deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2500
Published: 2024-03-22
Description: The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/colormag/3.1.6/inc/template-tags.php#L845; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=221537%40colormag&new=221537%40colormag&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b44d89-6f1e-4a23-91ea-e79fc3221183?source=cve
CVE: CVE-2024-2780
Published: 2024-03-22
Description: A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257614 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Marriage%20Registration%20System/Complete%20Online%20Marriage%20Registration%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.257614; https://vuldb.com/?id.257614
CVE: CVE-2024-25807
Published: 2024-03-22
Description: Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Hebing123/cve/issues/17; https://github.com/Hebing123/cve/issues/17
CVE: CVE-2024-26557
Published: 2024-03-22
Description: Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Hebing123/cve/issues/18; https://github.com/Hebing123/cve/issues/18
CVE: CVE-2024-2805
Published: 2024-03-22
Description: A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been rated as critical. Affected by this issue is the function formSetSpeedWan of the file /goform/SetSpeedWan. The manipulation of the argument speed_dir leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257660. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/SetSpeedWan.md; https://vuldb.com/?ctiid.257660; https://vuldb.com/?id.257660
CVE: CVE-2024-25808
Published: 2024-03-22
Description: Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function.
CVSS Score: 8.3 (HIGH)
CWE: CWE-352
References: https://github.com/Hebing123/cve/issues/17; https://github.com/Hebing123/cve/issues/17
CVE: CVE-2024-29271
Published: 2024-03-22
Description: Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive information via the action parameter in save.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/givanz/VvvebJs/commit/c0c0545b44b23acc288ef907fb498ce15b9b576e; https://github.com/givanz/VvvebJs/issues/342; https://github.com/givanz/VvvebJs/commit/c0c0545b44b23acc288ef907fb498ce15b9b576e
CVE: CVE-2024-29272
Published: 2024-03-22
Description: Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/givanz/VvvebJs/commit/c6422cfd4d835c2fa6d512645e30015f24538ef0; https://github.com/givanz/VvvebJs/issues/343; https://github.com/givanz/VvvebJs/commit/c6422cfd4d835c2fa6d512645e30015f24538ef0
CVE: CVE-2024-29273
Published: 2024-03-22
Description: There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zyx0814/dzzoffice/issues/244; https://github.com/zyx0814/dzzoffice/issues/244
CVE: CVE-2024-29275
Published: 2024-03-22
Description: SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/seacms-net/CMS/issues/15; https://github.com/seacms-net/CMS/issues/15
CVE: CVE-2024-2806
Published: 2024-03-22
Description: A vulnerability classified as critical has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This affects the function addWifiMacFilter of the file /goform/addWifiMacFilter. The manipulation of the argument deviceId/deviceMac leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257661 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/addWifiMacFilter_deviceId.md; https://vuldb.com/?ctiid.257661; https://vuldb.com/?id.257661
CVE: CVE-2024-2807
Published: 2024-03-22
Description: A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.20_multi. This vulnerability affects the function formExpandDlnaFile of the file /goform/expandDlnaFile. The manipulation of the argument filePath leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257662 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formExpandDlnaFile.md; https://vuldb.com/?ctiid.257662; https://vuldb.com/?id.257662
CVE: CVE-2024-2808
Published: 2024-03-22
Description: A vulnerability, which was classified as critical, has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This issue affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257663. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formQuickIndex.md; https://vuldb.com/?ctiid.257663; https://vuldb.com/?id.257663
CVE: CVE-2024-2809
Published: 2024-03-22
Description: A vulnerability, which was classified as critical, was found in Tenda AC15 15.03.05.18/15.03.20_multi. Affected is the function formSetFirewallCfg of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257664. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formSetFirewallCfg.md; https://vuldb.com/?ctiid.257664; https://vuldb.com/?id.257664
CVE: CVE-2024-2810
Published: 2024-03-22
Description: A vulnerability has been found in Tenda AC15 15.03.05.18/15.03.20_multi and classified as critical. Affected by this vulnerability is the function formWifiWpsOOB of the file /goform/WifiWpsOOB. The manipulation of the argument index leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257665 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWifiWpsOOB.md; https://vuldb.com/?ctiid.257665; https://vuldb.com/?id.257665
CVE: CVE-2024-2811
Published: 2024-03-22
Description: A vulnerability was found in Tenda AC15 15.03.20_multi and classified as critical. Affected by this issue is the function formWifiWpsStart of the file /goform/WifiWpsStart. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWifiWpsStart.md; https://vuldb.com/?ctiid.257666; https://vuldb.com/?id.257666
CVE: CVE-2024-2812
Published: 2024-03-22
Description: A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257667. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWriteFacMac.md; https://vuldb.com/?ctiid.257667; https://vuldb.com/?id.257667
CVE: CVE-2024-2813
Published: 2024-03-22
Description: A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257668. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/form_fast_setting_wifi_set.md; https://vuldb.com/?ctiid.257668; https://vuldb.com/?id.257668
CVE: CVE-2024-2814
Published: 2024-03-22
Description: A vulnerability was found in Tenda AC15 15.03.20_multi. It has been rated as critical. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257669 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/fromDhcpListClient_page.md; https://vuldb.com/?ctiid.257669; https://vuldb.com/?id.257669
CVE: CVE-2024-2815
Published: 2024-03-22
Description: A vulnerability classified as critical has been found in Tenda AC15 15.03.20_multi. Affected is the function R7WebsSecurityHandler of the file /goform/execCommand of the component Cookie Handler. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/R7WebsSecurityHandler.md; https://vuldb.com/?ctiid.257670; https://vuldb.com/?id.257670
CVE: CVE-2024-2816
Published: 2024-03-22
Description: A vulnerability classified as problematic was found in Tenda AC15 15.03.05.18. Affected by this vulnerability is the function fromSysToolReboot of the file /goform/SysToolReboot. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/fromSysToolReboot.md; https://vuldb.com/?ctiid.257671; https://vuldb.com/?id.257671
CVE: CVE-2024-2817
Published: 2024-03-22
Description: A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18. Affected by this issue is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257672. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/fromSysToolRestoreSet.md; https://vuldb.com/?ctiid.257672; https://vuldb.com/?id.257672
CVE: CVE-2024-0638
Published: 2024-03-22
Description: Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.
CVSS Score: 8.2 (HIGH)
CWE: CWE-272
References: https://checkmk.com/werk/16232; https://checkmk.com/werk/16232
CVE: CVE-2024-1742
Published: 2024-03-22
Description: Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list.
CVSS Score: 3.8 (LOW)
CWE: CWE-214
References: https://checkmk.com/werk/16234; https://checkmk.com/werk/16234
CVE: CVE-2024-1848
Published: 2024-03-22
Description: Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024.
These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted CATPART, DWG, DXF, IPT, JT, SAT, SLDDRW, SLDPRT, STL, STP, X_B or X_T file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-125, CWE-416, CWE-457, CWE-787
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-28824
Published: 2024-03-22
Description: Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-272, CWE-807
References: https://checkmk.com/werk/16198; https://checkmk.com/werk/16198
CVE: CVE-2024-25168
Published: 2024-03-22
Description: SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the system/role/list interface.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/biantaibao/snow_SQL/blob/main/report.md; https://github.com/biantaibao/snow_SQL/blob/main/report.md
CVE: CVE-2024-28559
Published: 2024-03-22
Description: SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the setPrice() function of the Goodsbatchset.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://chiggerlor.substack.com/p/cve-2024-28560-cve-2024-28559; https://gitee.com/niushop-team/niushop_b2c_v5; https://v5.niuteam.cn
CVE: CVE-2024-28560
Published: 2024-03-22
Description: SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of the Address.php component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://chiggerlor.substack.com/p/cve-2024-28560-cve-2024-28559; https://gitee.com/niushop-team/niushop_b2c_v5; https://v5.niuteam.cn
CVE: CVE-2024-29943
Published: 2024-03-22
Description: An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This vulnerability affects Firefox < 124.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-787
References: http://www.openwall.com/lists/oss-security/2024/03/23/1; https://bugzilla.mozilla.org/show_bug.cgi?id=1886849; https://www.mozilla.org/security/advisories/mfsa2024-15/
CVE: CVE-2024-29944
Published: 2024-03-22
Description: An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.
CVSS Score: 8.4 (HIGH)
CWE: CWE-830
References: http://www.openwall.com/lists/oss-security/2024/03/23/1; https://bugzilla.mozilla.org/show_bug.cgi?id=1886852; https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE: CVE-2024-2448
Published: 2024-03-22
Description: An OS command injection vulnerability has been identified in LoadMaster.  An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78, CWE-78
References: https://progress.com/loadmaster; https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]0477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449; https://progress.com/loadmaster
CVE: CVE-2024-2449
Published: 2024-03-22
Description: A cross-site request forgery vulnerability has been identified in LoadMaster.  It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352, CWE-352
References: https://progress.com/loadmaster; https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]0477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449; https://progress.com/loadmaster
CVE: CVE-2024-2722
Published: 2024-03-22
Description: SQL injection vulnerability in the CIGESv2 system, through /ajaxConfigTotem.php, in the 'id' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system
CVE: CVE-2024-2723
Published: 2024-03-22
Description: SQL injection vulnerability in the CIGESv2 system, through /ajaxSubServicios.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system
CVE: CVE-2024-2724
Published: 2024-03-22
Description: SQL injection vulnerability in the CIGESv2 system, through /ajaxServiciosAtencion.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system
CVE: CVE-2024-2725
Published: 2024-03-22
Description: Information exposure vulnerability in the CIGESv2 system. A remote attacker might be able to access /vendor/composer/installed.json and retrieve all installed packages used by the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system
CVE: CVE-2024-2726
Published: 2024-03-22
Description: Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system
CVE: CVE-2024-2727
Published: 2024-03-22
Description: HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system
CVE: CVE-2024-2728
Published: 2024-03-22
Description: Information exposure vulnerability in the CIGESv2 system. This vulnerability could allow a local attacker to intercept traffic due to the lack of proper implementation of the TLS protocol.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-200
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cigesv2-system
CVE: CVE-2023-41099
Published: 2024-03-22
Description: In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM).
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.bull.com/ols/product/security/psirt/security-bulletins/cardos-api-local-privilege-escalation-psirt-358-tlp-clear-version-2-6-cve-2023-41099/view; https://support.bull.com/ols/product/security/psirt/security-bulletins/cardos-api-local-privilege-escalation-psirt-358-tlp-clear-version-2-6-cve-2023-41099/view