deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-53832
Published: 2024-12-10
Description: A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is connected via an unencrypted SPI bus. This could allow an attacker with physical access to the SPI bus to observe the password used for the secure element authentication, and then use the secure element as an oracle to decrypt all encrypted update files.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-522
References: https://cert-portal.siemens.com/productcert/html/ssa-128393.html; http://seclists.org/fulldisclosure/2025/Feb/19
CVE: CVE-2024-54005
Published: 2024-12-10
Description: A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user's system or accessible network folders by injecting malicious data into the communication channel between the two systems.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-611
References: https://cert-portal.siemens.com/productcert/html/ssa-701627.html
CVE: CVE-2024-54091
Published: 2024-12-10
Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 12), Solid Edge SE2025 (All versions < V225.0 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer while parsing X_T data or a specially crafted file in X_T format.
This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-672923.html; https://cert-portal.siemens.com/productcert/html/ssa-979056.html
CVE: CVE-2024-54093
Published: 2024-12-10
Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted ASM files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-730188.html
CVE: CVE-2024-54094
Published: 2024-12-10
Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-730188.html
CVE: CVE-2024-54095
Published: 2024-12-10
Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 10). The affected application is vulnerable to integer underflow vulnerability which can be triggered while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://cert-portal.siemens.com/productcert/html/ssa-730188.html
CVE: CVE-2024-55586
Published: 2024-12-10
Description: Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/CSIRTTrizna/CVE-2024-55586; https://github.com/nette/database/releases; https://www.csirt.sk/nette-framework-vulnerability-permits-sql-injection.html
CVE: CVE-2024-5660
Published: 2024-12-10
Description: Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668
References: https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660
CVE: CVE-2024-12236
Published: 2024-12-10
Description: A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC.

No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://cloud.google.com/vertex-ai/generative-ai/docs/security-bulletins#gcp-2024-063
CVE: CVE-2024-12323
Published: 2024-12-10
Description: The turboSMTP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link while logged in to turboSMTP.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/turbosmtp/trunk/turbo-stats-section.php#L209; https://plugins.trac.wordpress.org/changeset/3205021/; https://www.wordfence.com/threat-intel/vulnerabilities/id/cca9f71c-42e6-416f-94f2-cb79bbdfc69a?source=cve
CVE: CVE-2024-54751
Published: 2024-12-10
Description: COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://colorful-meadow-5b9.notion.site/CF-WR630AX_HardCode_vuln-14bc216a1c[PII_REDACTED]ce15e35fa652?pvs=4
CVE: CVE-2024-10494
Published: 2024-12-10
Description: An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q3 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-125
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview-.html
CVE: CVE-2024-10495
Published: 2024-12-10
Description: An out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q3 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-125
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview-.html
CVE: CVE-2024-10496
Published: 2024-12-10
Description: An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q3 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-125
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview-.html
CVE: CVE-2024-54152
Published: 2024-12-10
Description: Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. The problem has been patched in version 1.4.3 of Angular Expressions. Two possible workarounds are available. One may either disable access to `__proto__` globally or make sure that one uses the function with just one argument.
CWE: CWE-94
References: https://github.com/peerigon/angular-expressions/commit/97f7ad94006156eeb97fc942332578b6cfbf8eef; https://github.com/peerigon/angular-expressions/security/advisories/GHSA-5462-4vcx-jh7j
CVE: CVE-2024-55544
Published: 2024-12-10
Description: Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/; http://seclists.org/fulldisclosure/2024/Dec/3; https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/
CVE: CVE-2024-45493
Published: 2024-12-10
Description: An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has internal users, whose access is supposed to be restricted to login locally on the device. However, an attacker can bypass the check for this, which might allow them to authenticate with an internal user account from the network (if they know their password).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://us.msasafety.com/fieldserver; https://us.msasafety.com/security-notices
CVE: CVE-2024-45494
Published: 2024-12-10
Description: An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected firmware versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://us.msasafety.com/fieldserver; https://us.msasafety.com/security-notices
CVE: CVE-2024-46657
Published: 2024-12-10
Description: Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/diff/?id=b5c898a30f068b5342e8263a2cd5b9f0be291aac; https://gist.github.com/isumitpatel/615e6bd2621cb46b5d980ddb9db223e2; https://github.com/ArtifexSoftware/mupdf/commit/b5c898a30f068b5342e8263a2cd5b9f0be291aac
CVE: CVE-2024-55545
Published: 2024-12-10
Description: Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/; http://seclists.org/fulldisclosure/2024/Dec/3; https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/
CVE: CVE-2024-55546
Published: 2024-12-10
Description: Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/; http://seclists.org/fulldisclosure/2024/Dec/3; https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/
CVE: CVE-2024-55547
Published: 2024-12-10
Description: SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/; http://seclists.org/fulldisclosure/2024/Dec/3; https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/
CVE: CVE-2024-55548
Published: 2024-12-10
Description: Improper check of password character lenght in ORing IAP-420 allows a forced deadlock. This issue affects IAP-420: through 2.01e.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703
References: https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/; http://seclists.org/fulldisclosure/2024/Dec/3; https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/
CVE: CVE-2024-55602
Published: 2024-12-10
Description: PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal (`../`) sequences into the file extension property to read arbitrary files on the system. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 contains a patch for the issue.
CVSS Score: 7.6 (HIGH)
CWE: CWE-22
References: https://gist.github.com/JorianWoltjer/8a42e25c6dfa7604020d2a226e193407; https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L103; https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L43-L47
CVE: CVE-2024-12286
Published: 2024-12-10
Description: MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1392
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-01
CVE: CVE-2024-53243
Published: 2024-12-10
Description: In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could see alert search query responses using Splunk Secure Gateway App Key Value Store (KVstore) collections endpoints due to improper access control.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://advisory.splunk.com/advisories/SVD-2024-1201
CVE: CVE-2024-53244
Published: 2024-12-10
Description: In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on “/en-US/app/search/report“ endpoint through “s“ parameter.<br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://advisory.splunk.com/advisories/SVD-2024-1202
CVE: CVE-2024-53245
Published: 2024-12-10
Description: In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard name and the dashboard XML by cloning the dashboard.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://advisory.splunk.com/advisories/SVD-2024-1203
CVE: CVE-2024-53246
Published: 2024-12-10
Description: In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability, such as a Risky Commands Bypass, for successful exploitation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://advisory.splunk.com/advisories/SVD-2024-1204
CVE: CVE-2024-53247
Published: 2024-12-10
Description: In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could perform a Remote Code Execution (RCE).
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://advisory.splunk.com/advisories/SVD-2024-1205
CVE: CVE-2024-53866
Published: 2024-12-10
Description: The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data (including on first lockfile generation). This can make workspace A (even running with `ignore-scripts=true`) posion global cache and execute scripts in workspace B. Users generally expect `ignore-scripts` to be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it). Here, that expectation is broken. Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs. Version 9.15.0 fixes the issue. As a work-around, use separate cache and store dirs in each workspace.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-426
References: https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743; https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r
CVE: CVE-2024-10256
Published: 2024-12-10
Description: Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Patch-SDK-CVE-2024-10256
CVE: CVE-2024-11633
Published: 2024-12-10
Description: Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-88, CWE-88
References: https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs
CVE: CVE-2024-11634
Published: 2024-12-10
Description: Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution. (Not applicable to 9.1Rx)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs
CVE: CVE-2024-11639
Published: 2024-12-10
Description: An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773
CVE: CVE-2024-11772
Published: 2024-12-10
Description: Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773
CVE: CVE-2024-11773
Published: 2024-12-10
Description: SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773
CVE: CVE-2024-46442
Published: 2024-12-10
Description: An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: http://byd.com; https://github.com/zgsnj123/BYD_headunit_vuls/tree/main; https://www.bydauto.com.cn/
CVE: CVE-2024-50699
Published: 2024-12-10
Description: TP-Link TL-WR845N(UN)_V4_201214, TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 were discovered to contain weak default credentials for the Administrator account.
CVSS Score: 8.0 (HIGH)
CWE: CWE-522
References: https://security.iiita.ac.in/iot/password-reset-missing-tplink.pdf; https://security.iiita.ac.in/iot/base64-authorization.docx
CVE: CVE-2024-50920
Published: 2024-12-10
Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets.
CVSS Score: 8.8 (HIGH)
CWE: CWE-281
References: https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE: CVE-2024-50921
Published: 2024-12-10
Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending crafted packets to the controller.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE: CVE-2024-50924
Published: 2024-12-10
Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending crafted packets to the controller.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE: CVE-2024-50928
Published: 2024-12-10
Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memory, disrupting the device's communications with the controller.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE: CVE-2024-50929
Published: 2024-12-10
Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service (DoS).
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-281
References: https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE: CVE-2024-50930
Published: 2024-12-10
Description: An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-281
References: https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE: CVE-2024-50931
Published: 2024-12-10
Description: Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-281
References: https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE: CVE-2024-54008
Published: 2024-12-10
Description: An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04765en_us&docLocale=en_US
CVE: CVE-2024-55500
Published: 2024-12-10
Description: Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/avwo/whistle/commit/d1b8ca275dc4e453bd2efed392c0fd4b92f73cdf; https://www.sonarsource.com/blog/never-underestimate-csrf-why-origin-reflection-is-a-bad-idea/