deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-28907
Published: 2024-04-09
Description: Microsoft Brokering File System Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28907; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28907
CVE: CVE-2024-28908
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28908; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28908
CVE: CVE-2024-28909
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28909; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28909
CVE: CVE-2024-28910
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28910; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28910
CVE: CVE-2024-28911
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28911; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28911
CVE: CVE-2024-28912
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28912; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28912
CVE: CVE-2024-28913
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28913; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28913
CVE: CVE-2024-28914
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28914; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28914
CVE: CVE-2024-28915
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28915; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28915
CVE: CVE-2024-28917
Published: 2024-04-09
Description: Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28917; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28917
CVE: CVE-2024-28919
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28919; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28919
CVE: CVE-2024-28920
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28920; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28920
CVE: CVE-2024-28921
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28921; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28921
CVE: CVE-2024-28922
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28922; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28922
CVE: CVE-2024-28923
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28923; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28923
CVE: CVE-2024-28924
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28924; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28924
CVE: CVE-2024-28925
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28925; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28925
CVE: CVE-2024-28926
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28926; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28926
CVE: CVE-2024-28927
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28927; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28927
CVE: CVE-2024-28929
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28929; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28929
CVE: CVE-2024-28930
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28930; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28930
CVE: CVE-2024-28931
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28931; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28931
CVE: CVE-2024-28932
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28932; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28932
CVE: CVE-2024-28933
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28933; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28933
CVE: CVE-2024-28934
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28934; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28934
CVE: CVE-2024-28935
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28935; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28935
CVE: CVE-2024-28936
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28936; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28936
CVE: CVE-2024-28937
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28937; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28937
CVE: CVE-2024-28938
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28938; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28938
CVE: CVE-2024-28939
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-209
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28939; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28939
CVE: CVE-2024-28940
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28940; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28940
CVE: CVE-2024-28941
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28941; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28941
CVE: CVE-2024-28942
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28942; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28942
CVE: CVE-2024-28943
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28943; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28943
CVE: CVE-2024-28944
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-197
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28944; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28944
CVE: CVE-2024-28945
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28945; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28945
CVE: CVE-2024-29043
Published: 2024-04-09
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29043; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29043
CVE: CVE-2024-29044
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29044; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29044
CVE: CVE-2024-29045
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29045; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29045
CVE: CVE-2024-29046
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29046; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29046
CVE: CVE-2024-29047
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29047; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29047
CVE: CVE-2024-29048
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29048; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29048
CVE: CVE-2024-29050
Published: 2024-04-09
Description: Windows Cryptographic Services Remote Code Execution Vulnerability
CVSS Score: 8.4 (HIGH)
CWE: CWE-197, CWE-295
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29050; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29050
CVE: CVE-2024-29052
Published: 2024-04-09
Description: Windows Storage Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29052; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29052
CVE: CVE-2024-29053
Published: 2024-04-09
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-36, CWE-22
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29053; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29053
CVE: CVE-2024-29054
Published: 2024-04-09
Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29054; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29054
CVE: CVE-2024-29055
Published: 2024-04-09
Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29055; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29055
CVE: CVE-2024-29056
Published: 2024-04-09
Description: Windows Authentication Elevation of Privilege Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29056; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29056
CVE: CVE-2024-29061
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29061; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29061
CVE: CVE-2024-29062
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-367, CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29062; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29062
CVE: CVE-2024-29063
Published: 2024-04-09
Description: Azure AI Search Information Disclosure Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-798
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29063; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29063
CVE: CVE-2024-29064
Published: 2024-04-09
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-130
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29064; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29064
CVE: CVE-2024-29066
Published: 2024-04-09
Description: Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29066; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29066
CVE: CVE-2024-29905
Published: 2024-04-09
Description: DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using `dirac-proxy-init`), it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during the generation process. Version 8.0.41 contains a patch for the issue. As a workaround, setting the `X509_USER_PROXY` environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written, it can be safely copied to the standard location (`/tmp/x509up_uNNNN`).
CVSS Score: 8.1 (HIGH)
CWE: CWE-668
References: https://github.com/DIRACGrid/DIRAC/commit/1faa709341969a6321e29c843ca94039d33b2c3d; https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-v6f3-gh5h-mqwx; https://github.com/DIRACGrid/DIRAC/commit/1faa709341969a6321e29c843ca94039d33b2c3d
CVE: CVE-2024-29982
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29982; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29982
CVE: CVE-2024-29983
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29983; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29983
CVE: CVE-2024-29984
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29984; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29984
CVE: CVE-2024-29985
Published: 2024-04-09
Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29985; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29985
CVE: CVE-2024-29988
Published: 2024-04-09
Description: SmartScreen Prompt Security Feature Bypass Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29988; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29988; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29988
CVE: CVE-2024-29989
Published: 2024-04-09
Description: Azure Monitor Agent Elevation of Privilege Vulnerability
CVSS Score: 8.4 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29989; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29989
CVE: CVE-2024-29990
Published: 2024-04-09
Description: Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29990; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29990
CVE: CVE-2024-29992
Published: 2024-04-09
Description: Azure Identity Library for .NET Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29992; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29992
CVE: CVE-2024-29993
Published: 2024-04-09
Description: Azure CycleCloud Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29993; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29993
CVE: CVE-2024-30262
Published: 2024-04-09
Description: Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384, CWE-613, CWE-613
References: https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9; https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5; https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9
CVE: CVE-2024-31455
Published: 2024-04-09
Description: Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit `5c381cf` added the ability to get GitHub repositories registered to a project without specifying a specific provider.  Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. This issue is patched in pull request 2941. As a workaround, revert prior to `5c381cf`, or roll forward past `2eb94e7`.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/stacklok/minder/commit/11b6573ad62cfdd783a8bb52f3fce461466037f4; https://github.com/stacklok/minder/commit/5c381cfbf3e4b7ce040ed8511a1fae1a78a0014b; https://github.com/stacklok/minder/pull/2941
CVE: CVE-2024-31867
Published: 2024-04-09
Description: Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2024/04/09/12; https://github.com/apache/zeppelin/pull/4714; https://lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtf
CVE: CVE-2024-22423
Published: 2024-04-09
Description: yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment variables. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and load the fields from it instead.
CVSS Score: 8.3 (HIGH)
CWE: CWE-78
References: https://github.com/yt-dlp/yt-dlp/commit/de015e930747165dbb8fcd360f8775fd973b7d6e; https://github.com/yt-dlp/yt-dlp/commit/ff07792676f404ffff6ee61b5638c9dc1a33a37a; https://github.com/yt-dlp/yt-dlp/releases/tag/2021.04.11