deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-37234
Published: 2024-07-06
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/academy/wordpress-academy-lms-plugin-2-0-2-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/academy/wordpress-academy-lms-plugin-2-0-2-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-37260
Published: 2024-07-06
Description: Server-Side Request Forgery (SSRF) vulnerability in Theme-Ruby Foxiz.This issue affects Foxiz: from n/a through 2.3.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/foxiz/wordpress-foxiz-theme-theme-2-3-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/foxiz/wordpress-foxiz-theme-theme-2-3-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-39486
Published: 2024-07-06
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/drm_file: Fix pid refcounting race

<maarten.lankhorst@linux.intel.com>, Maxime Ripard
<mripard@kernel.org>, Thomas Zimmermann <tzimmermann@suse.de>

filp->pid is supposed to be a refcounted pointer; however, before this
patch, drm_file_update_pid() only increments the refcount of a struct
pid after storing a pointer to it in filp->pid and dropping the
dev->filelist_mutex, making the following race possible:

process A               process B
=========               =========
                        begin drm_file_update_pid
                        mutex_lock(&dev->filelist_mutex)
                        rcu_replace_pointer(filp->pid, <pid B>, 1)
                        mutex_unlock(&dev->filelist_mutex)
begin drm_file_update_pid
mutex_lock(&dev->filelist_mutex)
rcu_replace_pointer(filp->pid, <pid A>, 1)
mutex_unlock(&dev->filelist_mutex)
get_pid(<pid A>)
synchronize_rcu()
put_pid(<pid B>)   *** pid B reaches refcount 0 and is freed here ***
                        get_pid(<pid B>)   *** UAF ***
                        synchronize_rcu()
                        put_pid(<pid A>)

As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=y
because it requires RCU to detect a quiescent state in code that is not
explicitly calling into the scheduler.

This race leads to use-after-free of a "struct pid".
It is probably somewhat hard to hit because process A has to pass
through a synchronize_rcu() operation while process B is between
mutex_unlock() and get_pid().

Fix it by ensuring that by the time a pointer to the current task's pid
is stored in the file, an extra reference to the pid has been taken.

This fix also removes the condition for synchronize_rcu(); I think
that optimization is unnecessary complexity, since in that case we
would usually have bailed out on the lockless check above.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0acce2a5c619ef1abdee783d7fea5eac78ce4844; https://git.kernel.org/stable/c/16682588ead4a593cf1aebb33b36df4d1e9e4ffa; https://git.kernel.org/stable/c/4f2a129b33a2054e62273edd5a051c34c08d96e9
CVE: CVE-2024-37539
Published: 2024-07-06
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-todo/wordpress-wp-to-do-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-todo/wordpress-wp-to-do-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37541
Published: 2024-07-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StaxWP Elementor Addons, Widgets and Enhancements – Stax stax-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor Addons, Widgets and Enhancements – Stax: from n/a through <= 1.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/stax-addons-for-elementor/vulnerability/wordpress-elementor-addons-widgets-and-enhancements-stax-plugin-1-4-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stax-addons-for-elementor/wordpress-elementor-addons-widgets-and-enhancements-stax-plugin-1-4-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37542
Published: 2024-07-06
Description: Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-3-broken-access-control-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-3-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2024-37546
Published: 2024-07-06
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Image Hover Effects - Caption Hover with Carousel allows Stored XSS.This issue affects Image Hover Effects - Caption Hover with Carousel: from n/a through 3.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/image-hover-effects-with-carousel/wordpress-image-hover-effects-for-elementor-with-lightbox-and-flipbox-plugin-3-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/image-hover-effects-with-carousel/wordpress-image-hover-effects-for-elementor-with-lightbox-and-flipbox-plugin-3-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37547
Published: 2024-07-06
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Livemesh Livemesh Addons for Elementor.This issue affects Livemesh Addons for Elementor: from n/a through 8.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/addons-for-elementor/wordpress-elementor-addons-by-livemesh-plugin-8-3-7-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/addons-for-elementor/wordpress-elementor-addons-by-livemesh-plugin-8-3-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-37553
Published: 2024-07-06
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/testimonials-widget/wordpress-testimonials-widget-plugin-4-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/testimonials-widget/wordpress-testimonials-widget-plugin-4-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37554
Published: 2024-07-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows DOM-Based XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultraaddons-elementor-lite/vulnerability/wordpress-ultraaddons-elementor-addons-header-footer-builder-custom-font-custom-css-woo-widget-menu-builder-anywhere-elementor-shortcode-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultraaddons-elementor-lite/wordpress-ultraaddons-elementor-addons-header-footer-builder-custom-font-custom-css-woo-widget-menu-builder-anywhere-elementor-shortcode-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-6095
Published: 2024-07-06
Description: A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://github.com/mudler/localai/commit/2fc6fe806b903ac0a70218b21b5c84443a1b0866; https://huntr.com/bounties/4799262d-72dc-43c8-bc99-81d0dce996dc; https://github.com/mudler/localai/commit/2fc6fe806b903ac0a70218b21b5c84443a1b0866
CVE: CVE-2024-40596
Published: 2024-07-07
Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. (TimelineService does not support properly suppressing.)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://phabricator.wikimedia.org/T326866; https://phabricator.wikimedia.org/T326866
CVE: CVE-2024-40597
Published: 2024-07-07
Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribute is not respected.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://phabricator.wikimedia.org/T326865; https://phabricator.wikimedia.org/T326865
CVE: CVE-2024-40598
Published: 2024-07-07
Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted attribute is not applied to entries.)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://phabricator.wikimedia.org/T326867; https://phabricator.wikimedia.org/T326867
CVE: CVE-2024-40599
Published: 2024-07-07
Description: An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://phabricator.wikimedia.org/T361448; https://phabricator.wikimedia.org/T361448
CVE: CVE-2024-40600
Published: 2024-07-07
Description: An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://phabricator.wikimedia.org/T361449; https://phabricator.wikimedia.org/T361449
CVE: CVE-2024-40601
Published: 2024-07-07
Description: An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://phabricator.wikimedia.org/T362588; https://phabricator.wikimedia.org/T362588
CVE: CVE-2024-40602
Published: 2024-07-07
Description: An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://phabricator.wikimedia.org/T361451; https://phabricator.wikimedia.org/T361451
CVE: CVE-2024-40603
Published: 2024-07-07
Description: An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://phabricator.wikimedia.org/T363884; https://phabricator.wikimedia.org/T363884
CVE: CVE-2024-40604
Published: 2024-07-07
Description: An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://phabricator.wikimedia.org/T361450; https://phabricator.wikimedia.org/T361450
CVE: CVE-2024-40605
Published: 2024-07-07
Description: An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://phabricator.wikimedia.org/T361452; https://phabricator.wikimedia.org/T361452
CVE: CVE-2024-40614
Published: 2024-07-07
Description: EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/EGroupware/egroupware/commit/553829d30cc2ccdc0e5a8c5a0e16fa03a3399a3f; https://github.com/EGroupware/egroupware/compare/23.1.20240430...23.1.20240624; https://github.com/EGroupware/egroupware/releases/tag/23.1.20240624
CVE: CVE-2024-6229
Published: 2024-07-07
Description: A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. Users can upload files via URL, which allows the insertion of malicious JavaScript payloads. These payloads are stored on the server and executed whenever any user clicks on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://huntr.com/bounties/2ee71e9e-2cf5-41a4-8440-d[PII_REDACTED]6; https://huntr.com/bounties/2ee71e9e-2cf5-41a4-8440-d[PII_REDACTED]6
CVE: CVE-2024-3651
Published: 2024-07-07
Description: A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d; https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb; https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
CVE: CVE-2024-6539
Published: 2024-07-07
Description: A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of the component Guestbook Handler. The manipulation of the argument Content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-270450 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/heyewei/SpringBootCMS/issues/IA9D7F; https://vuldb.com/?ctiid.270450; https://vuldb.com/?id.270450
CVE: CVE-2024-5711
Published: 2024-07-08
Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat input. This vulnerability is due to the lack of input validation and sanitization on both the frontend and backend components of the application. Specifically, the application fails to sanitize user input in the chat feature, leading to the execution of arbitrary JavaScript code in the context of the user's browser session. This issue affects all versions of the application. The impact of this vulnerability includes the potential for stolen credentials, extraction of sensitive information from chat logs, projects, and other data accessible through the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2; https://huntr.com/bounties/6c00ff84-574b-4b4f-bd58-aa7ec1809662; https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2
CVE: CVE-2024-39723
Published: 2024-07-08
Description: IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the USB port to cause loss of access to data.  IBM X-Force ID:  295935.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1299, CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/295935; https://www.ibm.com/support/pages/node/7159333; https://exchange.xforce.ibmcloud.com/vulnerabilities/295935
CVE: CVE-2024-38330
Published: 2024-07-08
Description: IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program call.  A malicious actor could cause user-controlled code to run with administrator privilege.  IBM X-Force ID:  295227.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/295227; https://www.ibm.com/support/pages/node/7159615; https://exchange.xforce.ibmcloud.com/vulnerabilities/295227
CVE: CVE-2024-31897
Published: 2024-07-08
Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.  IBM X-Force ID:  288178.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/288178; https://www.ibm.com/support/pages/node/7159332; https://exchange.xforce.ibmcloud.com/vulnerabilities/288178
CVE: CVE-2024-37528
Published: 2024-07-08
Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  294293.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/294293; https://www.ibm.com/support/pages/node/7159332; https://exchange.xforce.ibmcloud.com/vulnerabilities/294293
CVE: CVE-2024-34602
Published: 2024-07-08
Description: Use of implicit intent for sensitive communication in Samsung Messages prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. User interaction is required for triggering this vulnerability.
CVSS Score: 3.3 (LOW)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34603
Published: 2024-07-08
Description: Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-37389
Published: 2024-07-08
Description: Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.apache.org/thread/yso9fr0wtff53nk046h1o83hdyb1lrxh; http://www.openwall.com/lists/oss-security/2024/07/08/1; https://lists.apache.org/thread/yso9fr0wtff53nk046h1o83hdyb1lrxh
CVE: CVE-2024-24974
Published: 2024-07-08
Description: The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-923
References: https://community.openvpn.net/openvpn/wiki/CVE-2024-24974; https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/; https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html
CVE: CVE-2024-27459
Published: 2024-07-08
Description: The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://community.openvpn.net/openvpn/wiki/CVE-2024-27459; https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/; https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html
CVE: CVE-2024-27903
Published: 2024-07-08
Description: OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-283, CWE-434
References: https://community.openvpn.net/openvpn/wiki/CVE-2024-27903; https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/; https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html
CVE: CVE-2024-37999
Published: 2024-07-08
Description: A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application executes as a trusted account with high privileges and network access. This could allow an authenticated local attacker to escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-282
References: https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-501799; https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-501799
CVE: CVE-2024-6163
Published: 2024-07-08
Description: Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows remote attacker to bypass authentication and access data
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://checkmk.com/werk/17011; https://checkmk.com/werk/17011
CVE: CVE-2024-39742
Published: 2024-07-08
Description: IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability.  IBM X-Force ID:  297169.
CVSS Score: 8.1 (HIGH)
CWE: CWE-187, CWE-697
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/297169; https://www.ibm.com/support/pages/node/7159714; https://exchange.xforce.ibmcloud.com/vulnerabilities/297169
CVE: CVE-2024-39743
Published: 2024-07-08
Description: IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation.   A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  297172.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-405
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/297172; https://www.ibm.com/support/pages/node/7159714; https://exchange.xforce.ibmcloud.com/vulnerabilities/297172