deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-24989
Published: 2024-02-14
Description: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.

Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to  Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html .



NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: http://www.openwall.com/lists/oss-security/2024/05/30/4; https://my.f5.com/manage/s/article/K000138444; http://www.openwall.com/lists/oss-security/2024/05/30/4
CVE: CVE-2024-24990
Published: 2024-02-14
Description: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.

Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to  Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html .



 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2024/05/30/4; https://my.f5.com/manage/s/article/K000138445; http://www.openwall.com/lists/oss-security/2024/05/30/4
CVE: CVE-2024-0007
Published: 2024-02-14
Description: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface on Panorama appliances. This enables the impersonation of another authenticated administrator.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2024-0007; https://security.paloaltonetworks.com/CVE-2024-0007
CVE: CVE-2024-0008
Published: 2024-02-14
Description: Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://security.paloaltonetworks.com/CVE-2024-0008; https://security.paloaltonetworks.com/CVE-2024-0008
CVE: CVE-2024-0009
Published: 2024-02-14
Description: An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-940, CWE-346
References: https://security.paloaltonetworks.com/CVE-2024-0009; https://security.paloaltonetworks.com/CVE-2024-0009
CVE: CVE-2024-0010
Published: 2024-02-14
Description: A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of a user’s browser) if a user clicks on a malicious link, allowing phishing attacks that could lead to credential theft.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2024-0010; https://security.paloaltonetworks.com/CVE-2024-0010
CVE: CVE-2024-0011
Published: 2024-02-14
Description: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of an authenticated Captive Portal user’s browser) if a user clicks on a malicious link, allowing phishing attacks that could lead to credential theft.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2024-0011; https://security.paloaltonetworks.com/CVE-2024-0011
CVE: CVE-2023-48229
Published: 2024-02-14
Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds write exists in the driver for IEEE 802.15.4 radios on nRF platforms in the Contiki-NG operating system. The problem is triggered when parsing radio frames in the `read_frame` function in the `arch/cpu/nrf/net/nrf-ieee-driver-arch.c` module. More specifically, the `read_frame` function performs an incomplete validation of the payload length of the packet, which is a value that can be set by an external party that sends radio packets to a Contiki-NG system. Although the value is validated to be in the range of the MTU length, it is not validated to fit into the given buffer into which the packet will be copied. The problem has been patched in the "develop" branch of Contiki-NG and is expected to be included in subsequent releases. Users are advised to update their develop branch or to update to a subsequent release when available. Users unable to upgrade should consider manually applying the changes in PR #2741.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/contiki-ng/contiki-ng/pull/2741; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-rcwv-xwc9-5hp2; https://github.com/contiki-ng/contiki-ng/pull/2741
CVE: CVE-2024-25300
Published: 2024-02-14
Description: A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WoodManGitHub/MyCVEs/blob/main/2024-REDAXO/XSS.md; https://github.com/WoodManGitHub/MyCVEs/blob/main/2024-REDAXO/XSS.md
CVE: CVE-2024-25301
Published: 2024-02-14
Description: Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/WoodManGitHub/MyCVEs/blob/main/2024-REDAXO/RCE.md; https://github.com/evildrummer/MyOwnCVEs/tree/main/CVE-2021-39459; https://github.com/WoodManGitHub/MyCVEs/blob/main/2024-REDAXO/RCE.md
CVE: CVE-2023-50926
Published: 2024-02-14
Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message contains a field that specifies the length of an IPv6 address prefix. The value of this field is not validated, which means that an attacker can set a value that is longer than the maximum prefix length. Subsequently, a memcmp function call that compares different prefixes can be called with a length argument that surpasses the boundary of the array allocated for the prefix, causing an out-of-bounds read. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in the next release. Users are advised to update as soon as they are able to or to manually apply the changes in Contiki-NG pull request #2721.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/contiki-ng/contiki-ng/pull/2721; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-jp4p-fq85-jch2; https://github.com/contiki-ng/contiki-ng/pull/2721
CVE: CVE-2023-50927
Published: 2024-02-14
Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. Users unable to upgrade should manually apply the code changes in PR #2484.
CVSS Score: 8.6 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/contiki-ng/contiki-ng/pull/2484; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9423-rgj4-wjfw; https://github.com/contiki-ng/contiki-ng/pull/2484
CVE: CVE-2024-1482
Published: 2024-02-14
Description: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Score: 7.1 (HIGH)
CWE: CWE-863, CWE-863
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5; https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10
CVE: CVE-2024-25165
Published: 2024-02-14
Description: A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compiler.flex.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/matthiaskramm/swftools/issues/217; https://github.com/matthiaskramm/swftools/issues/217
CVE: CVE-2024-25617
Published: 2024-02-14
Description: Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-182, CWE-400
References: https://github.com/squid-cache/squid/commit/72a3bbd5e431597c3fdb56d752bc56b010ba3817; https://github.com/squid-cache/squid/security/advisories/GHSA-h5x6-w8mv-xfpr; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-25618
Published: 2024-02-14
Description: Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML, OIDC) to attach to existing local users with the same e-mail address. This results in a possible account takeover if the authentication provider allows changing the e-mail address or multiple authentication providers are configured. When a user logs in through an external authentication provider for the first time, Mastodon checks the e-mail address passed by the provider to find an existing account. However, using the e-mail address alone means that if the authentication provider allows changing the e-mail address of an account, the Mastodon account can immediately be hijacked. All users logging in through external authentication providers are affected. The severity is medium, as it also requires the external authentication provider to misbehave. However, some well-known OIDC providers (like Microsoft Azure) make it very easy to accidentally allow unverified e-mail changes. Moreover, OpenID Connect also allows dynamic client registration. This issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-287, CWE-306
References: https://github.com/mastodon/mastodon/commit/b31af34c9716338e4a32a62cc812d1ca59e88d15; https://github.com/mastodon/mastodon/security/advisories/GHSA-vm39-j3vx-pch3; https://github.com/mastodon/mastodon/commit/b31af34c9716338e4a32a62cc812d1ca59e88d15
CVE: CVE-2024-25619
Published: 2024-02-14
Description: Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue listening to streaming after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the relationship between Applications and Access Tokens, it uses a `dependent: delete_all` configuration, which means the `after_commit` callback setup on `AccessTokenExtension` didn't actually fire, since `delete_all` doesn't trigger ActiveRecord callbacks. To mitigate, we need to add a `before_destroy` callback to `ApplicationExtension` which announces to streaming that all the Application's Access Tokens are being "killed". Impact should be negligible given the affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workaround for this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-613, CWE-672, CWE-613, CWE-672
References: https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71; https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x; https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71
CVE: CVE-2023-48733
Published: 2024-02-14
Description: An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1188
References: https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137; https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139; https://lists.debian.org/debian-lts-announce/2024/06/msg00028.html
CVE: CVE-2023-49721
Published: 2024-02-14
Description: An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137; https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139; https://nvd.nist.gov/vuln/detail/CVE-2023-48733
CVE: CVE-2024-1367
Published: 2024-02-14
Description: 
A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host. 


CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.tenable.com/security/tns-2024-02; https://www.tenable.com/security/tns-2024-02
CVE: CVE-2024-1471
Published: 2024-02-14
Description: 
An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to HTML redirection attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://www.tenable.com/security/tns-2024-02; https://www.tenable.com/security/tns-2024-02
CVE: CVE-2022-48219
Published: 2024-02-14
Description: Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-693
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]0920-16/hpsbhf03907; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]0920-16/hpsbhf03907
CVE: CVE-2022-48220
Published: 2024-02-14
Description: Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-203
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]0920-16/hpsbhf03907; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]0920-16/hpsbhf03907
CVE: CVE-2023-6138
Published: 2024-02-14
Description: A potential security vulnerability has been identified in the system BIOS for certain HP Workstation PCs, which might allow escalation of privilege, arbitrary code execution, or denial of service. HP is releasing mitigation for the potential vulnerability.
CVSS Score: 7.9 (HIGH)
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]7908-16/hpsbhf03915; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]7908-16/hpsbhf03915
CVE: CVE-2024-24300
Published: 2024-02-14
Description: 4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, the content of the cookie remains unchanged.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/yckuo-sdc/PoC; https://github.com/yckuo-sdc/PoC
CVE: CVE-2024-24301
Published: 2024-02-14
Description: Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/yckuo-sdc/PoC; https://github.com/yckuo-sdc/PoC
CVE: CVE-2024-25620
Published: 2024-02-15
Description: Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the `Chart.yaml` file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Users unable to upgrade should check all charts used by Helm for path changes in their name as found in the `Chart.yaml` file. This includes dependencies.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/helm/helm/commit/0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503; https://github.com/helm/helm/security/advisories/GHSA-v53g-5gjp-272r; https://github.com/helm/helm/commit/0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503
CVE: CVE-2024-1523
Published: 2024-02-15
Description: EC-WEB FS-EZViewer(Web)'s query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo privilege in the database for privilege escalation, elevating their privileges to administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7672-7eeac-1.html; https://www.twcert.org.tw/tw/cp-132-7672-7eeac-1.html
CVE: CVE-2024-26260
Published: 2024-02-15
Description: The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96; https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html; https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96
CVE: CVE-2024-26261
Published: 2024-02-15
Description: The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96; https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html; https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96
CVE: CVE-2024-26262
Published: 2024-02-15
Description: EBM Technologies Uniweb/SoliPACS WebServer's query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo privilege in the database for privilege escalation, elevating their privileges to administrator .
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html; https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html
CVE: CVE-2024-26263
Published: 2024-02-15
Description: EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data without login.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://www.twcert.org.tw/tw/cp-132-7676-9418d-1.html; https://www.twcert.org.tw/tw/cp-132-7676-9418d-1.html
CVE: CVE-2024-26264
Published: 2024-02-15
Description: EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7677-b1c0f-1.html; https://www.twcert.org.tw/tw/cp-132-7677-b1c0f-1.html
CVE: CVE-2022-23084
Published: 2024-02-15
Description: The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin.  This time-of-check to time-of-use bug could lead to kernel memory corruption.

On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.
CVSS Score: 7.5 (HIGH)
CWE: CWE-367, CWE-367
References: https://security.freebsd.org/advisories/FreeBSD-SA-22:04.netmap.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.freebsd.org/advisories/FreeBSD-SA-22:04.netmap.asc
CVE: CVE-2022-23085
Published: 2024-02-15
Description: A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow.  This insufficient bounds checking could lead to kernel memory corruption.

On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-120
References: https://security.freebsd.org/advisories/FreeBSD-SA-22:04.netmap.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.freebsd.org/advisories/FreeBSD-SA-22:04.netmap.asc
CVE: CVE-2022-23086
Published: 2024-02-15
Description: Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header.  Other heap content would be overwritten if the specified size was too small.

Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation.  Note that the device node is only accessible to root and members of the operator group.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-122
References: https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc