deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-42380
Published: 2024-09-10
Description: The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability. There is low impact on confidentiality of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3488039; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-44113
Published: 2024-09-10
Description: Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-359, CWE-862
References: https://me.sap.com/notes/3481992; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-44114
Published: 2024-09-10
Description: SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application.
CVSS Score: 2.0 (LOW)
CWE: CWE-863
References: https://me.sap.com/notes/3507252; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-44115
Published: 2024-09-10
Description: The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces, and nodes. There is low impact on integrity of the application
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3488039; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-44116
Published: 2024-09-10
Description: The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces. There is low impact on integrity of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3488039; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-8268
Published: 2024-09-10
Description: The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.4/route/class-fed-request.php#L29; https://plugins.trac.wordpress.org/changeset/3147868/frontend-dashboard/tags/2.2.5/route/class-fed-request.php?old=3048034&old_path=frontend-dashboard%2Ftags%2F2.2.4%2Froute%2Fclass-fed-request.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/7d66694a-c99f-44f8-8004-1a47ad9f9250?source=cve
CVE: CVE-2024-8478
Published: 2024-09-10
Description: The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/amazonsimpleadmin/trunk/AsaCore.php#L285; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3147740%40amazonsimpleadmin&new=3147740%40amazonsimpleadmin&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/7f50769c-77b8-42ff-b67d-b9b289fc51da?source=cve
CVE: CVE-2024-41728
Published: 2024-09-10
Description: Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects.
CVSS Score: 2.7 (LOW)
CWE: CWE-862
References: https://me.sap.com/notes/3496410; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-44112
Published: 2024-09-10
Description: Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a remote-enabled function which will allow them to delete non-sensitive entries in a user data table. There is no effect on confidentiality or availability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3505293; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-45286
Published: 2024-09-10
Description: Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows unauthorized access that could lead to disclosure of highly sensitive data. There is no impact on integrity or availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3488341; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-0067
Published: 2024-09-10
Description: Marinus Pfund, member of the AXIS OS Bug Bounty Program, 
has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folder/file names on the local file system of the Axis device. 
Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-35, CWE-22
References: https://www.axis.com/dam/public/c7/d0/91/cve-2024-0067-en-US-448994.pdf
CVE: CVE-2024-21528
Published: 2024-09-10
Description: All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1321
References: https://github.com/alexanderwallin/node-gettext/blob/65d9670f691c2eeca40dce129c95bcf8b613d344/lib/gettext.js%23L113; https://security.snyk.io/vuln/SNYK-JS-NODEGETTEXT-6100943
CVE: CVE-2024-44117
Published: 2024-09-10
Description: The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID. There is low impact on integrity and availability of the application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3488039; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-44120
Published: 2024-09-10
Description: SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and trick a user to click it. If the victim clicks on this crafted URL before it times out, then the attacker could read and manipulate user content in the browser.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3498221; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-44121
Published: 2024-09-10
Description: Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted. The vulnerability could expose internal user data that should remain confidential. It does not impact the integrity and availability of the application
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-213
References: https://me.sap.com/notes/3437585; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-45279
Published: 2024-09-10
Description: Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker to craft a URL link which could embed a malicious JavaScript. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3501359; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-45280
Published: 2024-09-10
Description: Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3505503; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-45281
Published: 2024-09-10
Description: SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to the vulnerable system to perform DLL related tasks. This could result in a high impact on confidentiality and integrity of the application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-426
References: https://me.sap.com/notes/3425287; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-45283
Published: 2024-09-10
Description: SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After successful exploitation, an attacker can read the sensitive information but cannot modify or delete the data.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-256
References: https://me.sap.com/notes/3477359; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-45284
Published: 2024-09-10
Description: An authenticated attacker with high privilege can use functions of SLCM transactions to which access should be restricted. This may result in an escalation of privileges causing low impact on integrity of the application.
CVSS Score: 2.4 (LOW)
CWE: CWE-862
References: https://me.sap.com/notes/2256627; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-45285
Published: 2024-09-10
Description: The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a crafted packet in the function module targeting specific parameters, the specific targeted user will no longer have access to any functionality of SAP GUI. There is low impact on integrity and availability of the application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3488039; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-45504
Published: 2024-09-10
Description: Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://alsifaq.dga.jp/faq_detail.html?id=6494; https://jvn.jp/en/jp/JVN05579230/; https://success.trendmicro.com/ja-JP/solution/KA-0017618
CVE: CVE-2024-6173
Published: 2024-09-10
Description: 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowing for an attacker to block access to the guard tour configuration page in the web interface of the Axis device. 
Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1286
References: https://www.axis.com/dam/public/5a/87/a2/cve-2024-6173-en-US-458042.pdf
CVE: CVE-2024-6509
Published: 2024-09-10
Description: Marinus Pfund, member of the AXIS OS Bug Bounty Program, 
has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource exhaustion of the Axis device. 
Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-155, CWE-770
References: https://www.axis.com/dam/public/f6/c6/f5/cve-2024-6509-en-US-458043.pdf
CVE: CVE-2024-6979
Published: 2024-09-10
Description: Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of account passwords and social engineering attacks in tricking the administrator to perform specific configurations on operator- and/or viewer-privileged accounts. 
Axis has released patched AXIS OS a version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: https://www.axis.com/dam/public/c3/44/5b/cve-2024-6979-en-US-448997.pdf
CVE: CVE-2024-7784
Published: 2024-09-10
Description: During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-121
References: https://www.axis.com/dam/public/ba/5f/4e/cve-2024-7784-en-US-448998.pdf
CVE: CVE-2024-7891
Published: 2024-09-10
Description: The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b584a225-0d91-464d-b1c1-15594274d9d4/
CVE: CVE-2024-7955
Published: 2024-09-10
Description: The Starbox  WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cbfcbe57-553d-490a-b7f3-48aa0022f63d/
CVE: CVE-2024-44072
Published: 2024-09-10
Description: OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN12824024/; https://www.buffalo.jp/news/detail/20240719-01.html
CVE: CVE-2024-42424
Published: 2024-09-10
Description: Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Improper Input Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000227014/dsa-2024-327
CVE: CVE-2024-42427
Published: 2024-09-10
Description: Dell ThinOS versions 2402 and 2405, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS Score: 7.6 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.dell.com/support/kbdoc/en-us/000228350/dsa-2024-386
CVE: CVE-2024-6596
Published: 2024-09-10
Description: An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cert.vde.com/en/advisories/VDE-2024-041
CVE: CVE-2024-7618
Published: 2024-09-10
Description: The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.4.0/templates/reactions/admin_reaction.php#L112; https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.0/classes/adminconfigreactions.php?rev=3147528#L88; https://plugins.trac.wordpress.org/changeset/3147528/
CVE: CVE-2024-7655
Published: 2024-09-10
Description: The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.0/classes/adminconfigfields.php?rev=3147528#L17; https://plugins.trac.wordpress.org/changeset/3147528/; https://wordpress.org/plugins/peepso-core/#developers
CVE: CVE-2024-7734
Published: 2024-09-10
Description: An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP encapsulation service. The impact is limited to blocking of valid IPsec VPN peers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://cert.vde.com/en/advisories/VDE-2024-052
CVE: CVE-2024-39574
Published: 2024-09-10
Description: Dell PowerScale InsightIQ, version 5.1, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000228412/dsa-2024-360-security-update-for-dell-powerscale-insightiq-for-multiple-security-vulnerabilities
CVE: CVE-2024-39580
Published: 2024-09-10
Description: Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000228412/dsa-2024-360-security-update-for-dell-powerscale-insightiq-for-multiple-security-vulnerabilities
CVE: CVE-2024-39581
Published: 2024-09-10
Description: Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to read, modify, and delete arbitrary files.
CVSS Score: 7.3 (HIGH)
CWE: CWE-552
References: https://www.dell.com/support/kbdoc/en-us/000228412/dsa-2024-360-security-update-for-dell-powerscale-insightiq-for-multiple-security-vulnerabilities
CVE: CVE-2024-39582
Published: 2024-09-10
Description: Dell PowerScale InsightIQ, version 5.0, contain a Use of hard coded Credentials vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 2.3 (LOW)
CWE: CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000228412/dsa-2024-360-security-update-for-dell-powerscale-insightiq-for-multiple-security-vulnerabilities
CVE: CVE-2024-39583
Published: 2024-09-10
Description: Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000228412/dsa-2024-360-security-update-for-dell-powerscale-insightiq-for-multiple-security-vulnerabilities
CVE: CVE-2024-42425
Published: 2024-09-10
Description: Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 3.8 (LOW)
CWE: CWE-788, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000227015/dsa-2024-328
CVE: CVE-2024-43385
Published: 2024-09-10
Description: A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mGuard devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en/advisories/VDE-2024-039
CVE: CVE-2024-43386
Published: 2024-09-10
Description: A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://cert.vde.com/en/advisories/VDE-2024-039
CVE: CVE-2024-43387
Published: 2024-09-10
Description: A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en/advisories/VDE-2024-039
CVE: CVE-2024-43388
Published: 2024-09-10
Description: A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://cert.vde.com/en/advisories/VDE-2024-039
CVE: CVE-2024-43389
Published: 2024-09-10
Description: A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can lead to a DoS.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://cert.vde.com/en/advisories/VDE-2024-039
CVE: CVE-2024-43390
Published: 2024-09-10
Description: A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which can lead to a DoS.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://cert.vde.com/en/advisories/VDE-2024-039
CVE: CVE-2024-43391
Published: 2024-09-10
Description: A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_PORTFORWARDING.SRC_IP environment variable which can lead to a DoS.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://cert.vde.com/en/advisories/VDE-2024-039
CVE: CVE-2024-43392
Published: 2024-09-10
Description: A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP  environment variable which can lead to a DoS.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://cert.vde.com/en/advisories/VDE-2024-039