deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39818
Published: 2024-08-14
Description: Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24022
CVE: CVE-2024-39822
Published: 2024-08-14
Description: Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an information disclosure via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24029
CVE: CVE-2024-39823
Published: 2024-08-14
Description: Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-862
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24030
CVE: CVE-2024-39824
Published: 2024-08-14
Description: Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-862
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24030
CVE: CVE-2024-39825
Published: 2024-08-14
Description: Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.
CVSS Score: 8.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24022
CVE: CVE-2024-42434
Published: 2024-08-14
Description: Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-862
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24030
CVE: CVE-2024-42435
Published: 2024-08-14
Description: Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24030
CVE: CVE-2024-42436
Published: 2024-08-14
Description: Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24031
CVE: CVE-2024-42437
Published: 2024-08-14
Description: Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24031
CVE: CVE-2024-42438
Published: 2024-08-14
Description: Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24031
CVE: CVE-2024-42439
Published: 2024-08-14
Description: Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-426, CWE-426
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24032
CVE: CVE-2024-42440
Published: 2024-08-14
Description: Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-269
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24034
CVE: CVE-2024-42441
Published: 2024-08-14
Description: Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-266
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24034
CVE: CVE-2024-5914
Published: 2024-08-14
Description: A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://security.paloaltonetworks.com/CVE-2024-5914
CVE: CVE-2024-5915
Published: 2024-08-14
Description: A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://security.paloaltonetworks.com/CVE-2024-5915
CVE: CVE-2024-5916
Published: 2024-08-14
Description: An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to external systems.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-313, CWE-312
References: https://security.paloaltonetworks.com/CVE-2024-5916
CVE: CVE-2023-50314
Published: 2024-08-14
Description: IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks.  An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information.  IBM X-Force ID:  274713.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/274713; https://www.ibm.com/support/pages/node/7165502
CVE: CVE-2024-31882
Published: 2024-08-14
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service, under specific non default configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user.  IBM X-Force ID:  287614.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-943, CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287614; https://www.ibm.com/support/pages/node/7165338; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-35136
Published: 2024-08-14
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) federated server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain non default conditions.  IBM X-Force ID:  291307.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-943
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/291307; https://www.ibm.com/support/pages/node/7165341; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-35152
Published: 2024-08-14
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. IBM X-Force ID:  292639.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-789
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/292639; https://www.ibm.com/support/pages/node/7165342; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-37529
Published: 2024-08-14
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation.  IBM X-Force ID:  294295.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-789
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/292639; https://www.ibm.com/support/pages/node/7165342; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-7792
Published: 2024-08-14
Description: A vulnerability was found in SourceCodester Task Progress Tracker 1.0. It has been classified as critical. Affected is an unknown function of the file /endpoint/delete-task.php. The manipulation of the argument task leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/Task-Progress-Tracker/Task-Progress-Trackersql.md; https://vuldb.com/?ctiid.274560; https://vuldb.com/?id.274560
CVE: CVE-2024-27120
Published: 2024-08-14
Description: A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticated attacker may retrieve sensitive information about the underlying system. The vulnerability has been remediated in version 24.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-22
References: https://csirt.divd.nl/CVE-2024-27120; https://csirt.divd.nl/DIVD-2024-00031/
CVE: CVE-2024-40619
Published: 2024-08-14
Description: CVE-2024-40619 IMPACT

A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201690.html
CVE: CVE-2024-40620
Published: 2024-08-14
Description: CVE-2024-40620 IMPACT

A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the data's confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-311
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201691.html
CVE: CVE-2024-42360
Published: 2024-08-14
Description: SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/wurmlab/sequenceserver/commit/457e52709f7f9ed2fceed59b3db564cb50785dba; https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h
CVE: CVE-2024-6078
Published: 2024-08-14
Description: CVE-2024-6078 IMPACT

An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any user ID without the use of a username or password. If exploited, a malicious user could take over the account of a legitimate user. The malicious user would be able to view and modify data stored in the cloud.
CWE: CWE-287
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201687.html
CVE: CVE-2024-7507
Published: 2024-08-14
Description: CVE-2024-7507 IMPACT

A denial-of-service vulnerability exists in the affected products.  This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201685.html
CVE: CVE-2024-7513
Published: 2024-08-14
Description: CVE-2024-7513 IMPACT

A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing any user to edit or replace files, which are executed by account with elevated permissions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201688.html
CVE: CVE-2024-7515
Published: 2024-08-14
Description: CVE-2024-7515 IMPACT

A denial-of-service vulnerability exists in the affected products. A malformed PTP management packet can cause a major nonrecoverable fault in the controller.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201686.html
CVE: CVE-2024-42353
Published: 2024-08-14
Description: WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/Pylons/webob/commit/f689bcf4f0a1f64f1735b1d5069aef5be6974b5b; https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3
CVE: CVE-2024-7793
Published: 2024-08-14
Description: A vulnerability was found in SourceCodester Task Progress Tracker 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-task.php. The manipulation of the argument task_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/joinia/webray.com.cn/blob/main/Task-Progress-Tracker/Task-Progress-Trackerxss.md; https://vuldb.com/?ctiid.274561; https://vuldb.com/?id.274561
CVE: CVE-2024-7794
Published: 2024-08-14
Description: A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file mybill.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/ppp-src/ha/issues/5; https://vuldb.com/?ctiid.274562; https://vuldb.com/?id.274562
CVE: CVE-2024-43368
Published: 2024-08-14
Description: The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a `text/html` content type. However, Trix only checks the content type on the paste event's `dataTransfer` object. As long as the `dataTransfer` has a content type of `text/html`, Trix parses its contents and creates an `Attachment` with them, even if the attachment itself doesn't have a `text/html` content type. Trix then uses the attachment content to set the attachment element's `innerHTML`. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This vulnerability was fixed in version 2.1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/basecamp/trix/commit/7656f578af0d03141a72a9d27cb3692e6947dae6; https://github.com/basecamp/trix/pull/1149; https://github.com/basecamp/trix/pull/1156
CVE: CVE-2024-7625
Published: 2024-08-15
Description: In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-610
References: https://discuss.hashicorp.com/t/hcsec-2024-17-nomad-vulnerable-to-allocation-directory-escape-on-non-existing-file-paths-through-archive-unpacking/69293
CVE: CVE-2024-7797
Published: 2024-08-15
Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. Affected is an unknown function of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql.md; https://vuldb.com/?ctiid.274650; https://vuldb.com/?id.274650
CVE: CVE-2024-7798
Published: 2024-08-15
Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login2. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql2.md; https://vuldb.com/?ctiid.274651; https://vuldb.com/?id.274651
CVE: CVE-2024-7799
Published: 2024-08-15
Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/bidding/admin/users.php. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/Wsstiger/cve/blob/main/Sourcecoster_unauthorized.md; https://vuldb.com/?ctiid.274652; https://vuldb.com/?id.274652
CVE: CVE-2024-7800
Published: 2024-08-15
Description: A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=delete_product. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql3.md; https://vuldb.com/?ctiid.274653; https://vuldb.com/?id.274653
CVE: CVE-2024-7808
Published: 2024-08-15
Description: A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file logindbc.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/XYgit-99/cve/issues/1; https://vuldb.com/?ctiid.274704; https://vuldb.com/?id.274704
CVE: CVE-2024-7809
Published: 2024-08-15
Description: A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /tracking/nbproject/. The manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-548
References: https://github.com/Wsstiger/cve/blob/main/Tracer_mu.md; https://vuldb.com/?ctiid.274705; https://vuldb.com/?id.274705
CVE: CVE-2024-7810
Published: 2024-08-15
Description: A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tracking/admin/view_itprofile.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Wsstiger/cve/blob/main/Tracer_sql.md; https://vuldb.com/?ctiid.274706; https://vuldb.com/?id.274706
CVE: CVE-2024-25024
Published: 2024-08-15
Description: IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user.  IBM X-Force ID:  281430.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-256
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/281430; https://www.ibm.com/support/pages/node/7165488
CVE: CVE-2024-6533
Published: 2024-08-15
Description: Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://directus.io/; https://fluidattacks.com/advisories/bocelli
CVE: CVE-2024-7420
Published: 2024-08-15
Description: The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missing or incorrect nonce validation in the /admin/snippets.php file. This makes it possible for unauthenticated attackers to activate/deactivate and delete code snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-43275 appears to be a duplicate of this issue.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/insert-php-code-snippet/trunk/admin/snippets.php#L28; https://plugins.trac.wordpress.org/changeset/3134787/insert-php-code-snippet/trunk/admin/snippets.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/88001f3c-f5cc-4051-a713-788014e2241a?source=cve
CVE: CVE-2024-7624
Published: 2024-08-15
Description: The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285, CWE-863
References: https://plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Base/AjaxHandler.php?rev=3111536#L2464; https://plugins.trac.wordpress.org/changeset/3134404/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ef344d-cd56-43f9-b185-de83a92800de?source=cve