deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49113
Published: 2024-06-20
Description: The Kiuwan Local Analyzer (KLA) Java scanning application contains several 
hard-coded secrets in plain text format. In some cases, this can 
potentially compromise the confidentiality of the scan results. Several credentials were found in the JAR files of the Kiuwan Local Analyzer.

The
 JAR file "lib.engine/insight/optimyth-insight.jar" contains the file 
"InsightServicesConfig.properties", which has the configuration tokens 
"insight.github.user" as well as "insight.github.password" prefilled 
with credentials. At least the specified username corresponds to a valid
 GitHub account. The
 JAR file "lib.engine/insight/optimyth-insight.jar" also contains the 
file "es/als/security/Encryptor.properties", in which the key used for 
encrypting the results of any performed scan.




This issue affects Kiuwan SAST: <master.1808.p685.q13371
CVSS Score: 7.8 (HIGH)
CWE: CWE-312
References: https://r.sec-consult.com/kiuwan; https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log; http://seclists.org/fulldisclosure/2024/Jun/3
CVE: CVE-2024-6186
Published: 2024-06-20
Description: A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. This affects an unknown part of the file /view/userAuthentication/SSO/commit.php. The manipulation of the argument ad_log_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/L1OudFd8cl09/CVE/blob/main/11_06_2024_c.md; https://vuldb.com/?ctiid.269157; https://vuldb.com/?id.269157
CVE: CVE-2024-6187
Published: 2024-06-20
Description: A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/L1OudFd8cl09/CVE/blob/main/11_06_2024_d.md; https://vuldb.com/?ctiid.269158; https://vuldb.com/?id.269158
CVE: CVE-2023-3353
Published: 2024-06-20
Description: Rejected reason: ** REJECT ** Developer patched two issues with a single patch, so only one CVE is necessary. Please use CVE-2023-3352.
CVE: CVE-2024-37532
Published: 2024-06-20
Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation.  IBM X-Force ID:  294721.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347, CWE-347
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/294721; https://www.ibm.com/support/pages/node/7158031; https://exchange.xforce.ibmcloud.com/vulnerabilities/294721
CVE: CVE-2024-5156
Published: 2024-06-20
Description: The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/flatsome-multipurpose-responsive-woocommerce-theme/5484319#item-description__change-log; https://www.wordfence.com/threat-intel/vulnerabilities/id/cf6c13de-e666-4c80-aa4c-6f610d899d03?source=cve; https://themeforest.net/item/flatsome-multipurpose-responsive-woocommerce-theme/5484319#item-description__change-log
CVE: CVE-2024-6188
Published: 2024-06-20
Description: A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269159. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://kiwiyumi.com/post/tracksys-export-source-code/; https://vuldb.com/?ctiid.269159; https://vuldb.com/?id.269159
CVE: CVE-2024-6189
Published: 2024-06-20
Description: A vulnerability was found in Tenda A301 15.13.08.12. It has been classified as critical. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269160. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://military-hail-377.notion.site/Tenda-A301V2-0-stack-overflow-c95f23f03b2b4eb5b8ffd3912e9982fd; https://vuldb.com/?ctiid.269160; https://vuldb.com/?id.269160
CVE: CVE-2024-37222
Published: 2024-06-20
Description: Cross Site Scripting (XSS) vulnerability in Averta Master Slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.10.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/master-slider/wordpress-master-slider-plugin-3-9-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/master-slider/wordpress-master-slider-plugin-3-9-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-6162
Published: 2024-06-20
Description: A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
CVSS Score: 7.5 (HIGH)
CWE: CWE-488
References: https://access.redhat.com/errata/RHSA-2024:1194; https://access.redhat.com/errata/RHSA-2024:4386; https://access.redhat.com/errata/RHSA-2024:4884
CVE: CVE-2024-6190
Published: 2024-06-20
Description: A vulnerability was found in itsourcecode Farm Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-269162 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/HryspaHodor/CVE/issues/2; https://vuldb.com/?ctiid.269162; https://vuldb.com/?id.269162
CVE: CVE-2024-6191
Published: 2024-06-20
Description: A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. This affects an unknown part of the file login.php of the component Login Page. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269163.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/HryspaHodor/CVE/issues/3; https://vuldb.com/?ctiid.269163; https://vuldb.com/?id.269163
CVE: CVE-2024-6192
Published: 2024-06-20
Description: A vulnerability classified as critical was found in itsourcecode Loan Management System 1.0. This vulnerability affects unknown code of the file login.php of the component Login Page. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269164.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/HryspaHodor/CVE/issues/4; https://vuldb.com/?ctiid.269164; https://vuldb.com/?id.269164
CVE: CVE-2024-37676
Published: 2024-06-20
Description: An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-787
References: http://htop.com; https://gist.github.com/Cirno9-dev/0109cde3bdbe7eccc[PII_REDACTED]740b7; https://github.com/htop-dev/htop
CVE: CVE-2024-6193
Published: 2024-06-20
Description: A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. This issue affects some unknown processing of the file driverprofile.php. The manipulation of the argument driverid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269165 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/HryspaHodor/CVE/issues/5; https://vuldb.com/?ctiid.269165; https://vuldb.com/?id.269165
CVE: CVE-2024-6194
Published: 2024-06-20
Description: A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file editmeasurement.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269166 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/HryspaHodor/CVE/issues/6; https://vuldb.com/?ctiid.269166; https://vuldb.com/?id.269166
CVE: CVE-2024-6195
Published: 2024-06-20
Description: A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file orderadd.php. The manipulation of the argument customer leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269167.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/[PII_REDACTED]/cve/issues/2; https://vuldb.com/?ctiid.269167; https://vuldb.com/?id.269167
CVE: CVE-2024-6196
Published: 2024-06-20
Description: A vulnerability was found in itsourcecode Banking Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin_class.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269168.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/[PII_REDACTED]/cve/issues/1; https://vuldb.com/?ctiid.269168; https://vuldb.com/?id.269168
CVE: CVE-2022-41324
Published: 2024-06-20
Description: Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensitive device information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users; https://northern.tech; https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users
CVE: CVE-2022-45929
Published: 2024-06-20
Description: Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and could allow privilege escalation from a low-privileged read-only user to a high-privileged user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users; https://northern.tech; https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users
CVE: CVE-2024-28397
Published: 2024-06-20
Description: An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-94
References: https://github.com/Marven11; https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape; https://github.com/Marven11
CVE: CVE-2024-33335
Published: 2024-06-20
Description: SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://gist.github.com/vrhappy/08cb4c8721eed8a74fe786ecdff1ec1e; https://www.h3c.com/cn/; https://www.h3c.com/cn/Service/Online_Help/psirt/
CVE: CVE-2024-37343
Published: 2024-06-20
Description: There is a cross-site scripting vulnerability in the Secure
Access administrative console of Absolute Secure Access prior to version 13.06.
Attackers with valid tunnel credentials can pass a limited-length script to the
administrative console which is then temporarily stored where an administrator
using a non-default configuration could click on it while the attacker has a
valid tunnel session with the server. The scope is unchanged, there is no loss
of confidentiality. Impact to system availability is none, impact to system
integrity is high.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37343/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37343/
CVE: CVE-2024-37344
Published: 2024-06-20
Description: There is a cross-site scripting vulnerability in the Policy
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with another system
administrator’s use of the policy management UI when the administrators are
editing the same policy object. The scope is unchanged, there is no loss of
confidentiality. Impact to system availability is none, impact to system
integrity is high.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37344/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37344/
CVE: CVE-2024-37345
Published: 2024-06-20
Description: There is a cross-site scripting vulnerability in the Secure
Access administrative UI of Absolute Secure Access prior to version 13.06.
Attackers can pass a limited-length script to the administrative UI which is
then stored where an administrator can access it. The scope is unchanged, there
is no loss of confidentiality. Impact to system availability is none, impact to
system integrity is high
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/
CVE: CVE-2024-37346
Published: 2024-06-20
Description: There is an insufficient input validation vulnerability in
the Warehouse component of Absolute Secure Access prior to 13.06. Attackers
with system administrator permissions can impair the availability of certain
elements of the Secure Access administrative UI by writing invalid data to the
warehouse over the network. There is no loss of warehouse integrity or
confidentiality, the security scope is unchanged. Loss of availability is high.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37346/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37346/
CVE: CVE-2024-37347
Published: 2024-06-20
Description: There is a cross-site scripting vulnerability in the pool
configuration component of the management UI of Absolute Secure Access prior to
13.06. Attackers with system administrator permissions can pass a limited
length script to be run by another administrator. The scope is unchanged, there
is no loss of confidentiality. Impact to system integrity is high, impact to
system availability is none.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37347/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37347/
CVE: CVE-2024-37348
Published: 2024-06-20
Description: There is a cross-site
scripting vulnerability in the management UI of Absolute Secure Access prior to
version 13.06. Attackers with system administrator permissions can interfere
with another system administrator’s use of the management UI when the second
administrator later edits the same management object. This vulnerability is
distinct from CVE-2024-37349  and CVE-2024-37351. The scope is unchanged,
there is no loss of confidentiality. Impact to system integrity is high, impact
to system availability is none.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37348/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37348/
CVE: CVE-2024-37626
Published: 2024-06-20
Description: A command injection issue in TOTOLINK A6000R V1.0.1-B20[PII_REDACTED] firmware allows a remote attacker to execute arbitrary code via the iface parameter in the vif_enable function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://a6000r.com; https://github.com/lakemoon602/vuln/blob/main/totolink/TOTOlink%20A6000R%20vif_enable.md; https://www.totolink.net/
CVE: CVE-2024-37349
Published: 2024-06-20
Description: There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with other system
administrator’s use of the management UI when the victim administrator edits
the same management object. This vulnerability is distinct from CVE-2024-37348 and
CVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact
to system integrity is high, impact to system availability is none.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37349/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37349/
CVE: CVE-2024-37350
Published: 2024-06-20
Description: There is a cross-site scripting vulnerability in the policy
management UI of Absolute Secure Access prior to version 13.06. Attackers can
interfere with a system administrator’s use of the policy management UI when
the attacker convinces the victim administrator to follow a crafted link to the
vulnerable component while the attacking administrator is authenticated to the
console. The scope is unchanged, there is no loss of confidentiality. Impact to
system integrity is high, impact to system availability is none.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/
CVE: CVE-2024-37351
Published: 2024-06-20
Description: There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with other system
administrator’s use of the management UI when the second administrator later
edits the same management object. This vulnerability is distinct from CVE-2024-37348 and
CVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact
to system integrity is high, impact to system availability is none.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37351/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37351/
CVE: CVE-2024-37352
Published: 2024-06-20
Description: There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06 that allows
attackers with system administrator permissions to interfere with other system
administrators’ use of the management UI when the second administrator accesses
the vulnerable page. The scope is unchanged, there is no loss of
confidentiality. Impact to system integrity is high, impact to system
availability is none.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37352/; https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37352/
CVE: CVE-2024-37674
Published: 2024-06-20
Description: Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: http://moodle.com; https://github.com/MohamedAzizMSALLEMI/Moodle_Security/blob/main/CVE-2024-37674.md; http://moodle.com
CVE: CVE-2024-37699
Published: 2024-06-20
Description: An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://dle-news.ru/pressrelease/1909-datalife-engine-v172-press-release.html; https://exploit.az/threads/datalife-engine-dle-sql-inyeksiyasi-17-0.19/; https://exploit.az/threads/datalife-engine-dle-sql-inyeksiyasi-sql-injection-sql-inekcija-17-1.19/
CVE: CVE-2024-37897
Published: 2024-06-20
Description: SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration.
In SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions (e.g. expired) can reset their password and log in. Users are advised to upgrade to version 2.6.1. Users unable to upgrade may keep the password reset feature disabled or set a blank email address for users and admins with access restrictions so they cannot receive the email with the reset code and exploit the vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e[PII_REDACTED]423; https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh; https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e[PII_REDACTED]423