deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38296
Published: 2024-04-22
Description: Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: TCL 30Z (TCL/4188R/Jetta_ATT:12/SP1A.210812.016/LV8E:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU5P:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU61:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU66:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU68:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6P:user/release-keys, and TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6X:user/release-keys) and TCL A3X (TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAAZ:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB3:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB7:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABA:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABM:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABP:user/release-keys, and TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABS:user/release-keys). This malicious app reads from the "persist.sys.tctPowerIccid" system property to indirectly obtain the ICCID.
CVSS Score: 8.0 (HIGH)
CWE: CWE-200, CWE-266, CWE-284
References: https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf; https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf
CVE: CVE-2023-38298
Published: 2024-04-22
Description: Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: TCL 30Z (TCL/4188R/Jetta_ATT:12/SP1A.210812.016/LV8E:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU5P:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU61:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU66:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU68:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6P:user/release-keys, and TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6X:user/release-keys); TCL A3X (TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAAZ:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB3:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB7:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABA:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABM:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABP:user/release-keys, and TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABS:user/release-keys); TCL 20XE (TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB7I-0:user/release-keys and TCL/5087Z_BO/Doha_TMO:11/RP1A.200720.011/PB83-0:user/release-keys); and TCL 10L (TCL/T770B/T1_LITE:10/QKQ1.200329.002/3CJ0:user/release-keys and TCL/T770B/T1_LITE:11/RKQ1.210107.001/8BIC:user/release-keys). This malicious app reads from the "gsm.device.imei0" system property to indirectly obtain the device IMEI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266, CWE-280, CWE-284
References: https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf; https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf
CVE: CVE-2023-38299
Published: 2024-04-22
Description: Various software builds for the AT&T Calypso, Nokia C100, Nokia C200, and BLU View 3 devices leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: AT&T Calypso (ATT/U318AA/U318AA:10/QP1A.190711.020/[PII_REDACTED]:user/release-keys); Nokia C100 (Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_190:user/release-keys and Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_270:user/release-keys); Nokia C200 (Nokia/Drake_02US/DRK:12/SP1A.210812.016/02US_1_080:user/release-keys); and BLU View 3 (BLU/B140DL/B140DL:11/RP1A.200720.011/[PII_REDACTED]:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/[PII_REDACTED]:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/[PII_REDACTED]:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/[PII_REDACTED]:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/[PII_REDACTED]:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/[PII_REDACTED]:user/release-keys, and BLU/B140DL/B140DL:11/RP1A.200720.011/[PII_REDACTED]:user/release-keys). This malicious app reads from the "persist.sys.imei1" system property to indirectly obtain the device IMEI.
CVSS Score: 5.5 (MEDIUM)
References: https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf; https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf
CVE: CVE-2023-38300
Published: 2024-04-22
Description: A certain software build for the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys) leaks the IMEI and the ICCID to system properties that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in this instance they are leaked by a high-privilege process and can be obtained indirectly. This malicious app reads from the "persist.sys.verizon_test_plan_imei" system property to indirectly obtain the IMEI and reads the "persist.sys.verizon_test_plan_iccid" system property to obtain the ICCID.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf; https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf
CVE: CVE-2023-38301
Published: 2024-04-22
Description: An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. Various software builds for the BLU View 2, Boost Mobile Celero 5G, Sharp Rouvo V, Motorola Moto G Pure, Motorola Moto G Power, T-Mobile Revvl 6 Pro 5G, and T-Mobile Revvl V+ 5G devices leak the device serial number to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: BLU View 2 (BLU/B131DL/B130DL:11/RP1A.200720.011/[PII_REDACTED]:user/release-keys); Boost Mobile Celero 5G (Celero5G/Jupiter/Jupiter:11/RP1A.200720.011/SW_S98119AA1_V067:user/release-keys); Sharp Rouvo V (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys); Motorola Moto G Pure (motorola/ellis_trac/ellis:11/RRHS31.Q3-46-110-2/74844:user/release-keys, motorola/ellis_trac/ellis:11/RRHS31.Q3-46-110-7/5cde8:user/release-keys, motorola/ellis_trac/ellis:11/RRHS31.Q3-46-110-10/d67faa:user/release-keys, motorola/ellis_trac/ellis:11/RRHS31.Q3-46-110-13/b4a29:user/release-keys, motorola/ellis_trac/ellis:12/S3RH32.20-42-10/1c2540:user/release-keys, motorola/ellis_trac/ellis:12/S3RHS32.20-42-13-2-1/6368dd:user/release-keys, motorola/ellis_a/ellis:11/RRH31.Q3-46-50-2/20fec:user/release-keys, motorola/ellis_vzw/ellis:11/RRH31.Q3-46-138/103bd:user/release-keys, motorola/ellis_vzw/ellis:11/RRHS31.Q3-46-138-2/e5502:user/release-keys, and motorola/ellis_vzw/ellis:12/S3RHS32.20-42-10-14-2/5e0b0:user/release-keys); Motorola Moto G Power (motorola/tonga_g/tonga:11/RRQ31.Q3-68-16-2/e5877:user/release-keys and motorola/tonga_g/tonga:12/S3RQS32.20-42-10-6/f876d3:user/release-keys); T-Mobile Revvl 6 Pro 5G (T-Mobile/Augusta/Augusta:12/SP1A.210812.016/SW_S98121AA1_V070:user/release-keys); and T-Mobile Revvl V+ 5G (T-Mobile/Sprout/Sprout:11/RP1A.200720.011/SW_S98115AA1_V077:user/release-keys). This malicious app reads from the "vendor.gsm.serial" system property to indirectly obtain the device serial number.
CVSS Score: 3.4 (LOW)
CWE: CWE-200
References: https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf; https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf
CVE: CVE-2023-38302
Published: 2024-04-22
Description: A certain software build for the Sharp Rouvo V device (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys) leaks the Wi-Fi MAC address and the Bluetooth MAC address to system properties that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in this instance they are leaked by a high-privilege process and can be obtained indirectly. This malicious app reads from the "ro.boot.wifi_mac" system property to indirectly obtain the Wi-Fi MAC address and reads the "ro.boot.bt_mac" system property to obtain the Bluetooth MAC address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf; https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf
CVE: CVE-2024-28699
Published: 2024-04-22
Description: A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://pdf2json.com; https://github.com/flexpaper/pdf2json; https://github.com/flexpaper/pdf2json/issues/52
CVE: CVE-2024-28436
Published: 2024-04-22
Description: Cross Site Scripting vulnerability in D-Link DAP products DAP-2230, DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2590, DAP-2690, DAP-2695, DAP-3520, DAP-3662 allows a remote attacker to execute arbitrary code via the reload parameter in the session_login.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://djallalakira.medium.com/cve-2024-28436-cross-site-scripting-vulnerability-in-d-link-dap-products-3596976cc99f; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10380; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10382
CVE: CVE-2022-46897
Published: 2024-04-22
Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The CapsuleIFWUSmm driver does not check the return value from a method or function. This can prevent it from detecting unexpected states and conditions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-252
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge
CVE: CVE-2024-31666
Published: 2024-04-22
Description: An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/hapa3/cms/blob/main/1.md; https://github.com/hapa3/cms/blob/main/1.md
CVE: CVE-2024-29376
Published: 2024-04-22
Description: Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/r2tunes/Reports/blob/main/Sylius.md; https://github.com/r2tunes/Reports/blob/main/Sylius.md
CVE: CVE-2024-31545
Published: 2024-04-22
Description: Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manage_user&id=6.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://github.com/emirhanmtl/vuln-research/blob/main/SQLi-4-Computer-Laboratory-Management-System-PoC.md; https://github.com/emirhanmtl/vuln-research/blob/main/SQLi-4-Computer-Laboratory-Management-System-PoC.md
CVE: CVE-2024-32407
Published: 2024-04-22
Description: An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://book.hacktricks.xyz/v/jp/pentesting-web/ssti-server-side-template-injection; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://book.hacktricks.xyz/v/jp/pentesting-web/ssti-server-side-template-injection
CVE: CVE-2024-32205
Published: 2024-04-22
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-32238
Published: 2024-04-22
Description: H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/asdfjkl11/CVE-2024-32238/issues/1; https://www.h3c.com/cn/Products_And_Solution/InterConnect/Products/Routers/Products/Enterprise/ER/ER8300G2-X/; https://github.com/asdfjkl11/CVE-2024-32238/issues/1
CVE: CVE-2024-32399
Published: 2024-04-22
Description: Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ component.
CVSS Score: 7.6 (HIGH)
CWE: CWE-22
References: https://github.com/NN0b0dy/CVE-2024-32399/blob/main/README.md; https://github.com/NN0b0dy/c01/blob/main/01.pdf; https://github.com/NN0b0dy/CVE-2024-32399/blob/main/README.md
CVE: CVE-2024-32405
Published: 2024-04-22
Description: Cross Site Scripting vulnerability in inducer relate before v.2024.1 allows a remote attacker to escalate privileges via a crafted payload to the Answer field of InlineMultiQuestion parameter on Exam function.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/178101/Relate-Cross-Site-Scripting.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2024-4040
Published: 2024-04-22
Description: A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1336, CWE-94
References: https://github.com/airbus-cert/CVE-2024-4040; https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/; https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update
CVE: CVE-2024-27574
Published: 2024-04-22
Description: SQL Injection vulnerability in Trainme Academy version Ichin v.1.3.2 allows a remote attacker to obtain sensitive information via the informacion, idcurso, and tit parameters.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/7WaySecurity/vulnerabilities/tree/main; https://github.com/7WaySecurity/vulnerabilities/tree/main
CVE: CVE-2024-29368
Published: 2024-04-22
Description: An arbitrary file upload vulnerability in the file handling module of moziloCMS v2.0 allows attackers to bypass extension restrictions via file renaming, potentially leading to unauthorized file execution or storage of malicious content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/becpn/mozilocms; https://github.com/becpn/mozilocms
CVE: CVE-2024-32039
Published: 2024-04-22
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787, CWE-190, CWE-787
References: https://github.com/FreeRDP/FreeRDP/pull/10077; https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6; https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
CVE: CVE-2024-32040
Published: 2024-04-22
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).
CVSS Score: 8.1 (HIGH)
CWE: CWE-191, CWE-191
References: https://github.com/FreeRDP/FreeRDP/pull/10077; https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6; https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
CVE: CVE-2024-32041
Published: 2024-04-22
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/pull/10077; https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6; https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
CVE: CVE-2024-32394
Published: 2024-04-22
Description: An issue in ruijie.com/cn RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S_07150910 and RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S_07150910 allows a remote attacker to execute arbitrary code via a crafted HTTP request.
CVSS Score: 8.8 (HIGH)
References: https://gist.github.com/Swind1er/7aad5c28e5bdc91d73fa7489b7250c94; https://gist.github.com/Swind1er/7aad5c28e5bdc91d73fa7489b7250c94
CVE: CVE-2024-32458
Published: 2024-04-22
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/pull/10077; https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6; https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
CVE: CVE-2024-31036
Published: 2024-04-22
Description: A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmission of crafted hexstreams.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-122
References: https://github.com/nanomq/nanomq/issues/1722; https://github.com/nanomq/nanomq/issues/1722
CVE: CVE-2024-32459
Published: 2024-04-22
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/pull/10077; https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6; https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
CVE: CVE-2024-32460
Published: 2024-04-22
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/pull/10077; https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6; https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
CVE: CVE-2024-32461
Published: 2024-04-22
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to version 24.4.0 allows a user with global read privileges to execute SQL commands via the package parameter. With this vulnerability, an attacker can exploit a SQL injection time based vulnerability to extract all data from the database, such as administrator credentials. Version 24.4.0 contains a patch for the vulnerability.

CVSS Score: 7.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://doc.clickup.com/[PII_REDACTED]/p/h/8ckm0bc-53/16811991bb5fff6; https://github.com/librenms/librenms/commit/d29201fce134347f891102699fbde7070debee33; https://github.com/librenms/librenms/security/advisories/GHSA-cwx6-cx7x-4q34
CVE: CVE-2024-32479
Published: 2024-04-22
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the `Service` template name, which can lead to stored Cross-site Scripting. Version 24.4.0 fixes this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/librenms/librenms/blob/a61c11db7e8ef6a437ab55741658be2be7d14d34/app/Http/Controllers/ServiceTemplateController.php#L67C23-L67C23; https://github.com/librenms/librenms/commit/19344f0584d4d6d4526fdf331adc60530e3f685b; https://github.com/librenms/librenms/security/advisories/GHSA-72m9-7c8x-pmmw