deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-53092
Published: 2024-11-21
Description: In the Linux kernel, the following vulnerability has been resolved:

virtio_pci: Fix admin vq cleanup by using correct info pointer

vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq
resources by virtio_pci_vq_info pointer. The info pointer of admin
vq is stored in vp_dev->admin_vq.info instead of vp_dev->vqs[].
Using the info pointer from vp_dev->vqs[] for admin vq causes a
kernel NULL pointer dereference bug.
In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer
from vp_dev->admin_vq.info for admin vq to clean up the resources.
Also make info ptr as argument of vp_del_vq() to be symmetric with
vp_setup_vq().

vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace:
==================================================================
BUG: kernel NULL pointer dereference, address:[PII_REDACTED]
...
CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1
RIP: 0010:vp_reset+0x57/0x90 [virtio_pci]
Call Trace:
 <TASK>
...
 ? vp_reset+0x57/0x90 [virtio_pci]
 ? vp_reset+0x38/0x90 [virtio_pci]
 virtio_reset_device+0x1d/0x30
 remove_vq_common+0x1c/0x1a0 [virtio_net]
 virtnet_remove+0xa1/0xc0 [virtio_net]
 virtio_dev_remove+0x46/0xa0
...
 virtio_pci_driver_exit+0x14/0x810 [virtio_pci]
==================================================================
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/018d3d4ad4be7fbc95d8a2367642a32d21df55c7; https://git.kernel.org/stable/c/97ee04feb682c906a1fa973ebe586fe91567d165
CVE: CVE-2024-53093
Published: 2024-11-21
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-multipath: defer partition scanning

We need to suppress the partition scan from occuring within the
controller's scan_work context. If a path error occurs here, the IO will
wait until a path becomes available or all paths are torn down, but that
action also occurs within scan_work, so it would deadlock. Defer the
partion scan to a different context that does not block scan_work.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1f021341eef41e77a633186e9be5223de2ce5d48; https://git.kernel.org/stable/c/4a57f42e5ed42cb8f1beb262c4f6d3e698939e4e; https://git.kernel.org/stable/c/60de2e03f984cfbcdc12fa552f95087c35a05a98
CVE: CVE-2024-53094
Published: 2024-11-21
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES

While running ISER over SIW, the initiator machine encounters a warning
from skb_splice_from_iter() indicating that a slab page is being used in
send_page. To address this, it is better to add a sendpage_ok() check
within the driver itself, and if it returns 0, then MSG_SPLICE_PAGES flag
should be disabled before entering the network stack.

A similar issue has been discussed for NVMe in this thread:
https://lore.kernel.org/all/[PII_REDACTED]2417.146696-1-ofir.gal@volumez.com/

  WARNING: CPU: 0 PID: 5342 at net/core/skbuff.c:7140 skb_splice_from_iter+0x173/0x320
  Call Trace:
   tcp_sendmsg_locked+0x368/0xe40
   siw_tx_hdt+0x695/0xa40 [siw]
   siw_qp_sq_process+0x102/0xb00 [siw]
   siw_sq_resume+0x39/0x110 [siw]
   siw_run_sq+0x74/0x160 [siw]
   kthread+0xd2/0x100
   ret_from_fork+0x34/0x40
   ret_from_fork_asm+0x1a/0x30
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3406bfc813a9bbd9c3055795e985f527b7852e8c; https://git.kernel.org/stable/c/4e1e3dd88a4cedd5ccc1a3fc3d71e03b70a7a791; https://git.kernel.org/stable/c/bb5738957d92c8603a90c9664d34236641c221b2
CVE: CVE-2024-49588
Published: 2024-11-21
Description: Multiple endpoints in `oracle-sidecar` in versions 0.347.0 to 0.543.0 were found to be vulnerable to SQL injections.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: https://cwe.mitre.org/data/definitions/89.html; https://palantir.safebase.us/?tcuUid=b5724367-8b86-436a-8ef2-4480ec41cc2c
CVE: CVE-2024-51364
Published: 2024-11-21
Description: An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://modbusmechanic.com; https://github.com/Gelcon/PoC-ModbusMechanic-3.0-Insecure-Deserialization-and-RCE
CVE: CVE-2024-51365
Published: 2024-11-21
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-51366
Published: 2024-11-21
Description: An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploading a crafted .conf file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://omegat.com; https://github.com/Gelcon/PoCofOmegaTV6_0_1; https://omegat.org/
CVE: CVE-2024-51367
Published: 2024-11-21
Description: An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via uploading a crafted .xml file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://blackboard.com; https://github.com/Gelcon/PoCofBlackBoard2.0.0.2
CVE: CVE-2024-52615
Published: 2024-11-21
Description: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-330
References: https://access.redhat.com/errata/RHSA-2025:11402; https://access.redhat.com/errata/RHSA-2025:16441; https://access.redhat.com/security/cve/CVE-2024-52615
CVE: CVE-2024-52616
Published: 2024-11-21
Description: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-334
References: https://access.redhat.com/errata/RHSA-2025:7437; https://access.redhat.com/security/cve/CVE-2024-52616; https://bugzilla.redhat.com/show_bug.cgi?id=2326429
CVE: CVE-2024-52052
Published: 2024-11-21
Description: Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-646
References: https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/; https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes
CVE: CVE-2024-52053
Published: 2024-11-21
Description: Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript into the web dashboard to automatically hijack admin accounts.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/; https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes
CVE: CVE-2024-52054
Published: 2024-11-21
Description: Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the file system.
CVSS Score: 2.7 (LOW)
CWE: CWE-22, CWE-22
References: https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/; https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes
CVE: CVE-2024-52055
Published: 2024-11-21
Description: Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target directory contains an XML definition file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/; https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes
CVE: CVE-2024-52056
Published: 2024-11-21
Description: Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the target directory contains an XML definition file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/; https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes
CVE: CVE-2024-31408
Published: 2024-11-22
Description: OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbitrary OS command with root privileges by sending a specially crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN41397971/; https://www.aiphone.net/important/20241016_1/; https://www.aiphone.net/important/20241016_2/
CVE: CVE-2024-39290
Published: 2024-11-22
Description: Insufficiently protected credentials issue exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent unauthenticated attacker may obtain sensitive information such as a username and its password in the address book.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://jvn.jp/en/jp/JVN41397971/; https://www.aiphone.net/important/20241016_1/; https://www.aiphone.net/important/20241016_2/
CVE: CVE-2024-45837
Published: 2024-11-22
Description: Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may log in to SFTP service and obtain and/or manipulate unauthorized files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-321
References: https://jvn.jp/en/jp/JVN41397971/; https://www.aiphone.net/important/20241016_1/; https://www.aiphone.net/important/20241016_2/
CVE: CVE-2024-47142
Published: 2024-11-22
Description: AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials, which may allow a network-adjacent authenticated attacker to perform unintended operations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://jvn.jp/en/jp/JVN41397971/; https://www.aiphone.net/important/20241016_2/; https://www.aiphone.net/support/software-documents/ixg/
CVE: CVE-2024-38296
Published: 2024-11-22
Description: Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain an Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
CVSS Score: 6.7 (MEDIUM)
References: https://www.dell.com/support/kbdoc/en-us/000250949/dsa-2024-345-security-update-for-dell-networking-edge-gateway-5200-vulnerability
CVE: CVE-2024-10034
Published: 2024-11-22
Description: The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery link text parameter in all versions up to, and including, 3.2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3192798%40simply-gallery-block%2Ftrunk&old=3176753%40simply-gallery-block%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/89bd70b2-0b5f-4edb-890b-d291bdb8a851?source=cve
CVE: CVE-2024-10666
Published: 2024-11-22
Description: The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the [etf] shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206719%40easy-twitter-feeds&new=3206719%40easy-twitter-feeds&sfp_email=&sfph_mail=; https://wordpress.org/plugins/easy-twitter-feeds/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d9cd3168-3261-4e36-8fbe-2058cd821937?source=cve
CVE: CVE-2024-11104
Published: 2024-11-22
Description: The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the save_options() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. Please note this is limited to option values that can be saved as arrays.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1267; https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1290; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3189030%40sky-elementor-addons&new=3189030%40sky-elementor-addons&sfp_email=&sfph_mail=
CVE: CVE-2024-11225
Published: 2024-11-22
Description: The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.9.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/5.9.3/includes/libs/functions.php#L420; https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/5.9.3/includes/libs/functions.php#L422; https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/5.9.3/includes/libs/functions.php#L584
CVE: CVE-2024-11355
Published: 2024-11-22
Description: The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_setting() function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view settings for playlists.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/ultimate-youtube-video-player/trunk/admin/admin.php#L18; https://plugins.trac.wordpress.org/browser/ultimate-youtube-video-player/trunk/admin/inc/handler/getsetting.php#L1; https://www.wordfence.com/threat-intel/vulnerabilities/id/4119178c-9227-4623-a962-e0f103612c75?source=cve
CVE: CVE-2024-11381
Published: 2024-11-22
Description: The Control horas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ch_registro' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/control-horas/trunk/includes/class-fichaje.php#L59; https://www.wordfence.com/threat-intel/vulnerabilities/id/1aeafeec-7202-4ee6-b724-8dcf98591294?source=cve
CVE: CVE-2024-11601
Published: 2024-11-22
Description: The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the save_options() function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note this is limited to option values that can be saved as arrays.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862, CWE-352, CWE-862
References: https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1267; https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1290; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3189030%40sky-elementor-addons&new=3189030%40sky-elementor-addons&sfp_email=&sfph_mail=
CVE: CVE-2024-8735
Published: 2024-11-22
Description: The MailMunch – Grow your Email List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/mailmunch/tags/3.1.8/admin/partials/mailmunch-admin-display.php#L16; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193789%40mailmunch&new=3193789%40mailmunch&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e45860-16c4-4d13-aad9-c742a8eced37?source=cve
CVE: CVE-2024-8932
Published: 2024-11-22
Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff; https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-9422
Published: 2024-11-22
Description: The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.
CVSS Score: 6.6 (MEDIUM)
References: https://wpscan.com/vulnerability/81320923-767c-43f0-a8eb-b398c306c16f/
CVE: CVE-2024-8929
Published: 2024-11-22
Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-125, CWE-200
References: https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678; https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-7837
Published: 2024-11-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Firmanet Software ERP allows SQL Injection.This issue affects ERP: through 22.11.2024.


NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1868
CVE: CVE-2024-7882
Published: 2024-11-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-Commerce allows SQL Injection.This issue affects e-Commerce: before 22.11.2024.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1869
CVE: CVE-2017-9711
Published: 2024-11-22
Description: Certain unprivileged processes are able to perform IOCTL calls.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html
CVE: CVE-2021-30299
Published: 2024-11-22
Description: Possible out of bound access in audio module due to lack of validation of user provided input.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2022-bulletin.html
CVE: CVE-2024-41779
Published: 2024-11-22
Description: IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to remotely execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-367
References: https://www.ibm.com/support/pages/node/7172535
CVE: CVE-2024-41781
Published: 2024-11-22
Description: IBM PowerVM Platform KeyStore (IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1030.00 through FW1030.60, FW1050.00 through FW1050.20, and FW1060.00 through FW1060.10 functionality can be compromised if an attacker gains service access to the HMC.  An attacker that gains service access to the HMC can locate and through a series of service procedures decrypt data contained in the Platform KeyStore.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7172698
CVE: CVE-2024-51766
Published: 2024-11-22
Description: A potential security vulnerability has been identified in the HPE NonStop DISK UTIL (T9208) product. This vulnerability could be exploited to cause a denial of service (DoS) to NonStop server. It exists in all prior DISK UTIL product versions of L-series and J-series.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns04759en_us&docLocale=en_US
CVE: CVE-2024-45719
Published: 2024-11-22
Description: Inadequate Encryption Strength vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.4.0.

The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.
Users are recommended to upgrade to version 1.4.1, which fixes the issue.
CVSS Score: 2.6 (LOW)
CWE: CWE-326
References: https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491; http://www.openwall.com/lists/oss-security/2024/11/22/1
CVE: CVE-2024-49054
Published: 2024-11-22
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-357
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49054
CVE: CVE-2021-38116
Published: 2024-11-22
Description: Possible Elevation of Privilege Vulnerability

in iManager has been discovered in
OpenText™ iManager. This impacts all versions before 3.2.5
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.netiq.com/documentation/imanager-32/imanager325_releasenotes/data/imanager325_releasenotes.html
CVE: CVE-2021-38117
Published: 2024-11-22
Description: Possible Command injection Vulnerability

in iManager has been discovered in
OpenText™ iManager 3.2.4.0000.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-77
References: https://www.netiq.com/documentation/imanager-32/imanager325_releasenotes/data/imanager325_releasenotes.html
CVE: CVE-2021-38118
Published: 2024-11-22
Description: Possible improper input validation Vulnerability

in iManager has been discovered in
OpenText™ iManager 3.2.4.0000.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-250
References: https://www.netiq.com/documentation/imanager-32/imanager325_releasenotes/data/imanager325_releasenotes.html