deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-54212
Published: 2024-12-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/magical-addons-for-elementor/vulnerability/wordpress-magical-addons-for-elementor-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54213
Published: 2024-12-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zionbuilder ZionBuilder zionbuilder allows Stored XSS.This issue affects ZionBuilder: from n/a through <= 3.6.16.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/zionbuilder/vulnerability/wordpress-wordpress-page-builder-zion-builder-plugin-3-6-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54214
Published: 2024-12-06
Description: Unrestricted Upload of File with Dangerous Type vulnerability in roninwp Revy revy allows Upload a Web Shell to a Web Server.This issue affects Revy: from n/a through <= 1.18.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/revy/vulnerability/wordpress-revy-plugin-1-18-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-54216
Published: 2024-12-06
Description: Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms arforms allows Path Traversal.This issue affects ARForms: from n/a through <= 6.4.1.
CVSS Score: 7.7 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/arforms/vulnerability/wordpress-arforms-plugin-6-4-1-subscriber-arbitrary-file-read-vulnerability?_s_id=cve
CVE: CVE-2024-11738
Published: 2024-12-06
Description: A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-248
References: https://access.redhat.com/security/cve/CVE-2024-11738; https://bugzilla.redhat.com/show_bug.cgi?id=2328732; https://github.com/advisories/GHSA-qg5g-gv98-5ffh
CVE: CVE-2024-42196
Published: 2024-12-06
Description: HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117910
CVE: CVE-2024-54141
Published: 2024-12-06
Description: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-209
References: https://github.com/thorsten/phpMyFAQ/commit/b9289a0b2233df864361c131cd177b6715fbb0fe; https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-vrjr-p3xp-xx2x
CVE: CVE-2024-12254
Published: 2024-12-06
Description: Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()
 method would not "pause" writing and signal to the Protocol to drain 
the buffer to the wire once the write buffer reached the "high-water 
mark". Because of this, Protocols would not periodically drain the write
 buffer potentially leading to memory exhaustion.





This
 vulnerability likely impacts a small number of users, you must be using
 Python 3.12.0 or later, on macOS or Linux, using the asyncio module 
with protocols, and using .writelines() method which had new 
zero-copy-on-write behavior in Python 3.12.0 and later. If not all of 
these factors are true then your usage of Python is unaffected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770, CWE-770
References: https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82; https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5; https://github.com/python/cpython/commit/e991ac8f2037d78140e417cc9a9486223eb3e786
CVE: CVE-2024-30129
Published: 2024-12-06
Description: The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-644
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117533
CVE: CVE-2024-50677
Published: 2024-12-06
Description: A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZumiYumi/CVE-2024-50677; https://github.com/oroinc/orocommerce-application
CVE: CVE-2024-54135
Published: 2024-12-06
Description: ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/photo_upload.php  within the decode_key function. User inputs were supplied to this function without sanitization via collection GET parameter and photoIDS POST parameter respectively. The decode_key function invokes PHP unserialize function as defined in upload/includes/classes/photos.class.php. As a result, it is possible for an adversary to inject maliciously crafted PHP serialized object and utilize gadget chains to cause unexpected behaviors of the application. This vulnerability is fixed in 5.5.1 Revision 200.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/MacWarrior/clipbucket-v5/commit/76a829c088f0813ab3244a3bd[PII_REDACTED]409b0; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-4523-mqmv-wrqx
CVE: CVE-2024-54136
Published: 2024-12-06
Description: ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to unserialize function. As a result, it is possible for an adversary to inject maliciously crafted PHP serialized object and utilize gadget chains to cause unexpected behaviors of the application. This vulnerability is fixed in 5.5.1 Revision 200.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/MacWarrior/clipbucket-v5/commit/76a829c088f0813ab3244a3bd[PII_REDACTED]409b0; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-vxvf-5cmq-5f78
CVE: CVE-2024-54137
Published: 2024-12-06
Description: liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext. This vulnerability is fixed in 0.12.0.
CVSS Score: 7.4 (HIGH)
CWE: CWE-200
References: https://github.com/open-quantum-safe/liboqs/commit/cce1bfde4e52c524b087b9687020d283fbde0f24; https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7
CVE: CVE-2024-54745
Published: 2024-12-06
Description: WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://colorful-meadow-5b9.notion.site/WN701AE_HardCode_vuln-14ac216a1c308015b571e68810d83e16?pvs=4; https://docs.wavlink.xyz/Firmware_ch/fm-701e/
CVE: CVE-2024-54747
Published: 2024-12-06
Description: WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://colorful-meadow-5b9.notion.site/WN531P3_HardCode_vuln-14ac216a1c30805c9b4dd59028d866cc?pvs=73; https://docs.wavlink.xyz/Firmware_ch/fm-531p3/
CVE: CVE-2024-54750
Published: 2024-12-06
Description: Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: In Ubiquiti's view there is no vulnerability as the Hardcoded Password should be after setup not before.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://colorful-meadow-5b9.notion.site/U6-LR_HardCode_vuln-14bc216a1c30806487ebdda3bb984e91?pvs=4
CVE: CVE-2024-48859
Published: 2024-12-06
Description: An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following versions:
QTS 5.1.9.2954 build 20241120 and later
QTS 5.2.2.2950 build 20241114 and later
QuTS hero h5.1.9.2954 build 20241120 and later
QuTS hero h5.2.2.2952 build 20241116 and later
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://www.qnap.com/en/security-advisory/qsa-24-49
CVE: CVE-2024-48863
Published: 2024-12-06
Description: A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
License Center 1.9.43 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-50
CVE: CVE-2024-48865
Published: 2024-12-06
Description: An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow attackers with local network access to compromise the security of the system.

We have already fixed the vulnerability in the following versions:
QTS 5.1.9.2954 build 20241120 and later
QTS 5.2.2.2950 build 20241114 and later
QuTS hero h5.1.9.2954 build 20241120 and later
QuTS hero h5.2.2.2952 build 20241116 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-24-49
CVE: CVE-2024-48866
Published: 2024-12-06
Description: An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to run the system into unexpected state.

We have already fixed the vulnerability in the following versions:
QTS 5.1.9.2954 build 20241120 and later
QTS 5.2.2.2950 build 20241114 and later
QuTS hero h5.1.9.2954 build 20241120 and later
QuTS hero h5.2.2.2952 build 20241116 and later
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-177
References: https://www.qnap.com/en/security-advisory/qsa-24-49
CVE: CVE-2024-48867
Published: 2024-12-06
Description: An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data.

We have already fixed the vulnerability in the following versions:
QTS 5.1.9.2954 build 20241120 and later
QTS 5.2.2.2950 build 20241114 and later
QuTS hero h5.1.9.2954 build 20241120 and later
QuTS hero h5.2.2.2952 build 20241116 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-93
References: https://www.qnap.com/en/security-advisory/qsa-24-49
CVE: CVE-2024-48868
Published: 2024-12-06
Description: An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data.

We have already fixed the vulnerability in the following versions:
QTS 5.1.9.2954 build 20241120 and later
QTS 5.2.2.2950 build 20241114 and later
QuTS hero h5.1.9.2954 build 20241120 and later
QuTS hero h5.2.2.2952 build 20241116 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-93
References: https://www.qnap.com/en/security-advisory/qsa-24-49
CVE: CVE-2024-50387
Published: 2024-12-06
Description: A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code.

We have already fixed the vulnerability in the following version:
SMB Service 4.15.002 and later
SMB Service h4.15.002 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-24-42
CVE: CVE-2024-50388
Published: 2024-12-06
Description: An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute commands.

We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup Sync 25.1.1.673 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-41
CVE: CVE-2024-50389
Published: 2024-12-06
Description: A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code.

We have already fixed the vulnerability in the following version:
QuRouter 2.4.5.032 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-24-45
CVE: CVE-2024-50393
Published: 2024-12-06
Description: A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following versions:
QTS 5.1.9.2954 build 20241120 and later
QTS 5.2.2.2950 build 20241114 and later
QuTS hero h5.1.9.2954 build 20241120 and later
QuTS hero h5.2.2.2952 build 20241116 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-49
CVE: CVE-2024-50402
Published: 2024-12-06
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.1.9.2954 build 20241120 and later
QTS 5.2.2.2950 build 20241114 and later
QuTS hero h5.1.9.2954 build 20241120 and later
QuTS hero h5.2.2.2952 build 20241116 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-24-49
CVE: CVE-2024-50403
Published: 2024-12-06
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.2.2950 build 20241114 and later
QuTS hero h5.2.2.2952 build 20241116 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-24-49
CVE: CVE-2024-50404
Published: 2024-12-06
Description: A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.

We have already fixed the vulnerability in the following versions:
Qsync Central 4.4.0.16_20240819 ( 2024/08/19 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://www.qnap.com/en/security-advisory/qsa-24-48
CVE: CVE-2024-53691
Published: 2024-12-06
Description: A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.

We have already fixed the vulnerability in the following versions:
QTS 5.1.8.2823 build 20240712 and later
QTS 5.2.0.2802 build 20240620 and later
QuTS hero h5.1.8.2823 build 20240712 and later
QuTS hero h5.2.0.2802 build 20240620 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://www.qnap.com/en/security-advisory/qsa-24-28
CVE: CVE-2024-54143
Published: 2024-12-06
Description: openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious image can be served in place of a legitimate one, allowing the attacker to "poison" the artifact cache and deliver compromised images to unsuspecting users. This can be combined with other attacks, such as a command injection in Imagebuilder that allows malicious users to inject arbitrary commands into the build process, resulting in the production of malicious firmware images signed with the legitimate build key. This has been patched with 920c8a1.
CWE: CWE-328
References: https://github.com/openwrt/asu/commit/920c8a13d97b4d4095f0d939cf0aaae777e0f87e; https://github.com/openwrt/asu/security/advisories/GHSA-r3gq-96h6-3v7q
CVE: CVE-2024-54749
Published: 2024-12-06
Description: Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: this is disputed by the Supplier because the observation only established that a password is present in a firmware image; however, the device cannot be deployed without setting a new password during installation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://colorful-meadow-5b9.notion.site/U7-Pro_HardCode_vuln-14bc216a1c30802e9c4cd03753e880cc?pvs=4
CVE: CVE-2024-55268
Published: 2024-12-06
Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing Management System 1.0 which allows remote attackers to execute arbitrary code via the regmobilenumber parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/COVID19/Reflected%20Cross%20Site%20reg.pdf; https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/COVID19/Reflected%20Cross%20Site%20reg.pdf
CVE: CVE-2024-11220
Published: 2024-12-06
Description: A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-279, CWE-732
References: https://openautomationsoftware.com/downloads/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03
CVE: CVE-2024-42494
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-359
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE: CVE-2024-47043
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and part of the email address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE: CVE-2024-47547
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-640
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE: CVE-2024-48703
Published: 2024-12-06
Description: PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchdata parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Reflected%20Cross-Site%20Scripting%20%28XSS%29-Search.pdf; https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Reflected%20Cross-Site%20Scripting%20%28XSS%29-Search.pdf
CVE: CVE-2024-48871
Published: 2024-12-06
Description: The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-340-02; https://www.planet.com.tw/en/support/downloads?method=keyword&keyword=v1.305b241111
CVE: CVE-2024-51727
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-service attack on a user's account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-826
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE: CVE-2024-52320
Published: 2024-12-06
Description: The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-340-02; https://www.planet.com.tw/en/support/downloads?method=keyword&keyword=v1.305b241111
CVE: CVE-2024-52558
Published: 2024-12-06
Description: The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to crash the program.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-191
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-340-02; https://www.planet.com.tw/en/support/downloads?method=keyword&keyword=v1.305b241111
CVE: CVE-2024-45722
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1391
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE: CVE-2024-46874
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device credentials could issue commands to other devices on behalf of Ruijie's cloud.
CVSS Score: 8.1 (HIGH)
CWE: CWE-280
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE: CVE-2024-47146
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically adjacent and sniffing the RAW WIFI signal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-402
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE: CVE-2024-47791
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receive partial messages being sent to and from devices.
CVSS Score: 7.5 (HIGH)
CWE: CWE-155
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01