deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-44147
Published: 2024-09-17
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An app may gain unauthorized access to Local Network.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-44148
Published: 2024-09-17
Description: This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.
CVSS Score: 10.0 (CRITICAL)
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44149
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281, CWE-281
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44151
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44152
Published: 2024-09-17
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44153
Published: 2024-09-17
Description: The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44154
Published: 2024-09-17
Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously crafted file may lead to unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44158
Published: 2024-09-17
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. A shortcut may output sensitive user data without consent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121246
CVE: CVE-2024-44160
Published: 2024-09-17
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Processing a maliciously crafted texture may lead to unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-400
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44161
Published: 2024-09-17
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Processing a maliciously crafted texture may lead to unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44162
Published: 2024-09-17
Description: This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://support.apple.com/en-us/121239; http://seclists.org/fulldisclosure/2024/Sep/38
CVE: CVE-2024-44163
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. A malicious application may be able to access private information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44164
Published: 2024-09-17
Description: This issue was addressed with improved checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to bypass Privacy preferences.
CVSS Score: 7.1 (HIGH)
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121246
CVE: CVE-2024-44165
Published: 2024-09-17
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2. Network traffic may leak outside a VPN tunnel.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121246
CVE: CVE-2024-44166
Published: 2024-09-17
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44167
Published: 2024-09-17
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2. An app may be able to overwrite arbitrary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44168
Published: 2024-09-17
Description: A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-427, CWE-114
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44169
Published: 2024-09-17
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, tvOS 18, visionOS 2, watchOS 11. An app may be able to cause unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240
CVE: CVE-2024-44170
Published: 2024-09-17
Description: A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, watchOS 11. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240; https://support.apple.com/en-us/121250
CVE: CVE-2024-44171
Published: 2024-09-17
Description: This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, watchOS 11. An attacker with physical access to a locked device may be able to Control Nearby Devices via accessibility features.
CVSS Score: 4.6 (MEDIUM)
References: https://support.apple.com/en-us/121240; https://support.apple.com/en-us/121246; https://support.apple.com/en-us/121250
CVE: CVE-2024-44176
Published: 2024-09-17
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, tvOS 18, visionOS 2, watchOS 11. Processing an image may lead to a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240
CVE: CVE-2024-44177
Published: 2024-09-17
Description: A privacy issue was addressed by removing sensitive data. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44178
Published: 2024-09-17
Description: This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59, CWE-787
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44180
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to access contacts from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-44181
Published: 2024-09-17
Description: An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44182
Published: 2024-09-17
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to access sensitive data logged when a shortcut fails to launch another app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44183
Published: 2024-09-17
Description: A logic error was addressed with improved error handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, tvOS 18, visionOS 2, watchOS 11. An app may be able to cause a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240
CVE: CVE-2024-44184
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121246
CVE: CVE-2024-44186
Published: 2024-09-17
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44187
Published: 2024-09-17
Description: A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240; https://support.apple.com/en-us/121241
CVE: CVE-2024-44188
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44189
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. A logic issue existed where a process may be able to capture screen contents without user consent.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44190
Published: 2024-09-17
Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to read arbitrary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44191
Published: 2024-09-17
Description: This issue was addressed through improved state management. This issue is fixed in Xcode 16, iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. An app may gain unauthorized access to Bluetooth.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121239; https://support.apple.com/en-us/121240
CVE: CVE-2024-44198
Published: 2024-09-17
Description: An integer overflow was addressed through improved input validation. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240; https://support.apple.com/en-us/121248
CVE: CVE-2024-44202
Published: 2024-09-17
Description: An authentication issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18. Private Browsing tabs may be accessed without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://support.apple.com/en-us/121241; https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-45496
Published: 2024-09-17
Description: A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An attacker with developer-level access can provide a crafted .gitconfig file containing commands executed during the cloning process, leading to arbitrary command execution on the worker node. An attacker running code in a privileged container could escalate their permissions on the node running the container.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269
References: https://access.redhat.com/errata/RHSA-2024:3718; https://access.redhat.com/errata/RHSA-2024:6685; https://access.redhat.com/errata/RHSA-2024:6687
CVE: CVE-2024-7387
Published: 2024-09-17
Description: A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-250
References: https://access.redhat.com/errata/RHSA-2024:3718; https://access.redhat.com/errata/RHSA-2024:6685; https://access.redhat.com/errata/RHSA-2024:6687
CVE: CVE-2024-8110
Published: 2024-09-17
Description: Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer.
If a computer on which the affected product is installed receives a large number of UDP broadcast packets in a short period, occasionally that computer may restart.
If both the active and standby computers are restarted at the same time, the functionality on that computer may be temporarily unavailable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252
References: https://web-material3.yokogawa.com/1/36276/files/YSAR-24-0003-E.pdf
CVE: CVE-2024-5170
Published: 2024-09-17
Description: The Logo Manager For Enamad WordPress plugin through 0.7.1 does not sanitise and escape in its widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/37b5ed06-0633-49e0-b47d-8aa2f4510179/
CVE: CVE-2024-8043
Published: 2024-09-17
Description: The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/2ba27715-add4-4e2c-ad0d-83ebdc26aec1/
CVE: CVE-2024-8044
Published: 2024-09-17
Description: The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/14b42ba8-7a8b-4fbf-86fb-6095879ec05c/
CVE: CVE-2024-8047
Published: 2024-09-17
Description: The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/0ae1474c-9193-48ee-8cf6-d19900ad95f4/
CVE: CVE-2024-8051
Published: 2024-09-17
Description: The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/d5edf7ed-207c-48bb-9226-8647ad4348e4/
CVE: CVE-2024-8052
Published: 2024-09-17
Description: The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/d821a6d0-d749-4e02-9b7c-3065e66e1c97/
CVE: CVE-2024-8091
Published: 2024-09-17
Description: The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1ca90b81-7539-4a15-8c5a-39a8d96a74a2/
CVE: CVE-2024-8092
Published: 2024-09-17
Description: The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/d5a91ceb-8a92-4f99-b7b7-1c4e0a587022/
CVE: CVE-2024-8093
Published: 2024-09-17
Description: The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/c7fd690a-5f02-491c-a3fb-6eac9ffffe96/
CVE: CVE-2024-8490
Published: 2024-09-17
Description: The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'save_account_details' function. This makes it possible for unauthenticated attackers to edit the name, email address, and password of an administrator account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/propertyhive/tags/2.0.19/includes/class-ph-ajax.php#L1089; https://plugins.trac.wordpress.org/browser/propertyhive/tags/2.0.19/includes/class-ph-ajax.php#L976; https://plugins.trac.wordpress.org/changeset/3152548/
CVE: CVE-2024-8761
Published: 2024-09-17
Description: The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. This is due to insufficient validation on the redirect url supplied via the link parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS Score: 7.2 (HIGH)
CWE: CWE-601
References: https://plugins.trac.wordpress.org/browser/share-this-image/tags/2.03/assets/js/sti.js#L693; https://plugins.trac.wordpress.org/browser/share-this-image/tags/2.03/includes/class-sti-shortlink.php#L64; https://plugins.trac.wordpress.org/browser/share-this-image/tags/2.03/includes/class-sti-shortlink.php#L74
CVE: CVE-2024-8767
Published: 2024-09-17
Description: Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-250
References: https://security-advisory.acronis.com/advisories/SEC-4976
CVE: CVE-2024-5998
Published: 2024-09-17
Description: A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7; https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
CVE: CVE-2024-46085
Published: 2024-09-17
Description: FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/rename
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/RainingSEC/cms/tree/main/11/readme.md
CVE: CVE-2024-46362
Published: 2024-09-17
Description: FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_directory
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ohuquq/cms/tree/main/13/readme.md