References: https://cwe.mitre.org/data/definitions/862.html
CVE: CVE-2024-8372
Published: 2024-09-09
Description: Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .

This issue affects AngularJS versions 1.3.0-rc.4 and greater.

Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-1289
References: https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017; https://www.herodevs.com/vulnerability-directory/cve-2024-8372; https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
CVE: CVE-2024-8373
Published: 2024-09-09
Description: Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .

This issue affects all versions of AngularJS.

Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-791
References: https://codepen.io/herodevs/full/bGPQgMp/8da9ce87e99403ee13a295c305ebfa0b; https://www.herodevs.com/vulnerability-directory/cve-2024-8373; https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
CVE: CVE-2024-44720
Published: 2024-09-09
Description: SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/seacms-net/CMS/issues/22
CVE: CVE-2024-44721
Published: 2024-09-09
Description: SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/seacms-net/CMS/issues/23
CVE: CVE-2024-8604
Published: 2024-09-09
Description: A vulnerability classified as problematic has been found in SourceCodester Online Food Ordering System 2.0. This affects an unknown part of the file index.php of the component Create an Account Page. The manipulation of the argument First Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://vuldb.com/?ctiid.276831; https://vuldb.com/?id.276831; https://vuldb.com/?submit.404660
CVE: CVE-2024-8605
Published: 2024-09-09
Description: A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affects unknown code of the file /view/registration.php of the component Registration Form. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://code-projects.org/; https://github.com/ali0999109/Inventory-management; https://vuldb.com/?ctiid.276832
CVE: CVE-2024-44333
Published: 2024-09-09
Description: D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 are vulnerable to Remote Command Execution. An attacker can achieve arbitrary command execution by sending a carefully crafted malicious string to the CGI function responsible for handling usb_paswd.asp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/Swind1er/c8656b32058e28e64f92d100c92ca12c; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-45406
Published: 2024-09-09
Description: Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8; https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42
CVE: CVE-2024-44334
Published: 2024-09-09
Description: D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 are vulnerable to Remote Command Execution due to insufficient parameter filtering in the CGI handling function of upgrade_filter.asp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://gist.github.com/Swind1er/563789899a7a4b9c261045a15efea952; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-44335
Published: 2024-09-09
Description: D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 are vulnerable to Remote Command Execution (RCE) via version_upgrade.asp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://gist.github.com/Swind1er/029fb2a9dab916f926fab40cc059223f; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-44849
Published: 2024-09-09
Description: Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://blog.extencil.me/information-security/cves/cve-2024-44849; https://github.com/extencil/CVE-2024-44849?tab=readme-ov-file; https://www.qualitor.com.br/official-security-advisory-cve-2024-44849
CVE: CVE-2024-24510
Published: 2024-09-09
Description: Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://book.hacktricks.xyz/pentesting-web/xs-search/css-injection; https://github.com/Alinto/sogo/commit/[PII_REDACTED]8ed71774eaf2979ee59330fc569424
CVE: CVE-2024-42759
Published: 2024-09-09
Description: An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-592
References: https://csflabs.github.io/cve/2024/09/06/cve-2024-42759-approval-of-your-own-ticket-with-BFLA.html; https://ellevo.com/
CVE: CVE-2024-45296
Published: 2024-09-09
Description: path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f; https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6; https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
CVE: CVE-2024-45411
Published: 2024-09-09
Description: Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-693
References: https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6; https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de; https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
CVE: CVE-2024-7260
Published: 2024-09-09
Description: An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.

Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://access.redhat.com/errata/RHSA-2024:6502; https://access.redhat.com/errata/RHSA-2024:6503; https://access.redhat.com/security/cve/CVE-2024-7260
CVE: CVE-2024-7318
Published: 2024-09-09
Description: A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute.
A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-324
References: https://access.redhat.com/errata/RHSA-2024:6502; https://access.redhat.com/errata/RHSA-2024:6503; https://access.redhat.com/security/cve/CVE-2024-7318
CVE: CVE-2024-7341
Published: 2024-09-09
Description: A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-384
References: https://access.redhat.com/errata/RHSA-2024:6493; https://access.redhat.com/errata/RHSA-2024:6494; https://access.redhat.com/errata/RHSA-2024:6495
CVE: CVE-2023-50883
Published: 2024-09-09
Description: ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.onlyoffice.com/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-027.txt; https://www.syss.de/pentest-blog/cross-site-scripting-schwachstelle-in-onlyoffice-docs-syss-2023-027
CVE: CVE-2024-27364
Published: 2024-09-09
Description: An issue was discovered in Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos W920, Exynos W930. In the function slsi_rx_roamed_ind(), there is no input validation check on a length coming from userspace, which can lead to a potential heap over-read.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-27364/
CVE: CVE-2024-27366
Published: 2024-09-09
Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos W920, Exynos W930. In the function slsi_rx_scan_done_ind(), there is no input validation check on a length coming from userspace, which can lead to a potential heap over-read.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-20
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-27366/
CVE: CVE-2024-27367
Published: 2024-09-09
Description: An issue was discovered in Samsung Mobile Processor Exynos Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos W920, Exynos W930. In the function slsi_rx_scan_ind(), there is no input validation check on a length coming from userspace, which can lead to integer overflow and a potential heap over-read.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-27367/
CVE: CVE-2024-27368
Published: 2024-09-09
Description: An issue was discovered in Samsung Mobile Processor Exynos Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos W920, Exynos W930. In the function slsi_rx_received_frame_ind(), there is no input validation check on a length coming from userspace, which can lead to a potential heap over-read.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27383
Published: 2024-09-09
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_get_scan_extra_ies(), there is no input validation check on default_ies coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27387
Published: 2024-09-09
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_rx_range_done_ind(), there is no input validation check on rtt_id coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-27387/
CVE: CVE-2024-42500
Published: 2024-09-09
Description: HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.
CVSS Score: 9.3 (CRITICAL)
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbux04697en_us&docLocale=en_US
CVE: CVE-2024-44085
Published: 2024-09-09
Description: ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.onlyoffice.com/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-027.txt; https://www.syss.de/pentest-blog/cross-site-scripting-schwachstelle-in-onlyoffice-docs-syss-2023-027
CVE: CVE-2024-44724
Published: 2024-09-09
Description: AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite_url parameter at /admin/site_add.php. This vulnerability allows attackers to execute arbitrary PHP code via injecting a crafted value.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/Hebing123/cve/issues/68
CVE: CVE-2024-44725
Published: 2024-09-09
Description: AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/Hebing123/cve/issues/69
CVE: CVE-2024-44902
Published: 2024-09-09
Description: A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://thinkphp.com; https://github.com/fru1ts/CVE-2024-44902
CVE: CVE-2024-6795
Published: 2024-09-09
Description: In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database. 

An attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content 

and/or perform administrative operations including shutting down the database.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-249-01
CVE: CVE-2024-6796
Published: 2024-09-09
Description: In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-249-01
CVE: CVE-2024-27365
Published: 2024-09-09
Description: An issue was discovered in Samsung Mobile Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos W920, Exynos W930. In the function slsi_rx_blockack_ind(), there is no input validation check on a length coming from userspace, which can lead to a potential heap over-read.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-27365/
CVE: CVE-2024-44410
Published: 2024-09-09
Description: D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-94
References: https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/CVE-2024-44410; https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/DI-8300A1.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-44411
Published: 2024-09-09
Description: D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/CVE-2024-44411; https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/DI-8300A1-2.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-8610
Published: 2024-09-09
Description: A vulnerability classified as problematic has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file /index.php?page=tenants of the component New Tenant Page. The manipulation of the argument Last Name/First Name/Middle Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1mB2ZNyWJDqJaZZro4qiMqovRO_qo4pss/view?usp=sharing; https://vuldb.com/?ctiid.276840; https://vuldb.com/?id.276840
CVE: CVE-2024-8611
Published: 2024-09-09
Description: A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of the file ssms.php. The manipulation of the argument customer leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/elegant228/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.276841
CVE: CVE-2024-38270
Published: 2024-09-10
Description: An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-331
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-for-web-authentication-tokens-generation-in-gs1900-series-switches-09-10-2024
CVE: CVE-2024-6342
Published: 2024-09-10
Description: **UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-nas-products-09-10-2024
CVE: CVE-2024-41729
Published: 2024-09-10
Description: Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-359, CWE-862
References: https://me.sap.com/notes/3481588; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-42371
Published: 2024-09-10
Description: The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces and nodes. There is low impact on integrity and availability of the application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3488039; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-42378
Published: 2024-09-10
Description: Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3497347; https://url.sap/sapsecuritypatchday