deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39918
Published: 2024-07-15
Description: @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in an arbitrary location that the server has permission to access. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts#L75; https://github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507; https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-vvmv-wrvp-9gjr
CVE: CVE-2024-39919
Published: 2024-07-15
Description: @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an `ALLOW_LIST` where the host can specify which services the user is permitted to capture screenshots of. By default, capturing screenshots of web services running on localhost, 127.0.0.1, or the [::] is allowed. If someone hosts this project on a server, users could then capture screenshots of other web services running locally. This issue has been addressed in version 2.1.1 with the addition of a blocklist. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://github.com/jasonraimondi/url-to-png/commit/f62ff40403ffa1781459d6be8d97b8035888c00c; https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-342q-2mc2-5gmp; https://github.com/jasonraimondi/url-to-png/commit/f62ff40403ffa1781459d6be8d97b8035888c00c
CVE: CVE-2024-40624
Published: 2024-07-15
Description: TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In `torrentpier/library/includes/functions.php`, `get_tracks()` uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to an arbitrary file, and execute commands on the system. For instance, the cookie bb_t will be deserialized when browsing to viewforum.php. This issue has been addressed in commit `ed37e6e52` which is expected to be included in release version 2.4.4. Users are advised to upgrade as soon as the new release is available. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c[PII_REDACTED]80304bf50f/library/includes/functions.php#L41-L60; https://github.com/torrentpier/torrentpier/commit/ed37e6e522f345f2b46147c6f53c1ab6dec1db9e; https://github.com/torrentpier/torrentpier/security/advisories/GHSA-fg86-4c2r-7wxw
CVE: CVE-2024-40627
Published: 2024-07-15
Description: Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware` allows all HTTP `OPTIONS` requests without evaluating it against any policy. If an application provides different responses to HTTP `OPTIONS` requests based on an entity existing (such as to indicate whether an entity is writable on a system level), an unauthenticated attacker could discover which entities exist within an application. This issue has been addressed in release version 2.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-204
References: https://github.com/busykoala/fastapi-opa/blob/6dd6f8c87e908fe080784a74707f016f1422b58a/fastapi_opa/opa/opa_middleware.py#L79-L80; https://github.com/busykoala/fastapi-opa/commit/9588109ff651f7ffc92687129c[PII_REDACTED]fb8c; https://github.com/busykoala/fastapi-opa/security/advisories/GHSA-5f5c-8rvc-j8wf
CVE: CVE-2024-40630
Published: 2024-07-15
Description: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in `HeifInput::seek_subimage()`.  In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the `ImageInput` APIs. This bug has been addressed in commit `0a2dcb4c` which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/AcademySoftwareFoundation/OpenImageIO/blob/7c486a1121a4bf71d50ff555fab2770294b748d7/src/heif.imageio/heifinput.cpp#L250; https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/0a2dcb4cf2c3fd4825a146cd3ad929d9d8305ce3; https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-jjm9-9m4m-c8p2
CVE: CVE-2024-4224
Published: 2024-07-15
Description: An authenticated stored cross-site scripting (XSS) exists in the TP-Link TL-SG1016DE affecting version TL-SG1016DE(UN) V7.6_1.0.0 Build 20230616, which could allow an adversary to run JavaScript in an administrator's browser. This issue was fixed in TL-SG1016DE(UN) V7_1.0.1 Build 20240628.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://takeonme.org/cves/CVE-2024-4224.html; https://www.tp-link.com/en/support/download/tl-sg1016de/v7/#Firmware; https://takeonme.org/cves/CVE-2024-4224.html
CVE: CVE-2024-40632
Published: 2024-07-15
Description: Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/shutdown. Linkerd could introduce an optional environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that do not include this header. This issue has been addressed in release version edge-24.6.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-918
References: https://github.com/linkerd/linkerd2-proxy/blob/46957de49f25fd4661af7b7c52659148f4d6dd27/linkerd/app/admin/src/server.rs; https://github.com/linkerd/linkerd2/commit/35fb2d6d11ef6520ae516dd717790529f85224fa; https://github.com/linkerd/linkerd2/security/advisories/GHSA-6v94-gj6x-jqj7
CVE: CVE-2024-4143
Published: 2024-07-15
Description: A potential security vulnerability has been identified in certain HP PC products using AMI BIOS, which might allow arbitrary code execution. AMI has released firmware updates to mitigate this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]4417-16/hpsbhf03953; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]4417-16/hpsbhf03953
CVE: CVE-2024-40524
Published: 2024-07-15
Description: Directory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\application.py component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.yuque.com/iceqaq/rtn9q7/cdd9w9phgxuqy4to; https://www.yuque.com/iceqaq/rtn9q7/cdd9w9phgxuqy4to
CVE: CVE-2024-6780
Published: 2024-07-16
Description: Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://security.tecno.com/SRC/blogdetail/276?lang=en_US; https://security.tecno.com/SRC/securityUpdates?type=SA; https://security.tecno.com/SRC/blogdetail/276?lang=en_US
CVE: CVE-2024-6557
Published: 2024-07-16
Description: The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and leaving the demo files in place with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/wp-scheduled-posts/trunk/vendor/wpdevelopers/pinterest-api-php/demo/boot.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3117736%40wp-scheduled-posts&new=3117736%40wp-scheduled-posts&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f80fa8b3-f345-4b3f-8a16-ee9f19b07a0b?source=cve
CVE: CVE-2024-4780
Published: 2024-07-16
Description: The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihe_link’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/image-hover-effects-addon-for-elementor/tags/1.4.3/includes/widgets.php#L529; https://plugins.trac.wordpress.org/changeset/3117113/; https://wordpress.org/plugins/image-hover-effects-addon-for-elementor/#developers
CVE: CVE-2024-6559
Published: 2024-07-16
Description: The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3. This is due the plugin utilizing sabre without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3118643/xcloner-backup-and-restore/trunk/vendor/sabre/vobject/bin/fetch_windows_zones.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0500c57a-3983-46e4-92fa-85f7fd47eba8?source=cve; https://plugins.trac.wordpress.org/changeset/3118643/xcloner-backup-and-restore/trunk/vendor/sabre/vobject/bin/fetch_windows_zones.php
CVE: CVE-2023-52290
Published: 2024-07-16
Description: In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection vulnerability. The attacker must successfully log into the system to launch an attack, which may cause data leakage. Since no data will be written, so this is a low-impact vulnerability.

Mitigation:

all users should upgrade to 2.1.4,  Such parameters will be blocked.


CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://lists.apache.org/thread/t3mcm8pb65d9gj3wrgtj9sx9s2pfvvl3; http://www.openwall.com/lists/oss-security/2024/07/15/4; https://lists.apache.org/thread/t3mcm8pb65d9gj3wrgtj9sx9s2pfvvl3
CVE: CVE-2024-41008
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: change vm->task_info handling

This patch changes the handling and lifecycle of vm->task_info object.
The major changes are:
- vm->task_info is a dynamically allocated ptr now, and its uasge is
  reference counted.
- introducing two new helper funcs for task_info lifecycle management
    - amdgpu_vm_get_task_info: reference counts up task_info before
      returning this info
    - amdgpu_vm_put_task_info: reference counts down task_info
- last put to task_info() frees task_info from the vm.

This patch also does logistical changes required for existing usage
of vm->task_info.

V2: Do not block all the prints when task_info not found (Felix)

V3: Fixed review comments from Felix
   - Fix wrong indentation
   - No debug message for -ENOMEM
   - Add NULL check for task_info
   - Do not duplicate the debug messages (ti vs no ti)
   - Get first reference of task_info in vm_init(), put last
     in vm_fini()

V4: Fixed review comments from Felix
   - fix double reference increment in create_task_info
   - change amdgpu_vm_get_task_info_pasid
   - additional changes in amdgpu_gem.c while porting
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c; https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c
CVE: CVE-2024-1937
Published: 2024-07-16
Description: The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to modify the content of arbitrary published posts, which includes the ability to insert malicious JavaScript.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3112878/brizy/trunk/editor/api.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5f73c3-f40b-45d5-9947-c1a514d230f7?source=cve; https://plugins.trac.wordpress.org/changeset/3112878/brizy/trunk/editor/api.php
CVE: CVE-2024-2691
Published: 2024-07-16
Description: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3116941/wp-event-manager/trunk/shortcodes/wp-event-manager-shortcodes.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/01a6dcf2-6f0b-494b-a18c-04bd9c44e0ce?source=cve; https://plugins.trac.wordpress.org/changeset/3116941/wp-event-manager/trunk/shortcodes/wp-event-manager-shortcodes.php
CVE: CVE-2024-3587
Published: 2024-07-16
Description: The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portfolios Widget in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/auxin-portfolio/tags/2.3.2/public/templates/elements/recent-portfolio.php#L179; https://plugins.trac.wordpress.org/changeset/3115537/auxin-portfolio/trunk/public/templates/elements/recent-portfolio.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ea041b-f09d-4c62-aada-26afbc60b6f2?source=cve
CVE: CVE-2024-3779
Published: 2024-07-16
Description: Denial of service vulnerability present shortly after product installation or upgrade, potentially allowed an attacker to render ESET’s security product inoperable, provided non-default preconditions were met.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.eset.com/en/ca8688; https://support.eset.com/en/ca8688
CVE: CVE-2024-5852
Published: 2024-07-16
Description: The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'uploadpath' parameter of the wordpress_file_upload shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload limited files to arbitrary locations on the web server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118456%40wp-file-upload&new=3118456%40wp-file-upload&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/39bb69e0-fb18-4737-9eb7-bda2b5bc16a2?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118456%40wp-file-upload&new=3118456%40wp-file-upload&sfp_email=&sfph_mail=
CVE: CVE-2024-6565
Published: 2024-07-16
Description: The AForms — Form Builder for Price Calculator & Cost Estimation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.6. This is due to the plugin utilizing the aura library and allowing direct access to the phpunit test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/aforms-form-builder-for-price-calculator-cost-estimation/trunk/vendor/aura/payload-interface/phpunit.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118052%40aforms-form-builder-for-price-calculator-cost-estimation&new=3118052%40aforms-form-builder-for-price-calculator-cost-estimation&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/702261eb-4f85-4388-9f82-75476640e8ed?source=cve
CVE: CVE-2024-6570
Published: 2024-07-16
Description: The Glossary plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.26. This is due the plugin utilizing wpdesk and not preventing direct access to the test files along with display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3116269%40glossary-by-codeat&new=3116269%40glossary-by-codeat&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3116892%40glossary-by-codeat&new=3116892%40glossary-by-codeat&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118151%40glossary-by-codeat&new=3118151%40glossary-by-codeat&sfp_email=&sfph_mail=
CVE: CVE-2023-52886
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()

Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors():

BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011

CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351
 print_report mm/kasan/report.c:462 [inline]
 kasan_report+0x11c/0x130 mm/kasan/report.c:572
 read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
...
Allocated by task 758:
...
 __do_kmalloc_node mm/slab_common.c:966 [inline]
 __kmalloc+0x5e/0x190 mm/slab_common.c:979
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:680 [inline]
 usb_get_configuration+0x1f7/0x5170 drivers/usb/core/config.c:887
 usb_enumerate_device drivers/usb/core/hub.c:2407 [inline]
 usb_new_device+0x12b0/0x19d0 drivers/usb/core/hub.c:2545

As analyzed by Khazhy Kumykov, the cause of this bug is a race between
read_descriptors() and hub_port_init(): The first routine uses a field
in udev->descriptor, not expecting it to change, while the second
overwrites it.

Prior to commit 45bf39f8df7f ("USB: core: Don't hold device lock while
reading the "descriptors" sysfs file") this race couldn't occur,
because the routines were mutually exclusive thanks to the device
locking.  Removing that locking from read_descriptors() exposed it to
the race.

The best way to fix the bug is to keep hub_port_init() from changing
udev->descriptor once udev has been initialized and registered.
Drivers expect the descriptors stored in the kernel to be immutable;
we should not undermine this expectation.  In fact, this change should
have been made long ago.

So now hub_port_init() will take an additional argument, specifying a
buffer in which to store the device descriptor it reads.  (If udev has
not yet been initialized, the buffer pointer will be NULL and then
hub_port_init() will store the device descriptor in udev as before.)
This eliminates the data race responsible for the out-of-bounds read.

The changes to hub_port_init() appear more extensive than they really
are, because of indentation changes resulting from an attempt to avoid
writing to other parts of the usb_device structure after it has been
initialized.  Similar changes should be made to the code that reads
the BOS descriptor, but that can be handled in a separate patch later
on.  This patch is sufficient to fix the bug found by syzbot.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-125
References: https://git.kernel.org/stable/c/7fe9d87996062f5eb0ca476ad0257f79bf43aaf5; https://git.kernel.org/stable/c/8186596a663506b1124bede9fde6f243ef9f37ee; https://git.kernel.org/stable/c/9d241c5d9a9b7ad95c90c6520272fe404d5ac88f
CVE: CVE-2024-39887
Published: 2024-07-16
Description: An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection.

This issue affects Apache Superset: before 4.0.2.

Users are recommended to upgrade to version 4.0.2, which fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2024/07/16/5; https://lists.apache.org/thread/j55vm41jg3l0x6w49zrmvbf3k0ts5fqz; http://www.openwall.com/lists/oss-security/2024/07/16/5