deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9568
Published: 2024-10-07
Description: A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formAdvNetwork of the file /goform/formAdvNetwork. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formAdvNetwork.md; https://vuldb.com/?ctiid.279462; https://vuldb.com/?id.279462
CVE: CVE-2024-9569
Published: 2024-10-07
Description: A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formEasySetPassword of the file /goform/formEasySetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formEasySetPassword.md; https://vuldb.com/?ctiid.279463; https://vuldb.com/?id.279463
CVE: CVE-2024-9571
Published: 2024-10-07
Description: Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affecting multiple parameters. This could allow a remote user to send a specially crafted query to an authenticated user and partially take control of their browser session.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-soplanning
CVE: CVE-2024-9572
Published: 2024-10-07
Description: Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in the groupe_id parameter. This could allow a remote user to send a specially crafted query to an authenticated user and steal their session details.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-soplanning
CVE: CVE-2024-9573
Published: 2024-10-07
Description: SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on the server.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-soplanning
CVE: CVE-2024-9574
Published: 2024-10-07
Description: SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-soplanning
CVE: CVE-2024-9576
Published: 2024-10-07
Description: Vulnerability in Distro Linux Workbooth v2.5 that allows to escalate privileges to the root user by manipulating the network configuration script.
CVSS Score: 7.0 (HIGH)
CWE: CWE-284
References: https://www.incibe.es/en/incibe-cert/notices/aviso/improper-access-control-linux-workbooth-distro
CVE: CVE-2024-28709
Published: 2024-10-07
Description: Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://limesurvey.com; https://github.com/LimeSurvey/LimeSurvey/commit/c844c4fba81cc26ffe6544bf095bad6252910bc0
CVE: CVE-2024-28710
Published: 2024-10-07
Description: Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://limesurvey.com; https://github.com/LimeSurvey/LimeSurvey/commit/c2fd60f94bc1db275f20cbb27a3135a9bdfb7f10
CVE: CVE-2024-45932
Published: 2024-10-07
Description: Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://TobeReleased.com; https://github.com/AslamMahi/CVE-Aslam-Mahi/blob/main/Laravel%20CRM%20v1.3.0/CVE-2024-45932.md
CVE: CVE-2024-46040
Published: 2024-10-07
Description: IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-Fi packets and forcefully turn off the access point after the authentication token has expired.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://github.com/Anonymous120386/Anonymous; https://www.iothaat.com/
CVE: CVE-2024-46041
Published: 2024-10-07
Description: IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay.
CVSS Score: 8.8 (HIGH)
CWE: CWE-294
References: https://github.com/Anonymous120386/Anonymous; https://www.iothaat.com/
CVE: CVE-2024-46278
Published: 2024-10-07
Description: Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: https://github.com/ayato-shitomi/CVE-2024-46278-teedy_1.11_account-takeover; https://github.com/ayato-shitomi/teedy_1.11_account-takeover
CVE: CVE-2024-46446
Published: 2024-10-07
Description: Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://mecha-cmscom.com; https://github.com/Sp1d3rL1/Mecha-cms-Arbitrary-File-Deletion-Vulnerability
CVE: CVE-2024-9570
Published: 2024-10-07
Description: A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formEasySetTimezone.md; https://vuldb.com/?ctiid.279464; https://vuldb.com/?id.279464
CVE: CVE-2024-27458
Published: 2024-10-07
Description: A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing mitigation for the potential vulnerability. Customers using HP Programmable Key are recommended to update HP Hotkey Support.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://support.hp.com/us-en/document/ish_1[PII_REDACTED]2130-16/hpsbhf03977
CVE: CVE-2024-46300
Published: 2024-10-07
Description: itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/riya98241/CVE/blob/main/CVE-2024-46300; https://portswigger.net/web-security/cross-site-scripting/stored
CVE: CVE-2024-42831
Published: 2024-10-07
Description: A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the web browser of a user via injecting a crafted payload into the dialog parameter at wrapper_dialog.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://elaine.com; http://realtime.com; https://seclists.org/fulldisclosure/2024/Sep/49
CVE: CVE-2024-44674
Published: 2024-10-07
Description: D-Link COVR-2600R FW101b05 is vulnerable to Buffer Overflow. In the function sub_24E28, the HTTP_REFERER is obtained through an environment variable, and this field is controllable, allowing it to be used as the value for src.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/REYu6/iot/blob/21e59c0cf491a9663423c515370c4fcb43436ae0/CVE/dlink/Covr-3902/2600R.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-46076
Published: 2024-10-07
Description: RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/kkll5875/f237f200bae6db6b47eea3236d82ad0d; https://github.com/yangzongzhuan/RuoYi
CVE: CVE-2024-47555
Published: 2024-10-07
Description: Missing Authentication - User & System Configuration
CVSS Score: 8.3 (HIGH)
CWE: CWE-306
References: https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE: CVE-2024-44068
Published: 2024-10-07
Description: An issue was discovered in the m2m scaler driver in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850,and W920. A Use-After-Free in the mobile processor leads to privilege escalation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-44068/
CVE: CVE-2024-45894
Published: 2024-10-07
Description: BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-552
References: https://gist.github.com/yihanjinchangtai/215ea4bf71edb0ac9df33b221b63a3a9; https://github.com/source-trace/bluecms/issues/1
CVE: CVE-2024-47556
Published: 2024-10-07
Description: Pre-Auth RCE via Path Traversal
CVSS Score: 8.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE: CVE-2024-47557
Published: 2024-10-07
Description: Pre-Auth RCE via Path Traversal
CVSS Score: 8.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE: CVE-2024-47558
Published: 2024-10-07
Description: Authenticated RCE via Path Traversal
CVSS Score: 7.6 (HIGH)
CWE: CWE-22, CWE-22
References: https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE: CVE-2024-47559
Published: 2024-10-07
Description: Authenticated RCE via Path Traversal
CVSS Score: 7.6 (HIGH)
CWE: CWE-22, CWE-22
References: https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE: CVE-2024-47975
Published: 2024-10-07
Description: Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access or an attacker with local access to potentially enable denial of service.
CVSS Score: 7.0 (HIGH)
CWE: CWE-284
References: https://www.solidigm.com/support-page/support-security.html
CVE: CVE-2024-31227
Published: 2024-10-07
Description: Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://github.com/redis/redis/commit/b351d5a3210e61cc3b22ba38a723d6da8f3c298a; https://github.com/redis/redis/security/advisories/GHSA-38p4-26x2-vqhh
CVE: CVE-2024-31228
Published: 2024-10-07
Description: Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0; https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976; https://lists.debian.org/debian-lts-announce/2024/11/msg00031.html
CVE: CVE-2024-31449
Published: 2024-10-07
Description: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-20, CWE-121
References: https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9; https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5
CVE: CVE-2024-45292
Published: 2024-10-07
Description: PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\PhpOffice\PhpSpreadsheet\Writer\Html` does not sanitize "javascript:" URLs from hyperlink `href` attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r8w8-74ww-j4wh
CVE: CVE-2024-45293
Published: 2024-10-07
Description: PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function. The function searches for the XML encoding through a defined regex which looks for `encoding="*"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. This logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the = in the attribute definition. Sensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser. This issue has been addressed in release versions 1.29.1, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hwr-6v2f-3m88
CVE: CVE-2024-47079
Published: 2024-10-07
Description: Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmware implementation for the broader project. The remote hardware module of the firmware does not have proper checks to ensure a remote hardware control message was received should be considered valid. This issue has been addressed in release version 2.5.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-345
References: https://github.com/meshtastic/firmware/security/advisories/GHSA-h8mh-p4r3-4jv7
CVE: CVE-2024-47971
Published: 2024-10-07
Description: Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-544
References: https://www.solidigm.com/support-page/support-security.htmlhttps://
CVE: CVE-2024-47972
Published: 2024-10-07
Description: Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the performance of the resource.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-404
References: https://www.solidigm.com/support-page/support-security.html
CVE: CVE-2024-47976
Published: 2024-10-07
Description: Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://www.solidigm.com/support-page/support-security.html
CVE: CVE-2024-43362
Published: 2024-10-07
Description: Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external links in `links.php` . Morever, the said fileurl is placed in some html code which is passed to the `print` function in `link.php` and `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `fileurl` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/Cacti/cacti/security/advisories/GHSA-wh9c-v56x-v77c; https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
CVE: CVE-2024-43363
Published: 2024-10-07
Description: Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process (completing only step 5 of the installation process is enough, no need to complete the steps before or after it) to use a php file as the cacti log file. After having the malicious hostname end up in the logs (log poisoning), one can simply go to the log file url to execute commands to achieve RCE. This issue has been addressed in version 1.2.28 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/Cacti/cacti/security/advisories/GHSA-gxq4-mv8h-6qj4; https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
CVE: CVE-2024-43364
Published: 2024-10-07
Description: Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in index.php, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cacti/cacti/security/advisories/GHSA-fgc6-g8gc-wcg5; https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
CVE: CVE-2024-43365
Published: 2024-10-07
Description: Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving external links in links.php . Morever, the said consolenewsection parameter is stored in the database and reflected back to user in `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the “consolenewsection” parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cacti/cacti/security/advisories/GHSA-49f2-hwx9-qffr; https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
CVE: CVE-2024-43789
Published: 2024-10-07
Description: Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can potentially reduce the availability of a Discourse instance. This problem has been patched in the latest version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/discourse/discourse/security/advisories/GHSA-62cq-cpmc-hvqq
CVE: CVE-2024-45051
Published: 2024-10-07
Description: Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287
References: https://github.com/discourse/discourse/security/advisories/GHSA-2vjv-pgh4-6rmq
CVE: CVE-2024-45060
Published: 2024-10-07
Description: PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of input where a number is expected leading to formula injection. The code in in `45_Quadratic_equation_solver.php` concatenates the user supplied parameters directly into spreadsheet formulas. This allows an attacker to take control over the formula and output unsanitized data into the page, resulting in JavaScript execution. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/PHPOffice/PhpSpreadsheet/blob/d50b8b5de7e30439fb57eae7df9ea90e79fa0f2d/samples/Basic/45_Quadratic_equation_solver.php#L56; https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-v66g-p9x6-v98p