deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-41731
Published: 2024-08-13
Description: SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On successful exploitation,
the attacker can cause a low impact on the Integrity of the application.
CVSS Score: 3.1 (LOW)
CWE: CWE-434
References: https://me.sap.com/notes/3433545; https://me.sap.com/notes/3515653; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-41732
Published: 2024-08-13
Description: SAP NetWeaver Application Server ABAP allows
  an unauthenticated attacker to craft a URL link that could bypass allowlist
  controls. Depending on the web applications provided by this server, the
  attacker might inject CSS code or links into the web application that could
  allow the attacker to read or modify information. There is no impact on
  availability of application.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284
References: https://me.sap.com/notes/3468102; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-41733
Published: 2024-08-13
Description: In SAP Commerce, valid user accounts can be
identified during the customer registration and login processes. This allows a
potential attacker to learn if a given e-mail is used for an account, but does
not grant access to any customer data beyond this knowledge. The attacker must
already know the e-mail that they wish to test for. The impact on
confidentiality therefore is low and no impact to integrity or availability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://me.sap.com/notes/3471450; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-41735
Published: 2024-08-13
Description: SAP Commerce Backoffice does not sufficiently
encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)
vulnerability causing low impact on confidentiality and integrity of the
application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3483256; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-41736
Published: 2024-08-13
Description: Under certain conditions SAP Permit to Work
allows an authenticated attacker to access information which would otherwise be
restricted causing low impact on the confidentiality of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://me.sap.com/notes/3475427; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-41737
Published: 2024-08-13
Description: SAP CRM ABAP (Insights
Management) allows an authenticated attacker to enumerate HTTP endpoints in the
internal network by specially crafting HTTP requests. On successful
exploitation this can result in information disclosure. It has no impact on
integrity and availability of the application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://me.sap.com/notes/3487537; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-42374
Published: 2024-08-13
Description: BEx Web Java Runtime Export Web Service does not
sufficiently validate an XML document accepted from an untrusted source. An
attacker can retrieve information from the SAP ADS system and exhaust the
number of XMLForm service which makes the SAP ADS rendering (PDF creation)
unavailable. This affects the confidentiality and availability of the
application.
CVSS Score: 8.2 (HIGH)
CWE: CWE-91
References: https://me.sap.com/notes/3485284; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-42375
Published: 2024-08-13
Description: SAP BusinessObjects Business Intelligence
  Platform allows an authenticated attacker to upload malicious code over the
  network, that could be executed by the application. On successful exploitation,
  the attacker can cause a low impact on the Integrity of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://me.sap.com/notes/3433545; https://me.sap.com/notes/3515653; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-42376
Published: 2024-08-13
Description: SAP Shared Service Framework does not perform necessary
authorization check for an authenticated user, resulting in escalation of
privileges. On successful exploitation, an attacker can cause a high impact on
confidentiality of the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3474590; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-42377
Published: 2024-08-13
Description: SAP shared service framework allows an
authenticated non-administrative user to call a remote-enabled function, which
will allow them to insert value entries into a non-sensitive table, causing low
impact on integrity of the application
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3474590; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-39591
Published: 2024-08-13
Description: SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3477423; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-41734
Published: 2024-08-13
Description: Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3494349; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-42373
Published: 2024-08-13
Description: SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to delete non-sensitive report variants that are typically restricted, causing minimal impact on the integrity of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3479293; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-7092
Published: 2024-08-13
Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘no_more_items_text’ parameter in all versions up to, and including, 5.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://essential-addons.com/changelog/; https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php#L3879; https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php#L3900
CVE: CVE-2024-6724
Published: 2024-08-13
Description: The Generate Images  WordPress plugin before 5.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0cb3158a-263d-4c4a-8029-62b453c281cb/
CVE: CVE-2024-6823
Published: 2024-08-13
Description: The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings.php#L32; https://plugins.trac.wordpress.org/changeset/3133909/; https://wordpress.org/plugins/media-library-assistant/#developers
CVE: CVE-2024-7247
Published: 2024-08-13
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Gallery and Countdown widgets in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/bdt-uikit.js#L4223; https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/ep-scripts.js#L514; https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/ep-scripts.js#L576
CVE: CVE-2024-7715
Published: 2024-08-13
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240812. It has been classified as critical. This affects the function sprintf of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument filter leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_photo_search.md; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://vuldb.com/?ctiid.274281
CVE: CVE-2024-36398
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application executes a subset of its services as `NT AUTHORITY\SYSTEM`. This could allow a local attacker to execute operating system commands with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://cert-portal.siemens.com/productcert/html/ssa-784301.html
CVE: CVE-2024-39922
Published: 2024-08-13
Description: A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions). Affected devices store user passwords in plaintext without proper protection. This could allow a physical attacker to retrieve them from the embedded storage ICs.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-256
References: https://cert-portal.siemens.com/productcert/html/ssa-921449.html
CVE: CVE-2024-41681
Published: 2024-08-13
Description: A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured to support weak ciphers  by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-326
References: https://cert-portal.siemens.com/productcert/html/ssa-720392.html
CVE: CVE-2024-41682
Published: 2024-08-13
Description: A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restriction of  excessive authentication attempts. This could allow an unauthenticated remote attacker to conduct brute force attacks against legitimate user passwords.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://cert-portal.siemens.com/productcert/html/ssa-720392.html
CVE: CVE-2024-41683
Published: 2024-08-13
Description: A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-521
References: https://cert-portal.siemens.com/productcert/html/ssa-720392.html
CVE: CVE-2024-41903
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application mounts the container's root filesystem with read and write privileges. This could allow an attacker to alter the container's filesystem leading to unauthorized modifications and data corruption.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269
References: https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE: CVE-2024-41904
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not properly enforce restriction of  excessive authentication attempts. This could allow an unauthenticated attacker to conduct brute force attacks against legitimate user credentials or keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE: CVE-2024-41905
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not have access control for accessing the files. This could allow an authenticated attacker with low privilege's to get access to sensitive information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE: CVE-2024-41906
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not properly handle cacheable HTTP responses in the web service. This could allow an attacker to read and modify data stored in the local cache.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-524
References: https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE: CVE-2024-41907
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missing general HTTP security headers in the web server. This could allow an attacker to make the servers more prone to clickjacking attack.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-358
References: https://cert-portal.siemens.com/productcert/html/ssa-716317.html
CVE: CVE-2024-41908
Published: 2024-08-13
Description: A vulnerability has been identified in NX (All versions < V2406.3000). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-357412.html
CVE: CVE-2024-41938
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The importCertificate function of the SINEC NMS Control web application contains a path traversal vulnerability. This could allow an authenticated attacker it to delete arbitrary certificate files on the drive SINEC NMS is installed on.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/html/ssa-784301.html
CVE: CVE-2024-41939
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and elevate their privileges on the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://cert-portal.siemens.com/productcert/html/ssa-784301.html
CVE: CVE-2024-41940
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a privileged command queue. This could allow an authenticated attacker to execute OS commands with elevated privileges.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-784301.html
CVE: CVE-2024-41941
Published: 2024-08-13
Description: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and modify settings in the application without authorization.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://cert-portal.siemens.com/productcert/html/ssa-784301.html
CVE: CVE-2024-41976
Published: 2024-08-13
Description: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices do not properly validate input in specific VPN configuration fields. This could allow an authenticated remote attacker to execute arbitrary code on the device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-087301.html
CVE: CVE-2024-41977
Published: 2024-08-13
Description: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices do not properly enforce isolation between user sessions in their web server component. This could allow an authenticated remote attacker to escalate their privileges on the devices.
CVSS Score: 7.1 (HIGH)
CWE: CWE-488
References: https://cert-portal.siemens.com/productcert/html/ssa-087301.html
CVE: CVE-2024-41978
Published: 2024-08-13
Description: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices insert sensitive information about the generation of 2FA tokens into log files. This could allow an authenticated remote attacker to forge 2FA tokens of other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://cert-portal.siemens.com/productcert/html/ssa-087301.html
CVE: CVE-2024-37935
Published: 2024-08-13
Description: Missing Authorization vulnerability in anhvnit Woocommerce OpenPos allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woocommerce OpenPos: from n/a through 6.4.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-openpos/wordpress-woocommerce-openpos-plugin-6-4-4-unauthenticated-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-38688
Published: 2024-08-13
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.