deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-22247
Published: 2024-04-02
Description: VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.

A malicious actor with physical access to the SD-WAN Edge appliance 
during activation can potentially exploit this vulnerability to access 
the BIOS configuration. In addition, the malicious actor may be able to 
exploit the default boot priority configured.


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287
References: https://www.vmware.com/security/advisories/VMSA-2024-0008.html; https://www.vmware.com/security/advisories/VMSA-2024-0008.html
CVE: CVE-2024-22248
Published: 2024-04-02
Description: VMware SD-WAN Orchestrator contains an open redirect vulnerability.

A malicious actor may be able to redirect a victim to an attacker 
controlled domain due to improper path handling leading to sensitive 
information disclosure.


CVSS Score: 7.1 (HIGH)
CWE: CWE-601
References: https://www.vmware.com/security/advisories/VMSA-2024-0008.html; https://www.vmware.com/security/advisories/VMSA-2024-0008.html
CVE: CVE-2024-28287
Published: 2024-04-02
Description: A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL.
CVSS Score: 7.3 (HIGH)
CWE: CWE-601
References: https://medium.com/%40rajput.thakur/dom-based-malicious-redirection-cve-2024-28287-304ac8e7f992; https://medium.com/%40rajput.thakur/dom-based-malicious-redirection-cve-2024-28287-304ac8e7f992
CVE: CVE-2024-2435
Published: 2024-04-02
Description: For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that signal. The XSS is in the timeline page displaying the workflow execution details of the workflow that was sent the crafted signal.
Access to send a signal to a workflow is determined by how you configured the authorizer on your server. This includes any entity with permission to directly call SignalWorkflowExecution or SignalWithStartWorkflowExecution, or any entity can deploy a worker that has access to call workflow progress APIs (specifically RespondWorkflowTaskCompleted).

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/temporalio/ui-server/releases/tag/v2.25.0; https://github.com/temporalio/ui-server/releases/tag/v2.25.0
CVE: CVE-2024-3151
Published: 2024-04-02
Description: A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325. Affected is an unknown function of the file /stockmovment/stockmovment/delete/ of the component Stock Movement Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258924. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://drive.google.com/file/d/1oTqULJy357Z4dk85vPR_yMFXRNhwZywX/view?usp=sharing; https://vuldb.com/?ctiid.258924; https://vuldb.com/?id.258924
CVE: CVE-2024-30335
Published: 2024-04-02
Description: Foxit PDF Reader AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22641.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-304/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30806
Published: 2024-04-02
Description: An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42aac.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122
References: https://github.com/axiomatic-systems/Bento4/issues/914; https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-30806; https://github.com/axiomatic-systems/Bento4/issues/914
CVE: CVE-2024-30807
Published: 2024-04-02
Description: An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_UnknownAtom::~AP4_UnknownAtom at Ap4Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42ts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/axiomatic-systems/Bento4/issues/937; https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-30807; https://github.com/axiomatic-systems/Bento4/issues/937
CVE: CVE-2024-30808
Published: 2024-04-02
Description: An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_SubStream::~AP4_SubStream at Ap4ByteStream.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42ts.
CVSS Score: 2.7 (LOW)
CWE: CWE-416
References: https://github.com/axiomatic-systems/Bento4/issues/937; https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-30808; https://github.com/axiomatic-systems/Bento4/issues/937
CVE: CVE-2024-30809
Published: 2024-04-02
Description: An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in Ap4Sample.h in AP4_Sample::GetOffset() const, leading to a Denial of Service (DoS), as demonstrated by mp42ts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/axiomatic-systems/Bento4/issues/937; https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-30809; https://github.com/axiomatic-systems/Bento4/issues/937
CVE: CVE-2024-31105
Published: 2024-04-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/tax-rate-upload/wordpress-tax-rate-upload-plugin-2-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tax-rate-upload/wordpress-tax-rate-upload-plugin-2-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31109
Published: 2024-04-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in Toastie Studio Woocommerce Social Media Share Buttons allows Stored XSS.This issue affects Woocommerce Social Media Share Buttons: from n/a through 1.3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-social-media-share-buttons/wordpress-woocommerce-social-media-share-buttons-plugin-1-3-0-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-social-media-share-buttons/wordpress-woocommerce-social-media-share-buttons-plugin-1-3-0-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24888
Published: 2024-04-02
Description: Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through <= 3.2.25.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/kadence-blocks/vulnerability/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-2-25-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/kadence-blocks/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-2-25-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-30531
Published: 2024-04-02
Description: Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content.This issue affects Nelio Content: from n/a through 3.2.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/nelio-content/wordpress-nelio-content-best-editorial-calendar-social-media-scheduling-plugin-3-2-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/nelio-content/wordpress-nelio-content-best-editorial-calendar-social-media-scheduling-plugin-3-2-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-30532
Published: 2024-04-02
Description: Server-Side Request Forgery (SSRF) vulnerability in Builderall Team Builderall Builder for WordPress.This issue affects Builderall Builder for WordPress: from n/a through 2.0.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/builderall-cheetah-for-wp/wordpress-builderall-builder-for-wordpress-plugin-2-0-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/builderall-cheetah-for-wp/wordpress-builderall-builder-for-wordpress-plugin-2-0-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-29834
Published: 2024-04-02
Description: This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. An authenticated user with produce permission can create subscriptions and update subscription properties on partitioned topics, even though this should be limited to users with consume permissions. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be slightly different. Additionally, the vulnerability allows an authenticated user to read, create, modify, and delete namespace properties in any namespace in any tenant. In Pulsar, namespace properties are reserved for user provided metadata about the namespace.

This issue affects Apache Pulsar versions from 2.7.1 to 2.10.6, from 2.11.0 to 2.11.4, from 3.0.0 to 3.0.3, from 3.1.0 to 3.1.3, and from 3.2.0 to 3.2.1. 

3.0 Apache Pulsar users should upgrade to at least 3.0.4.
3.1 and 3.2 Apache Pulsar users should upgrade to at least 3.2.2.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2024/04/02/2; https://lists.apache.org/thread/v0ltl94k9lg28qfr1f54hpkvvsjc5bj5; https://pulsar.apache.org/security/CVE-2024-29834/
CVE: CVE-2024-30336
Published: 2024-04-02
Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22642.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-303/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30337
Published: 2024-04-02
Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Acroforms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22704.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-318/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30338
Published: 2024-04-02
Description: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22705.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-319/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30339
Published: 2024-04-02
Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Acroforms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22706.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-317/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30340
Published: 2024-04-02
Description: Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22707.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-321/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30341
Published: 2024-04-02
Description: Foxit PDF Reader Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22709.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-315/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30342
Published: 2024-04-02
Description: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22720.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-322/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30343
Published: 2024-04-02
Description: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22721.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-316/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-25075
Published: 2024-04-02
Description: An issue was discovered in Softing uaToolkit Embedded before 1.41.1. When a subscription with a very low MaxNotificationPerPublish parameter is created, a publish response is mishandled, leading to memory consumption. When that happens often enough, the device will be out of memory, i.e., a denial of service.
CVSS Score: 5.1 (MEDIUM)
References: https://industrial.softing.com/fileadmin/psirt/downloads/2024/syt-2024-2.html; https://industrial.softing.com/fileadmin/psirt/downloads/2024/syt-2024-2.html
CVE: CVE-2024-27602
Published: 2024-04-02
Description: Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://gist.github.com/Raybye/fee21f1a5b3a9ab[PII_REDACTED]1478034; https://gist.github.com/Raybye/fee21f1a5b3a9ab[PII_REDACTED]1478034
CVE: CVE-2024-27604
Published: 2024-04-02
Description: Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://gist.github.com/Raybye/b88847e9e9a94a1b1028dbdb7e38c12b; https://gist.github.com/Raybye/b88847e9e9a94a1b1028dbdb7e38c12b
CVE: CVE-2024-27605
Published: 2024-04-02
Description: Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://gist.github.com/Raybye/f365c89115f80e81d209f2fca9490339; https://gist.github.com/Raybye/f365c89115f80e81d209f2fca9490339
CVE: CVE-2024-29432
Published: 2024-04-02
Description: Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Raybye/4b377eb06b5f9c324f090d39a0d25c2b; https://github.com/Raybye/alldata-bug/blob/main/alldata.md; https://gist.github.com/Raybye/4b377eb06b5f9c324f090d39a0d25c2b
CVE: CVE-2024-30344
Published: 2024-04-02
Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Acroforms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22733.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-320/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30345
Published: 2024-04-02
Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22742.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-323/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30346
Published: 2024-04-02
Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22745.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-324/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-30347
Published: 2024-04-02
Description: Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22910.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-327/; https://www.foxit.com/support/security-bulletins.html