deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-37136
Published: 2024-09-03
Description: Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Actor vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information exposure.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-359
References: https://www.dell.com/support/kbdoc/en-us/000227430/dsa-2024-291-security-update-for-dell-path-to-powerprotect-for-security-vulnerability
CVE: CVE-2024-38811
Published: 2024-09-03
Description: VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24939
CVE: CVE-2024-3655
Published: 2024-09-03
Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r43p0 through r49p0; Valhall GPU Kernel Driver: from r43p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r43p0 through r49p0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-45586
Published: 2024-09-03
Description: This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281
CVE: CVE-2024-45587
Published: 2024-09-03
Description: This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281
CVE: CVE-2024-8374
Published: 2024-09-03
Description: UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/plugins/ThreeMFReader.py). The vulnerability arises from improper handling of the drop_to_buildplate property within 3MF files, which are ZIP archives containing the model data. When a 3MF file is loaded in Cura, the value of the drop_to_buildplate property is passed to the Python eval() function without proper sanitization, allowing an attacker to execute arbitrary code by crafting a malicious 3MF file. This vulnerability poses a significant risk as 3MF files are commonly shared via 3D model databases.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/Ultimaker/Cura/commit/285a241eb28da3188c977f85d68937c0dad79c50
CVE: CVE-2024-41718
Published: 2024-09-03
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID. ConsultIDs: CVE-2024-39771. Reason: This CVE ID is a reservation duplicate of CVE-2024-39771. Notes: All CVE users should reference CVE-2024-39771 instead of this CVE ID. All references and descriptions in this CVE ID have been removed to prevent accidental usage.
CVE: CVE-2024-45588
Published: 2024-09-03
Description: This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized access and modification of sensitive information belonging to other users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863, CWE-863
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281
CVE: CVE-2024-6473
Published: 2024-09-03
Description: Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://yandex.com/bugbounty/i/hall-of-fame-browser/
CVE: CVE-2024-44920
Published: 2024-09-03
Description: A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the siteurl parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nn0nkey/nn0nkey/blob/main/CVE-2024-44920.md
CVE: CVE-2024-44921
Published: 2024-09-03
Description: SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nn0nkey/nn0nkey/blob/main/CVE-2024-44921.md
CVE: CVE-2024-6232
Published: 2024-09-03
Description: There is a MEDIUM severity vulnerability affecting CPython.





Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4; https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06; https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4
CVE: CVE-2024-8371
Published: 2024-09-03
Description: Rejected reason: Duplicate of CVE-2024-45305.
CVE: CVE-2024-8381
Published: 2024-09-03
Description: A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843, CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1912715; https://www.mozilla.org/security/advisories/mfsa2024-39/; https://www.mozilla.org/security/advisories/mfsa2024-40/
CVE: CVE-2024-8382
Published: 2024-09-03
Description: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
CVSS Score: 8.8 (HIGH)
CWE: CWE-273
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1906744; https://www.mozilla.org/security/advisories/mfsa2024-39/; https://www.mozilla.org/security/advisories/mfsa2024-40/
CVE: CVE-2024-8383
Published: 2024-09-03
Description: Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1908496; https://www.mozilla.org/security/advisories/mfsa2024-39/; https://www.mozilla.org/security/advisories/mfsa2024-40/
CVE: CVE-2024-8384
Published: 2024-09-03
Description: The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could have led to memory corruption. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1911288; https://www.mozilla.org/security/advisories/mfsa2024-39/; https://www.mozilla.org/security/advisories/mfsa2024-40/
CVE: CVE-2024-8385
Published: 2024-09-03
Description: A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843, CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1911909; https://www.mozilla.org/security/advisories/mfsa2024-39/; https://www.mozilla.org/security/advisories/mfsa2024-40/
CVE: CVE-2024-8386
Published: 2024-09-03
Description: If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1907032; https://bugzilla.mozilla.org/show_bug.cgi?id=1909163; https://bugzilla.mozilla.org/show_bug.cgi?id=1909529
CVE: CVE-2024-8387
Published: 2024-09-03
Description: Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1857607%2C1911858%2C1914009; https://www.mozilla.org/security/advisories/mfsa2024-39/; https://www.mozilla.org/security/advisories/mfsa2024-40/
CVE: CVE-2024-8388
Published: 2024-09-03
Description: Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullscreen mode after the fix for CVE-2023-6870 in Firefox 121. This could lead to spoofing the browser UI if the sudden appearance of the prompt distracted the user from noticing the visual transition happening behind the prompt. These notifications now use the Android Toast feature. 
*This bug only affects Firefox on Android. Other operating systems are unaffected.* This vulnerability affects Firefox < 130.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1839074%2C1865413%2C1868970%2C1873367%2C1877820%2C1884642%2C1886469%2C1894326%2C1894891%2C1897648; https://bugzilla.mozilla.org/show_bug.cgi?id=1902996; https://www.mozilla.org/security/advisories/mfsa2024-39/
CVE: CVE-2024-8389
Published: 2024-09-03
Description: Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1907230%2C1909367; https://www.mozilla.org/security/advisories/mfsa2024-39/
CVE: CVE-2024-34463
Published: 2024-09-03
Description: BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The packet data also lacks authentication and integrity protection.)
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-285
References: https://github.com/yash-chandna/CVE-2024-34463; https://www.bplmedicaltechnologies.com/product-details/weighing-scales/personal-weighing-scale-pws-01bt/; https://yashhchandna.medium.com/random-sunday-thought-turned-into-a-cve-09ca0c08343f
CVE: CVE-2024-4259
Published: 2024-09-03
Description: Missing Authorization vulnerability in SAMPAŞ Holding AKOS (AkosCepVatandasService), SAMPAŞ Holding AKOS (TahsilatService) allows Collect Data as Provided by Users.
This issue affects AKOS (AkosCepVatandasService): before V2.0; AKOS (TahsilatService): before V1.0.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://www.usom.gov.tr/bildirim/tr-24-1377
CVE: CVE-2024-7345
Published: 2024-09-03
Description: Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms
CVSS Score: 8.3 (HIGH)
CWE: CWE-94, CWE-94
References: https://community.progress.com/s/article/Direct-local-client-connections-to-MS-Agents-can-bypass-authentication
CVE: CVE-2024-7346
Published: 2024-09-03
Description: Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection.  This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security.  The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-297, CWE-287
References: https://community.progress.com/s/article/Client-connections-using-default-TLS-certificates-from-OpenEdge-may-bypass-TLS-host-name-validation
CVE: CVE-2024-7654
Published: 2024-09-03
Description: An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated.  Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other types of attack that could spoof or deceive web interface users.   Unauthorized use of the OEE/OEM discovery service was remediated by deactivating the discovery service by default.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://community.progress.com/s/article/Unauthenticated-Content-Injection-in-OpenEdge-Management-web-interface-via-ActiveMQ-discovery-service
CVE: CVE-2024-42991
Published: 2024-09-03
Description: MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://gitee.com/mingSoft/MCMS/issues/IAHN9F
CVE: CVE-2024-6119
Published: 2024-09-03
Description: Issue summary: Applications performing certificate name checks (e.g., TLS
clients checking server certificates) may attempt to read an invalid memory
address resulting in abnormal termination of the application process.

Impact summary: Abnormal termination of an application can a cause a denial of
service.

Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an `otherName` subject alternative name of an
X.509 certificate. This may result in an exception that terminates the
application program.

Note that basic certificate chain validation (signatures, dates, ...) is not
affected, the denial of service can occur only when the application also
specifies an expected DNS name, Email address or IP address.

TLS servers rarely solicit client certificates, and even when they do, they
generally don't perform a name check against a reference identifier (expected
identity), but rather extract the presented identity after checking the
certificate chain.  So TLS servers are generally not affected and the severity
of the issue is Moderate.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843, CWE-843
References: https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f; https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6; https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2
CVE: CVE-2023-49233
Published: 2024-09-03
Description: Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning account to utilize functions normally reserved for administrators. The affected functions allow attackers to obtain different types of configured credentials and potentially elevate their privileges to administrator level.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://www.schutzwerk.com/blog/schutzwerk-sa-2023-005/; https://www.visual-planning.com/en/support-portal/updates
CVE: CVE-2024-43412
Published: 2024-09-03
Description: Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xibo Library via the Generic File module to be referenced on Displays and in Layouts. This is intended functionality. When previewing these resources from the Library and Layout editor they are executed in the users browser. This will be disabled in future releases, and users are encouraged to use the new developer tools in 4.1 to design their widgets which require this type of functionality. This behavior has been changed in 4.1.0 to preview previewing of generic files. There are no workarounds for this issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/xibosignage/xibo-cms/commit/d8f13339469d9f19ce591fb2bd7c9e0e0d2da118; https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-336f-wrgx-57gg
CVE: CVE-2024-38456
Published: 2024-09-03
Description: HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vulnerability in prunsrv.exe. A regular user (non-admin) can exploit the weak folder and file permissions to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.schutzwerk.com/blog/schutzwerk-sa-2024-001/; https://www.vivavis.com/en/solution/scada-en/high-leit/; https://www.vivavis.com/en/vivavis-high-leit-rce-vulnerability-cve-2024-38456/
CVE: CVE-2024-42901
Published: 2024-09-03
Description: A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/LimeSurvey/LimeSurvey/pull/3884; https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42901
CVE: CVE-2024-42902
Published: 2024-09-03
Description: An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://bugs.limesurvey.org/view.php?id=19639; https://github.com/LimeSurvey/LimeSurvey/blob/6434b12ded1c4b6516200c453441d0896e11eee0/vendor/kcfinder/js_localize.php#L19; https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42902
CVE: CVE-2024-42903
Published: 2024-09-03
Description: A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://github.com/LimeSurvey/LimeSurvey/compare/6.6.0+240729...6.6.1+240806; https://github.com/LimeSurvey/LimeSurvey/pull/3920; https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42903
CVE: CVE-2024-42904
Published: 2024-09-03
Description: A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter at /Controllers/ClientController.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nuxsmin/sysPass/blob/9d0e169d[PII_REDACTED]877fb65130db47fe1ddcfa/app/modules/api/Controllers/ClientController.php#L89; https://github.com/nuxsmin/sysPass/blob/master/lib/SP/DataModel/ClientData.php#L98; https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42904
CVE: CVE-2024-7619
Published: 2024-09-03
Description: Rejected reason: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-41435
Published: 2024-09-03
Description: YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://gist.github.com/ycybfhb/1427881e7db911786837d32b0669e06b; https://github.com/yugabyte/yugabyte-db/issues/22967
CVE: CVE-2024-41436
Published: 2024-09-03
Description: ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://gist.github.com/ycybfhb/db127ae9d105a4d20edc9f010a959016; https://github.com/ClickHouse/ClickHouse/issues/65520
CVE: CVE-2024-43413
Published: 2024-09-03
Description: Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/xibosignage/xibo-cms/commit/009527855d8bfd0ffb95f5c88ed72b7b5bdebfa1; https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-pfxp-vxh7-2h9f