deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-29086
Published: 2024-04-02
Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker cause DOS through stack overflow.
CVSS Score: 3.3 (LOW)
CWE: CWE-770, CWE-770
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md
CVE: CVE-2024-29276
Published: 2024-04-02
Description: An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.class component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.cnblogs.com/Rainy-Day/p/18061399; https://www.cnblogs.com/Rainy-Day/p/18061399
CVE: CVE-2024-2839
Published: 2024-04-02
Description: The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode in all versions up to, and including, 1.0.263 due to insufficient input sanitization and output escaping on user supplied attributes such as 'heading_type'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3061940/colibri-page-builder/trunk/extend-builder/shortcodes/blog/post-item.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c9466e5f-d8eb-4de4-a1d2-e5ef15bf1e4e?source=cve; https://plugins.trac.wordpress.org/changeset/3061940/colibri-page-builder/trunk/extend-builder/shortcodes/blog/post-item.php
CVE: CVE-2024-2925
Published: 2024-04-02
Description: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in all versions up to, and including, 2.8.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/tags/2.8.0.4/modules/button/includes/frontend.php; https://plugins.trac.wordpress.org/changeset/3062187/beaver-builder-lite-version/trunk/modules/button/includes/frontend.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d311170c-db2b-4c23-aa43-98d7e92839bb?source=cve
CVE: CVE-2024-1300
Published: 2024-04-02
Description: A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-772
References: https://access.redhat.com/errata/RHSA-2024:1662; https://access.redhat.com/errata/RHSA-2024:1706; https://access.redhat.com/errata/RHSA-2024:1923
CVE: CVE-2024-20799
Published: 2024-04-02
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html
CVE: CVE-2024-31002
Published: 2024-04-02
Description: Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4 BitReader::ReadCache() at Ap4Utils.cpp component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/axiomatic-systems/Bento4/issues/939; https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-31002; https://github.com/axiomatic-systems/Bento4/issues/939
CVE: CVE-2024-31003
Published: 2024-04-02
Description: Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial at Ap4ByteStream.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/axiomatic-systems/Bento4/issues/939; https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-31003; https://github.com/axiomatic-systems/Bento4/issues/939
CVE: CVE-2024-31004
Published: 2024-04-02
Description: An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mp4fragment.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/axiomatic-systems/Bento4/issues/941; https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-31004; https://github.com/axiomatic-systems/Bento4/issues/941
CVE: CVE-2024-31005
Published: 2024-04-02
Description: An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp,AP4_MdhdAtom::AP4_MdhdAtom,mp4fragment
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://github.com/axiomatic-systems/Bento4/issues/941; https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-31005; https://github.com/axiomatic-systems/Bento4/issues/941
CVE: CVE-2024-2931
Published: 2024-04-02
Description: The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpfront_user_role_editor_assign_roles_user_autocomplete AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract retrieve a list of all user email addresses who are registered on the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://inky-knuckle-2c2.notion.site/WPFront-User-Role-Editor-Information-disclosure-7435b8340a004f5f8485cad375326b2c; https://plugins.trac.wordpress.org/changeset/3061241/wpfront-user-role-editor/trunk/includes/users/class-assign-migrate.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/078a0647-fc3a-436c-bf00-8776b16e66ff?source=cve
CVE: CVE-2024-1732
Published: 2024-04-02
Description: The Sharkdropship for AliExpress Dropshipping and Affiliate plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wads_removeProductFromShop() function in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to delete arbitrary posts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059375%40wooshark-aliexpress-importer&new=3059375%40wooshark-aliexpress-importer&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4a2e636d-e602-4ab0-80f2-525a8a1f8388?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059375%40wooshark-aliexpress-importer&new=3059375%40wooshark-aliexpress-importer&sfp_email=&sfph_mail=
CVE: CVE-2024-1807
Published: 2024-04-02
Description: The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the psad_update_product_cat_custom_meta_ajax function in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to hide product categories.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/woocommerce-product-sort-and-display/trunk/classes/class-wc-psad-admin-hook.php#L306; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3055823%40woocommerce-product-sort-and-display&new=3055823%40woocommerce-product-sort-and-display&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c8bd778b-1d56-4544-b2c3-a77a7ec05aa4?source=cve
CVE: CVE-2024-1946
Published: 2024-04-02
Description: The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059862%40genesis-blocks&new=3059862%40genesis-blocks&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ce116ee1-f0ea-469b-8c17-8c17c76fdc66?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059862%40genesis-blocks&new=3059862%40genesis-blocks&sfp_email=&sfph_mail=
CVE: CVE-2024-2745
Published: 2024-04-02
Description: Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded.  This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc.  
 
The vulnerability is remediated in version 6.6.244. 


CVSS Score: 3.3 (LOW)
CWE: CWE-598
References: https://docs.rapid7.com/release-notes/insightvm/20240327/; https://docs.rapid7.com/release-notes/insightvm/20240327/
CVE: CVE-2023-51452
Published: 2024-04-02
Description: A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service through a crafted payload triggering a missing input size check in the pull_file_v2_proc function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, compromising it in a term of availability and producing a denial-of-service attack. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
CVSS Score: 3.0 (LOW)
CWE: CWE-787
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51452/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51452/
CVE: CVE-2023-51453
Published: 2024-04-02
Description: A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service through a crafted payload triggering a missing input size check in the process_push_file function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, compromising it in a term of availability and producing a denial-of-service attack. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
CVSS Score: 3.0 (LOW)
CWE: CWE-787
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51453/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51453/
CVE: CVE-2023-51454
Published: 2024-04-02
Description: A Out-of-bounds Write issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to overwrite a pointer in the process memory through a crafted payload triggering an unsafe memory write operation in the my_tcp_receive function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, potentially leading to a memory information leak or to an arbitrary code execution. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51454/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51454/
CVE: CVE-2023-51455
Published: 2024-04-02
Description: A Improper Validation of Array Index issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to corrupt a controlled memory location due to a missing input validation in the on_receive_session_packet_ack function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, potentially leading to a memory information leak or to an arbitrary code execution. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-129
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51455/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51455/
CVE: CVE-2023-51456
Published: 2024-04-02
Description: A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to trigger an out-of-bound read/write into the process memory through a crafted payload due to a missing input sanity check in the v2_pack_array_to_msg function implemented in the libv2_sdk.so library imported by the v2_sdk_service binary implementing the service, potentially leading to a memory information leak or an arbitrary code execution. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51456/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-51456/
CVE: CVE-2023-6948
Published: 2024-04-02
Description: A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service through a crafted payload triggering a missing input size check in the sdk_printf function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, compromising it in a term of availability and producing a denial-of-service attack. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
CVSS Score: 3.0 (LOW)
CWE: CWE-120, CWE-120
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6948/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6948/
CVE: CVE-2023-6949
Published: 2024-04-02
Description: A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal or external memory without requiring any kind of authentication.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6949/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6949/
CVE: CVE-2023-6950
Published: 2024-04-02
Description: An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a malicious packet containing a malformed path provided to the FTP SIZE command that leads to a denial-of-service attack of the FTP service itself.
CVSS Score: 3.0 (LOW)
CWE: CWE-1286
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6950/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6950/
CVE: CVE-2023-6951
Published: 2024-04-02
Description: A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-334
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951/; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951/
CVE: CVE-2024-29947
Published: 2024-04-02
Description: There is a NULL dereference pointer vulnerability in some Hikvision NVRs. Due to an insufficient validation of a parameter in a message, an attacker may send specially crafted messages to an affected product, causing a process abnormality. 
CVSS Score: 2.7 (LOW)
CWE: CWE-476
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-nvr-devices/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-nvr-devices/
CVE: CVE-2024-29948
Published: 2024-04-02
Description: There is an out-of-bounds read vulnerability in some Hikvision NVRs. An authenticated attacker could exploit this vulnerability by sending specially crafted messages to a vulnerable device, causing a service abnormality.
CVSS Score: 3.8 (LOW)
CWE: CWE-125
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-nvr-devices/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-nvr-devices/
CVE: CVE-2024-29949
Published: 2024-04-02
Description: There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-nvr-devices/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-nvr-devices/
CVE: CVE-2023-50313
Published: 2024-04-02
Description: IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration.  IBM X-Force ID:  274812.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/274812; https://www.ibm.com/support/pages/node/7145620; https://exchange.xforce.ibmcloud.com/vulnerabilities/274812
CVE: CVE-2024-29514
Published: 2024-04-02
Description: File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/zzq66/cve6/; https://github.com/zzq66/cve6/
CVE: CVE-2024-2389
Published: 2024-04-02
Description: In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.  An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]8733-CVE-2024-2389-Flowmon-critical-security-vulnerability; https://www.flowmon.com; https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]8733-CVE-2024-2389-Flowmon-critical-security-vulnerability
CVE: CVE-2024-30946
Published: 2024-04-02
Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co_do.php.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/testgo1safe/cms/blob/main/1.md; https://github.com/testgo1safe/cms/blob/main/1.md
CVE: CVE-2024-30620
Published: 2024-04-02
Description: Tenda AX1803 v1.0.0.1 contains a stack overflow via the serviceName parameter in the function fromAdvSetMacMtuWan.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: https://github.com/re1wn/IoT_vuln/blob/main/Tenda_AX1803_v1.0.0.1_contains_a_stack_overflow_via_the_serviceName_parameter_in_the_function_fromAdvSetMacMtuWan.md; https://github.com/re1wn/IoT_vuln/blob/main/Tenda_AX1803_v1.0.0.1_contains_a_stack_overflow_via_the_serviceName_parameter_in_the_function_fromAdvSetMacMtuWan.md
CVE: CVE-2024-30621
Published: 2024-04-02
Description: Tenda AX1803 v1.0.0.1 contains a stack overflow via the serverName parameter in the function fromAdvSetMacMtuWan.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/re1wn/IoT_vuln/blob/main/Tenda_AX1803_v1.0.0.1_contains_a_stack_overflow_via_the_serverName_parameter_in_the_function_fromAdvSetMacMtuWan.md; https://github.com/re1wn/IoT_vuln/blob/main/Tenda_AX1803_v1.0.0.1_contains_a_stack_overflow_via_the_serverName_parameter_in_the_function_fromAdvSetMacMtuWan.md
CVE: CVE-2024-30965
Published: 2024-04-02
Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Fishkey1/cms/commit/e9d294951ab2dd85709f1d12ad4747f25d326b1b; https://github.com/Fishkey1/cms/tree/main; https://github.com/Fishkey1/cms/commit/e9d294951ab2dd85709f1d12ad4747f25d326b1b
CVE: CVE-2024-22780
Published: 2024-04-02
Description: Cross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the errmsg parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://ca17.com; https://fuo.fi/CVE-2024-22780/; https://github.com/CA17/TeamsACS
CVE: CVE-2024-30248
Published: 2024-04-02
Description: Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79
References: https://github.com/piccolo-orm/piccolo_admin/commit/c419575c2467959d906154084d305648eb2b8faf; https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-pmww-v6c9-7p83; https://github.com/piccolo-orm/piccolo_admin/commit/c419575c2467959d906154084d305648eb2b8faf
CVE: CVE-2024-22246
Published: 2024-04-02
Description: VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.

A malicious actor with local access to the Edge Router UI during 
activation may be able to perform a command injection attack that could 
lead to full control of the router. 


CVSS Score: 7.4 (HIGH)
CWE: CWE-77
References: https://www.vmware.com/security/advisories/VMSA-2024-0008.html; https://www.vmware.com/security/advisories/VMSA-2024-0008.html