deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45510
Published: 2024-11-20
Description: An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper sanitization of user input. This allows an attacker to inject malicious code into specific fields of an e-mail message. When the victim adds the attacker to their contacts, the malicious code is stored and executed when viewing the contact list. This can lead to unauthorized actions such as arbitrary mail sending, mailbox exfiltration, profile picture alteration, and other malicious actions. Proper sanitization and escaping of input fields are necessary to mitigate this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
CVE: CVE-2024-48981
Published: 2024-11-20
Description: An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet header by looking up the identifying first byte and matching it against a table of possible lengths. The initial parsing function, hciTrSerialRxIncoming does not drop packets with invalid identifiers but also does not set a safe default for the length of unknown packets' headers, leading to a buffer overflow. This can be leveraged into an arbitrary write by an attacker. It is possible to overwrite the pointer to a not-yet-allocated buffer that is supposed to receive the contents of the packet body. One can then overwrite the state variable used by the function to determine which state of packet parsing is currently occurring. Because the buffer is allocated when the last byte of the header has been copied, the combination of having a bad header length variable that will never match the counter variable and being able to overwrite the state variable with the resulting buffer overflow can be used to advance the function to the next step while skipping the buffer allocation and resulting pointer write. The next 16 bytes from the packet body are then written wherever the corrupted data pointer is pointing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/source/cordio/stack_adaptation/hci_tr.c#L161; https://github.com/mbed-ce/mbed-os/pull/374
CVE: CVE-2024-48983
Published: 2024-11-20
Description: An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet header. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier plus the header length. WsfMsgAlloc then increments this again by sizeof(wsfMsg_t). This may cause an integer overflow that results in the buffer being significantly too small to contain the entire packet. This may cause a buffer overflow of up to 65 KB . This bug is trivial to exploit for a denial of service but can generally not be exploited further because the exploitable buffer is dynamically allocated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/wsf/sources/port/baremetal/wsf_msg.c#L72; https://github.com/mbed-ce/mbed-os/pull/388
CVE: CVE-2024-48985
Published: 2024-11-20
Description: An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet data. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier and the header length. If the allocate fails because the specified packet is too large, no exception handling occurs and hciTrSerialRxIncoming continues to write bytes into the 4-byte large temporary header buffer, leading to a buffer overflow. This can be leveraged into an arbitrary write by an attacker. It is possible to overwrite the pointer to the buffer that is supposed to receive the contents of the packet body but which couldn't be allocated. One can then overwrite the state variable used by the function to determine which step of the parsing process is currently being executed. This advances the function to the next state, where it proceeds to copy data to that arbitrary location. The packet body is then written wherever the corrupted data pointer is pointing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/source/cordio/stack_adaptation/hci_tr.c#L200; https://github.com/mbed-ce/mbed-os/pull/384
CVE: CVE-2024-52754
Published: 2024-11-20
Description: D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile_htm function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-120
References: https://github.com/faqiadegege/IoTVuln/blob/main/DI_8003_tgfile_htm_stackoverflow/detail.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-52757
Published: 2024-11-20
Description: D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the notify parameter in the arp_sys_asp function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-120
References: https://github.com/faqiadegege/IoTVuln/blob/main/DI_8003_arp_sys_asp_stackoverflow/detail.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48530
Published: 2024-11-20
Description: An issue in the Instructor Appointment Availability module of eSoft Planner 3.24.08271-USA allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/esoft-planner-cve/esoft_planner_cve
CVE: CVE-2024-48531
Published: 2024-11-20
Description: A reflected cross-site scripting (XSS) vulnerability on the Rental Availability module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/esoft-planner-cve/esoft_planner_cve
CVE: CVE-2024-48533
Published: 2024-11-20
Description: A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enumerate valid user e-mail accounts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://github.com/esoft-planner-cve/esoft_planner_cve
CVE: CVE-2024-48534
Published: 2024-11-20
Description: A reflected cross-site scripting (XSS) vulnerability on the Camp Details module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/esoft-planner-cve/esoft_planner_cve
CVE: CVE-2024-48535
Published: 2024-11-20
Description: A stored cross-site scripting (XSS) vulnerability in eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/esoft-planner-cve/esoft_planner_cve
CVE: CVE-2024-48536
Published: 2024-11-20
Description: Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a crafted web request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/esoft-planner-cve/esoft_planner_cve
CVE: CVE-2024-48982
Published: 2024-11-20
Description: An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. This value is assumed to be greater than or equal to 3, but the software doesn't ensure that this is the case. Supplying a length less than 3 leads to a buffer overflow in a buffer that is allocated later. It is simultaneously possible to cause another integer overflow by supplying large length values because the provided length value is increased by a few bytes to account for additional information that is supposed to be stored there. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L2748; https://github.com/mbed-ce/mbed-os/pull/386
CVE: CVE-2024-48984
Published: 2024-11-20
Description: An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading a byte from an input stream. It then fetches the length of the first report, uses it to calculate the beginning of the second report, etc. In doing this, it tracks the largest report so it can later allocate a buffer that fits every individual report (but only one at a time). It does not, however, validate that these addresses are all contained within the buffer passed to hciEvtProcessLeExtAdvReport. It is then possible, though unlikely, that the buffer designated to hold the reports is allocated in such a way that one of these out-of-bounds length fields is contained within the new buffer. When the (n-1)th report is copied, it overwrites the length field of the nth report. This now corrupted length field is then used for a memcpy into the new buffer, which may lead to a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L1317; https://github.com/mbed-ce/mbed-os/pull/387
CVE: CVE-2024-48986
Published: 2024-11-20
Description: An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L3018; https://github.com/mbed-ce/mbed-os/pull/385
CVE: CVE-2024-49203
Published: 2024-11-20
Description: Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.
References: https://github.com/OpenFeign/querydsl/; https://github.com/OpenFeign/querydsl/pull/742; https://github.com/OpenFeign/querydsl/pull/743
CVE: CVE-2024-52581
Published: 2024-11-20
Description: Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to upload arbitrary large files wrapped in a `multipart/form-data` request and cause excessive memory consumption on the server. The multipart form parser in affected versions is vulnerable to this type of attack by design. The public method signature as well as its implementation both expect the entire request body to be available as a single byte string. It is not possible to accept large file uploads in a safe way using this parser. This may be a regression, as a variation of this issue was already reported in CVE-2023-25578. Limiting the part number is not sufficient to prevent out-of-memory errors on the server. A patch is available in version 2.13.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/litestar-org/litestar/blob/main/litestar/_multipart.py#L97; https://github.com/litestar-org/litestar/commit/53c1473b5ff7502816a9a339ffc90731bb0c2138; https://github.com/litestar-org/litestar/security/advisories/GHSA-gjcc-jvgw-wvwj
CVE: CVE-2024-52677
Published: 2024-11-20
Description: HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/J-0k3r/CVE-2024-52677; https://github.com/J-0k3r/test/blob/main/upload.pdf; https://github.com/advisories/ghsa-j27h-7c89-c3c6
CVE: CVE-2024-52701
Published: 2024-11-20
Description: A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Piwigo/Piwigo/issues/2261
CVE: CVE-2024-52702
Published: 2024-11-20
Description: A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name parameter. NOTE: this is disputed by the Supplier because Website Name can only be set by an administrator, who may use JavaScript if they wish.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mybb/mybb/issues/4859; https://github.com/mybb/mybb/issues/4859#issuecomment[PII_REDACTED]
CVE: CVE-2024-52765
Published: 2024-11-20
Description: H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://tjr181.com/2024/11/08/H3C%20GR-1800AX/
CVE: CVE-2024-51151
Published: 2024-11-21
Description: D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://github.com/faqiadegege/IoTVuln/blob/main/DI_8200_msp_info_htm_rce/detail.md
CVE: CVE-2024-52755
Published: 2024-11-21
Description: D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the host_ip parameter in the ipsec_road_asp function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-120
References: https://github.com/faqiadegege/IoTVuln/blob/main/DI_8003_jingx_asp_stackoverflow/detail.md
CVE: CVE-2024-9875
Published: 2024-11-21
Description: Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://help.okta.com/asa/en-us/content/topics/releasenotes/advanced-server-access-release-notes.htm
CVE: CVE-2022-43933
Published: 2024-11-21
Description: An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an admin user troubleshooting the switch. The Logged information may include usernames and passwords, and secret keys.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-538, CWE-532
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21221
CVE: CVE-2022-43934
Published: 2024-11-21
Description: Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21220
CVE: CVE-2022-43935
Published: 2024-11-21
Description: An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch passwords and authorization IDs are printed in the embedded MLS DB file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21219
CVE: CVE-2022-43936
Published: 2024-11-21
Description: Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21218
CVE: CVE-2022-43937
Published: 2024-11-21
Description: Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Brocade SANnav before 2.3.0 and 2.2.2a
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22509; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-10164
Published: 2024-11-21
Description: The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdmpp_pay_link shortcode in all versions up to, and including, 5.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3193172/wpdm-premium-packages/trunk/includes/libs/ShortCodes.php; https://wordpress.org/plugins/wpdm-premium-packages/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/0c1758fc-5b0b-4071-b31b-1d72e34cc924?source=cve
CVE: CVE-2024-10172
Published: 2024-11-21
Description: The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's void_wbwhmcse_laouts_search shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204359%40void-visual-whmcs-element&new=3204359%40void-visual-whmcs-element&sfp_email=&sfph_mail=; https://wordpress.org/plugins/void-visual-whmcs-element/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4b52c6-1ac2-4f90-a776-c91232f5de34?source=cve
CVE: CVE-2024-10177
Published: 2024-11-21
Description: The Beds24 Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's beds24-link shortcode in all versions up to, and including, 2.0.27 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193719%40beds24-online-booking&new=3193719%40beds24-online-booking&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3197034%40beds24-online-booking&new=3197034%40beds24-online-booking&sfp_email=&sfph_mail=; https://wordpress.org/plugins/beds24-online-booking/#developers
CVE: CVE-2024-10316
Published: 2024-11-21
Description: The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/templates/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3189021; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a1cf60b-47bd-4e67-8fe4-6cf46809f2b2?source=cve
CVE: CVE-2024-10393
Published: 2024-11-21
Description: The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3186319/tutor; https://www.wordfence.com/threat-intel/vulnerabilities/id/bf8aa169-df51-46db-8c65-f1543d4f75f9?source=cve
CVE: CVE-2024-10400
Published: 2024-11-21
Description: The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3186319/tutor; https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf37d4e-e94a-4046-9949-c208e4e70197?source=cve
CVE: CVE-2024-10403
Published: 2024-11-21
Description: Brocade Fabric OS versions before 
8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can 
capture the SFTP/FTP server password used for a firmware download 
operation initiated by SANnav or through WebEM in a weblinker core dump 
that is later captured via supportsave.
CVSS Score: 7.5 (HIGH)
CWE: CWE-528, CWE-552
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25145
CVE: CVE-2024-10482
Published: 2024-11-21
Description: The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO  WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/46cbd4bb-b6f3-49e8-8d79-8c378c617e7c/