deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-22271
Published: 2024-07-09
Description: In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.

Specifically, an application is vulnerable when all of the following are true:

User is using Spring Cloud Function Web module

Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8

References  https://spring.io/security/cve-2022-22979   https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/  History 2020-01-16: Initial vulnerability report published.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://spring.io/security/cve-2024-22271; https://spring.io/security/cve-2024-22271
CVE: CVE-2024-37513
Published: 2024-07-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPCafe: from n/a through 2.2.27.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/wp-cafe/wordpress-wpcafe-plugin-2-2-27-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-cafe/wordpress-wpcafe-plugin-2-2-27-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-37520
Published: 2024-07-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 2.1.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/shopbuilder/vulnerability/wordpress-shopbuilder-elementor-woocommerce-builder-addons-plugin-2-1-12-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shopbuilder/wordpress-shopbuilder-elementor-woocommerce-builder-addons-plugin-2-1-12-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-37934
Published: 2024-07-09
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-8-4-subscriber-arbitrary-shortcode-execution-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-8-4-subscriber-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2024-37952
Published: 2024-07-09
Description: Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18.17.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/bookyourtravel/wordpress-bookyourtravel-theme-8-18-17-subscriber-privilege-escalation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bookyourtravel/wordpress-bookyourtravel-theme-8-18-17-subscriber-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2023-39328
Published: 2024-07-09
Description: A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/security/cve/CVE-2023-39328; https://bugzilla.redhat.com/show_bug.cgi?id=2219236; https://access.redhat.com/security/cve/CVE-2023-39328
CVE: CVE-2024-2177
Published: 2024-07-09
Description: A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://gitlab.com/gitlab-org/gitlab/-/issues/444467; https://hackerone.com/reports/2383443; https://gitlab.com/gitlab-org/gitlab/-/issues/444467
CVE: CVE-2024-6527
Published: 2024-07-09
Description: SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and obtain administrator's token to modify the content of pages.  This issue affects MegaBIP software versions through 5.13.
CWE: CWE-89
References: https://cert.pl/en/posts/2024/07/CVE-2024-6527/; https://cert.pl/posts/2024/07/CVE-2024-6527/; https://megabip.pl/
CVE: CVE-2024-6598
Published: 2024-07-09
Description: A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation.


Updating to KNIME Business Hub 1.10.2 or later solves the problem.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.knime.com/security/advisories#CVE-2024-6598; https://www.knime.com/security/advisories#CVE-2024-6598
CVE: CVE-2024-38363
Published: 2024-07-09
Description: Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new connectors. Sensitive information, such as credentials, could be exposed if a user tested a new connector on a compromised instance. The connection builder does not have access to any data processes. This vulnerability is fixed in 0.62.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-1336
References: https://github.com/airbytehq/airbyte/security/advisories/GHSA-4j3c-fgvx-xgqq; https://github.com/airbytehq/airbyte/security/advisories/GHSA-4j3c-fgvx-xgqq
CVE: CVE-2024-39697
Published: 2024-07-09
Description: phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.
CVSS Score: 8.6 (HIGH)
CWE: CWE-284, CWE-392, CWE-617, CWE-1284
References: https://github.com/whisperfish/rust-phonenumber/commit/b792151b17fc90231c232a23935830c2266f3203; https://github.com/whisperfish/rust-phonenumber/commit/f69abee1481fac0d6d531407bae90020e39c6407; https://github.com/whisperfish/rust-phonenumber/issues/69
CVE: CVE-2024-6600
Published: 2024-07-09
Description: Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on macOS. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-770
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1888340; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-30/
CVE: CVE-2024-6601
Published: 2024-07-09
Description: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-367
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1890748; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-30/
CVE: CVE-2024-6602
Published: 2024-07-09
Description: A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1895032; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-30/
CVE: CVE-2024-6603
Published: 2024-07-09
Description: In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
CVSS Score: 7.4 (HIGH)
CWE: CWE-823
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1895081; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-30/
CVE: CVE-2024-6604
Published: 2024-07-09
Description: Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1748105%2C1837550%2C1884266; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-30/
CVE: CVE-2024-6605
Published: 2024-07-09
Description: Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128.
CVSS Score: 8.8 (HIGH)
CWE: CWE-277
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1836786; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://bugzilla.mozilla.org/show_bug.cgi?id=1836786
CVE: CVE-2024-6606
Published: 2024-07-09
Description: Clipboard code failed to check the index on an array access. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1902305; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2024-6607
Published: 2024-07-09
Description: It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `&lt;select&gt;` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 8.8 (HIGH)
CWE: CWE-763
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1694513; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2024-6608
Published: 2024-07-09
Description: It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1743329; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2024-6609
Published: 2024-07-09
Description: When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1839258; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2024-6610
Published: 2024-07-09
Description: Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen mode. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1883396; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2024-6611
Published: 2024-07-09
Description: A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1275
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1844827; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2024-6612
Published: 2024-07-09
Description: CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1880374; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2024-6613
Published: 2024-07-09
Description: The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-209
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1900523; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2024-6614
Published: 2024-07-09
Description: The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-835
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1902983; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2024-6615
Published: 2024-07-09
Description: Memory safety bugs present in Firefox 127 and Thunderbird 127. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1892875%2C1894428%2C1898364; https://www.mozilla.org/security/advisories/mfsa2024-29/; https://www.mozilla.org/security/advisories/mfsa2024-32/
CVE: CVE-2023-40356
Published: 2024-07-09
Description: PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s existing registered devices. A threat actor might be able to exploit this vulnerability to register their own MFA device with a target user’s account if they have existing knowledge of the target user’s first factor credential.
CWE: CWE-290
References: https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks[PII_REDACTED]94; https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks[PII_REDACTED]94
CVE: CVE-2023-40702
Published: 2024-07-09
Description: PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate as a target user if they have existing knowledge of the target user’s first-factor credentials.
CWE: CWE-290
References: https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks[PII_REDACTED]94; https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks[PII_REDACTED]94
CVE: CVE-2023-50178
Published: 2024-07-09
Description: An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and various remote servers such as private SDN connectors and FortiToken Cloud.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://fortiguard.fortinet.com/psirt/FG-IR-22-298; https://fortiguard.fortinet.com/psirt/FG-IR-22-298
CVE: CVE-2023-50179
Published: 2024-07-09
Description: An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN connectors.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-480; https://fortiguard.fortinet.com/psirt/FG-IR-23-480
CVE: CVE-2023-50181
Published: 2024-07-09
Description: An improper access control vulnerability [CWE-284] in Fortinet FortiADC  version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker to perform some write actions via crafted HTTP or HTTPS requests.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-469; https://fortiguard.fortinet.com/psirt/FG-IR-23-469
CVE: CVE-2024-21759
Published: 2024-07-09
Description: An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker to view unauthorized resources via HTTP or HTTPS requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-011; https://fortiguard.fortinet.com/psirt/FG-IR-24-011
CVE: CVE-2024-23663
Published: 2024-07-09
Description: An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via a crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://fortiguard.com/psirt/FG-IR-23-459; https://fortiguard.com/psirt/FG-IR-23-459
CVE: CVE-2024-26015
Published: 2024-07-09
Description: An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.
CVSS Score: 3.4 (LOW)
CWE: CWE-1389, CWE-704
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-446; https://fortiguard.fortinet.com/psirt/FG-IR-23-446
CVE: CVE-2024-27782
Published: 2024-07-09
Description: Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-613
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-069; https://fortiguard.fortinet.com/psirt/FG-IR-24-069
CVE: CVE-2024-27783
Published: 2024-07-09
Description: Multiple cross-site request forgery (CSRF) weaknesses [CWE-352] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests.
CVSS Score: 7.6 (HIGH)
CWE: CWE-352
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-070; https://fortiguard.fortinet.com/psirt/FG-IR-24-070
CVE: CVE-2024-27784
Published: 2024-07-09
Description: Multiple Exposure of sensitive information to an unauthorized actor weaknesses [CWE-200] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an authenticated, remote attacker to retrieve sensitive information from the API endpoint or log files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-532
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-072; https://fortiguard.fortinet.com/psirt/FG-IR-24-072
CVE: CVE-2024-27785
Published: 2024-07-09
Description: An improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1236
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-073; https://fortiguard.fortinet.com/psirt/FG-IR-24-073
CVE: CVE-2024-33509
Published: 2024-07-09
Description: An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the device and different endpoints used to fetch data for Web Application Firewall (WAF).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://fortiguard.fortinet.com/psirt/FG-IR-22-326; https://fortiguard.fortinet.com/psirt/FG-IR-22-326
CVE: CVE-2024-20701
Published: 2024-07-09
Description: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20701; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20701
CVE: CVE-2024-21303
Published: 2024-07-09
Description: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21303; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21303
CVE: CVE-2024-21308
Published: 2024-07-09
Description: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21308; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21308
CVE: CVE-2024-21317
Published: 2024-07-09
Description: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21317; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21317
CVE: CVE-2024-21331
Published: 2024-07-09
Description: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21331; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21331
CVE: CVE-2024-21332
Published: 2024-07-09
Description: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21332; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21332
CVE: CVE-2024-21333
Published: 2024-07-09
Description: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21333; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21333