deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-6917
Published: 2024-08-12
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection.This issue affects Veribase Order Management: before v4.010.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.usom.gov.tr/bildirim/tr-24-1105
CVE: CVE-2023-7249
Published: 2024-08-12
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows Path Traversal.This issue affects OpenText Directory Services: from 16.4.2 before 24.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0807814
CVE: CVE-2024-36877
Published: 2024-08-12
Description: Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7D25v14, 7D25v17 to 7D25v19, and 7D25v1A to 7D25v1H was discovered to contain a write-what-where condition in the in the SW handler for SMI 0xE3. Motherboard's with the following chipsets are affected: Intel 300, Intel 400, Intel 500, Intel 600, Intel 700, AMD 300, AMD 400, AMD 500, AMD 600 and AMD 700.
CVSS Score: 8.2 (HIGH)
CWE: CWE-123
References: https://csr.msi.com/global/product-security-advisories; https://jjensn.com/at-home-in-your-firmware/
CVE: CVE-2024-39091
Published: 2024-08-12
Description: An OS command injection vulnerability in the ccm_debug component of MIPC Camera firmware prior to v5.4.[PII_REDACTED]21 allows attackers within the same network to execute arbitrary code via a crafted HTML request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://joerngermany.github.io/mipc_vulnerability/
CVE: CVE-2024-41909
Published: 2024-08-12
Description: Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which 
some security features have been downgraded or disabled, aka a Terrapin 
attack

The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-354
References: https://github.com/apache/mina-sshd/issues/445; https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-42480
Published: 2024-08-12
Description: Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/clastix/kamaji/blob/8cdc6191242f80d120c46b166e2102d27568225a/internal/datastore/etcd.go#L19-L24; https://github.com/clastix/kamaji/commit/1731e8c2ed5148b125ecfbdf091ee177bd44f3db; https://github.com/clastix/kamaji/security/advisories/GHSA-6r4j-4rjc-8vw5
CVE: CVE-2024-42481
Published: 2024-08-12
Description: Skyport Daemon (skyportd) is the daemon for the Skyport Panel. By making thousands of folders & files (easy due to skyport's lack of rate limiting on createFolder. createFile), skyportd in a lot of cases will cause 100% CPU usage and an OOM, probably crashing the system. This is fixed in 0.2.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/skyportlabs/skyportd/security/advisories/GHSA-cwmq-phcx-9g92
CVE: CVE-2024-42482
Published: 2024-08-12
Description: fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the `pattern` input (specifically the command separator `;` and command substitution characters `(` and `)`) mean that arbitrary command injection is possible by modification of the input value used in a workflow. This has the potential for exposure or exfiltration of sensitive information from the workflow runner, such as might be achieved by sending environment variables to an external entity. It is recommended that users update to the patched version `v1.6.12` or the latest release version `v2.0.0`, however remediation may be possible through careful control of workflows and the `pattern` input value used by this action.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-140
References: https://github.com/fish-shop/syntax-check/commit/91e6817c48ad475542fe4e78139029b036a53b03; https://github.com/fish-shop/syntax-check/commit/c2cb11395e21119ff8d6e7ea050430ee7d6f49ca; https://github.com/fish-shop/syntax-check/security/advisories/GHSA-xj87-mqvh-88w2
CVE: CVE-2024-42485
Published: 2024-08-12
Description: Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL.  Patched with Version v2.3.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/pxlrbt/filament-excel/commit/bda42891a4b0c15d5dab5da8c53a006ddadccfb7; https://github.com/pxlrbt/filament-excel/security/advisories/GHSA-m3px-vjxr-fx4m
CVE: CVE-2024-42489
Published: 2024-08-12
Description: Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack. This vulnerability is fixed in 1.10.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Viewpdf.xml#L265-L267; https://github.com/xwikisas/xwiki-pro-macros/commit/199553c[PII_REDACTED]1a20614f093af2d57970eba; https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-cfq3-q227-7j65
CVE: CVE-2024-42628
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/5/readme.md
CVE: CVE-2024-42629
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/edit/10.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/2/readme.md
CVE: CVE-2024-42630
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/10/readme.md
CVE: CVE-2024-42631
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/7/readme.md
CVE: CVE-2024-42632
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/1/readme.md
CVE: CVE-2024-40500
Published: 2024-08-12
Description: Cross Site Scripting vulnerability in Martin Kucej i-librarian v.5.11.0 and before allows a local attacker to execute arbitrary code via the search function in the import component.
CVSS Score: 8.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://nitipoom-jar.github.io/CVE-2024-40500/; https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-40500
CVE: CVE-2024-41475
Published: 2024-08-12
Description: Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://gist.github.com/AkiaCode/7c878b[PII_REDACTED]46d6589d86b1e89
CVE: CVE-2024-41651
Published: 2024-08-12
Description: An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality. NOTE: this is disputed by multiple parties, who report that exploitation requires that an attacker be able to hijack network requests made by an admin user (who, by design, is allowed to change the code that is running on the server).
CVSS Score: 8.1 (HIGH)
CWE: CWE-918, CWE-94
References: https://github.com/Fckroun/CVE-2024-41651/tree/main
CVE: CVE-2024-42474
Published: 2024-08-12
Description: Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/streamlit/streamlit/commit/3a639859cfdfba2187c81897d44a3e33825eb0a3; https://github.com/streamlit/streamlit/security/advisories/GHSA-rxff-vr5r-8cj5
CVE: CVE-2024-42623
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/8/readme.md
CVE: CVE-2024-42624
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/3/readme.md
CVE: CVE-2024-42625
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/add
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/9/readme.md
CVE: CVE-2024-42626
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/4/readme.md
CVE: CVE-2024-42627
Published: 2024-08-12
Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Kirtoc/cms/tree/main/6/readme.md
CVE: CVE-2024-7700
Published: 2024-08-12
Description: A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://access.redhat.com/security/cve/CVE-2024-7700; https://bugzilla.redhat.com/show_bug.cgi?id=2304090
CVE: CVE-2024-42543
Published: 2024-08-12
Description: TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3700R/loginauth.md
CVE: CVE-2024-42545
Published: 2024-08-12
Description: TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the ssid parameter in setWizardCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3700R/setWizardCfg.md
CVE: CVE-2024-40892
Published: 2024-08-12
Description: A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID (though this is less likely).
CVSS Score: 7.1 (HIGH)
CWE: CWE-1391
References: https://vulncheck.com/advisories/firewalla-bt-weak-credentials; https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/
CVE: CVE-2024-40893
Published: 2024-08-12
Description: Multiple authenticated operating system (OS) command injection vulnerabilities exist in Firewalla Box Software 
versions before 1.979. A physically close 
attacker that is authenticated to the Bluetooth Low-Energy (BTLE) interface can use the network configuration service to inject commands in various configuration parameters including networkConfig.Interface.Phy.Eth0.Extra.PingTestIP, networkConfig.Interface.Phy.Eth0.Extra.DNSTestDomain, and networkConfig.Interface.Phy.Eth0.Gateway6. Additionally, because the configuration can be synced to the Firewalla cloud, the attacker may be able to persist access even after hardware resets and firmware re-flashes.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://vulncheck.com/advisories/firewalla-bt-command-injection; https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/
CVE: CVE-2024-41710
Published: 2024-08-12
Description: A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-88, CWE-88
References: https://github.com/kwburns/CVE/blob/main/Mitel/6.3.0.1020/README.md; https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0019
CVE: CVE-2024-42546
Published: 2024-08-12
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the password parameter in the loginauth function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3100R/loginauth_password.md
CVE: CVE-2024-42547
Published: 2024-08-12
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3100R/loginauth.md
CVE: CVE-2024-6768
Published: 2024-08-12
Description: A Denial of Service in CLFS.sys in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated low-privilege user to cause a Blue Screen of Death via a forced call to the KeBugCheckEx function.
CWE: CWE-1284
References: https://www.fortra.com/security/advisories/research/fr-2024-001; https://www.vicarius.io/vsociety/posts/cve-2024-6768-detection-script-blue-screen-of-death-vulnerability-affecting-microsoft-windows; https://www.vicarius.io/vsociety/posts/cve-2024-6768-mitigation-script-blue-screen-of-death-vulnerability-affecting-microsoft-windows
CVE: CVE-2023-41884
Published: 2024-08-12
Description: ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a; https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-2qp3-fwpv-mc96
CVE: CVE-2023-48171
Published: 2024-08-12
Description: An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://gccybermonks.com/posts/defectdojo/
CVE: CVE-2024-42741
Published: 2024-08-12
Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setL2tpServerCfg/setL2tpServerCfg.md
CVE: CVE-2024-42742
Published: 2024-08-12
Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setUrlFilterRules/setUrlFilterRules.md
CVE: CVE-2024-42743
Published: 2024-08-12
Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setSyslogCfg/setSyslogCfg.md
CVE: CVE-2024-42744
Published: 2024-08-12
Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setModifyVpnUser/setModifyVpnUser.md
CVE: CVE-2024-42745
Published: 2024-08-12
Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-94
References: https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setUPnPCfg/setUPnPCfg.md
CVE: CVE-2024-42747
Published: 2024-08-12
Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setWanIeCfg/setWanIeCfg.md
CVE: CVE-2024-42748
Published: 2024-08-12
Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setWiFiWpsCfg/setWiFiWpsCfg.md
CVE: CVE-2024-43227
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper BetterDocs allows Stored XSS.This issue affects BetterDocs: from n/a through 3.5.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/betterdocs/wordpress-betterdocs-best-documentation-faq-knowledge-base-plugin-with-ai-support-instant-answer-for-elementor-gutenberg-plugin-3-5-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43231
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43233
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky BSK Forms Blacklist allows Reflected XSS.This issue affects BSK Forms Blacklist: from n/a through 3.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bsk-gravityforms-blacklist/wordpress-bsk-forms-blacklist-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43358
Published: 2024-08-12
Description: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the filter view via the filter[Id]. This vulnerability is fixed in 1.36.34 and 1.37.61.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ZoneMinder/zoneminder/commit/062cf568a33fb6a8604ec327b1de8bb2e0d1ff77; https://github.com/ZoneMinder/zoneminder/commit/4602cd0470a3b90b18bcc44b3c86d963872d1ba0; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-6rrw-66rf-6g5f
CVE: CVE-2024-43359
Published: 2024-08-12
Description: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via the displayinterval, speed, and scale parameters. This vulnerability is fixed in 1.36.34 and 1.37.61.
CVSS Score: 0.0 (NONE)
CWE: CWE-79, CWE-79
References: https://github.com/ZoneMinder/zoneminder/commit/6cc64dddff6144a98680f65ecf8dc249028431af; https://github.com/ZoneMinder/zoneminder/commit/b51c5df0cb869ca48fccfc6e6fd7c19bf717ecd2; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-pjjm-3qxp-6hj8
CVE: CVE-2024-43360
Published: 2024-08-12
Description: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a; https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6; https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397
CVE: CVE-2024-7704
Published: 2024-08-12
Description: A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecology_dev.zip of the component Source Code Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/Dreamy-elfland/240731; https://vuldb.com/?ctiid.274182; https://vuldb.com/?id.274182