deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-47502
Published: 2024-10-11
Description: An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).

In specific cases the state of TCP sessions that are terminated is not cleared, which over time leads to an exhaustion of resources, preventing new connections to the control plane from being established.

A continuously increasing number of connections shown by:



user@host > show system connections



is indicative of the problem. To recover the respective RE needs to be restarted manually.

This issue only affects IPv4 but does not affect IPv6.
This issue only affects TCP sessions established in-band (over an interface on an FPC) but not out-of-band (over the management ethernet port on the routing-engine).

This issue affects Junos OS Evolved: 

  *  All versions before 21.4R3-S9-EVO,
  *  22.2 versions before 22.2R3-S4-EVO,
  *  22.4 version before 22.4R3-S3-EVO,
  *  23.2 versions before 23.2R2-S1-EVO,
  *  23.4 versions before 23.4R2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://supportportal.juniper.net/JSA88132
CVE: CVE-2024-47503
Published: 2024-10-11
Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX4600 and SRX5000 Series allows an unauthenticated and logically adjacent attacker to cause a Denial-of-Service (DoS).

If in a multicast scenario a sequence of 

specific PIM packets is received, this will cause a flowd crash and restart, which leads to momentary service interruption.
This issue affects Junos OS on SRX 4600 and SRX 5000 Series:



  *  All versions before 21.4R3-S9,
  *  22.2 versions before 22.2R3-S5,
  *  22.3 versions before 22.3R3-S4,
  *  22.4 versions before 22.4R3-S4,
  *  23.2 versions before 23.2R2-S2,
  *  23.4 versions before 23.4R2, 
  *  24.2 versions before 24.2R1-S1, 24.2R2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://supportportal.juniper.net/JSA88133
CVE: CVE-2024-47504
Published: 2024-10-11
Description: An Improper Validation of Specified Type of Input vulnerability in the packet forwarding engine (pfe) Juniper Networks Junos OS on SRX5000 Series allows an unauthenticated, network based attacker to cause a Denial of Service (Dos).

When a non-clustered SRX5000 device receives a specifically malformed packet this will cause a flowd crash and restart.

This issue affects Junos OS:

  *  22.1 releases 22.1R1 and later before 22.2R3-S5,
  *  22.3 releases before 22.3R3-S4,
  *  22.4 releases before 22.4R3-S4,
  *  23.2 releases before 23.2R2-S2,
  *  23.4 releases before 23.4R2-S1,
  *  24.2 releases before 24.2R1-S1, 24.2R2.


Please note that the PR does indicate that earlier versions have been fixed as well, but these won't be adversely impacted by this.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1287
References: https://supportportal.juniper.net/JSA88134
CVE: CVE-2024-47505
Published: 2024-10-11
Description: An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an authenticated, network-based attacker to cause an FPC crash leading to a Denial of Service (DoS).When specific SNMP GET operations or specific low-priviledged CLI commands are executed, a GUID resource leak will occur, eventually leading to exhaustion and resulting in FPCs to hang. Affected FPCs need to be manually restarted to recover.

GUID exhaustion will trigger a syslog message like one of the following:

evo-pfemand[<pid>]: get_next_guid: Ran out of Guid Space ...
evo-aftmand-zx[<pid>]: get_next_guid: Ran out of Guid Space ...
The leak can be monitored by running the following command and taking note of the values in the rightmost column labeled Guids:





user@host> show platform application-info allocations app evo-pfemand/evo-pfemand



In case one or more of these values are constantly increasing the leak is happening.

This issue affects Junos OS Evolved:



  *  All versions before 21.4R3-S7-EVO,
  *  22.1 versions before 22.1R3-S6-EVO,
  *  22.2 versions before 22.2R3-EVO, 

  *  22.3 versions before 22.3R3-EVO,
  *  22.4 versions before 22.4R2-EVO.



Please note that this issue is similar to, but different from CVE-2024-47508 and CVE-2024-47509.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://supportportal.juniper.net/
CVE: CVE-2024-47506
Published: 2024-10-11
Description: A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When a large amount of traffic is processed by ATP Cloud inspection, a deadlock can occur which will result in a PFE crash and restart. Whether the crash occurs, depends on system internal timing that is outside the attackers control.



This issue affects Junos OS on SRX Series:



  *  All versions before 21.3R3-S1,
  *  21.4 versions before 21.4R3,
  *  22.1 versions before 22.1R2,
  *  22.2 versions before 22.2R1-S2, 22.2R2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-833
References: https://supportportal.juniper.net/JSA88137
CVE: CVE-2024-47507
Published: 2024-10-11
Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause an integrity impact to the downstream devices.

When a peer sends a BGP update message which contains the aggregator attribute with an ASN value of zero (0), rpd accepts and propagates this attribute, which can cause issues for downstream BGP peers receiving this.



This issue affects:

Junos OS:



  *  All versions before 21.4R3-S6,
  *  22.2 versions before 22.2R3-S3,
  *  22.4 versions before 22.4R3; 







Junos OS Evolved: 



  *  All versions before 21.4R3-S7-EVO,
  *  22.2 versions before 22.2R3-S4-EVO,
  *  22.4 versions before 22.4R3-EVO.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-754
References: https://supportportal.juniper.net/JSA88138
CVE: CVE-2024-47508
Published: 2024-10-11
Description: An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an authenticated, network-based attacker to cause an FPC crash leading to a Denial of Service (DoS).When specific SNMP GET operations or specific low-priviledged CLI commands are executed, a GUID resource leak will occur, eventually leading to exhaustion and resulting in FPCs to hang. Affected FPCs need to be manually restarted to recover.

GUID exhaustion will trigger a syslog message like one of the following:

evo-pfemand[<pid>]: get_next_guid: Ran out of Guid Space ...
evo-aftmand-zx[<pid>]: get_next_guid: Ran out of Guid Space ...
The leak can be monitored by running the following command and taking note of the values in the rightmost column labeled Guids:





user@host> show platform application-info allocations app evo-pfemand/evo-pfemand



In case one or more of these values are constantly increasing the leak is happening.

This issue affects Junos OS Evolved:



  *  All versions before 21.2R3-S8-EVO,
  *  21.3 versions before 21.3R3-EVO;
  *  21.4 versions before 22.1R2-EVO,

  *  22.1 versions before 22.1R1-S1-EVO, 22.1R2-EVO.





Please note that this issue is similar to, but different from CVE-2024-47505 and CVE-2024-47509.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://supportportal.juniper.net/
CVE: CVE-2024-47509
Published: 2024-10-11
Description: An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an authenticated, network-based attacker to cause an FPC crash leading to a Denial of Service (DoS).When specific SNMP GET operations or specific low-priviledged CLI commands are executed, a GUID resource leak will occur, eventually leading to exhaustion and resulting in FPCs to hang. Affected FPCs need to be manually restarted to recover.

GUID exhaustion will trigger a syslog message like one of the following:

evo-pfemand[<pid>]: get_next_guid: Ran out of Guid Space ...
evo-aftmand-zx[<pid>]: get_next_guid: Ran out of Guid Space ...
The leak can be monitored by running the following command and taking note of the values in the rightmost column labeled Guids:





user@host> show platform application-info allocations app evo-pfemand/evo-pfemand



In case one or more of these values are constantly increasing the leak is happening.

This issue affects Junos OS Evolved:



  *  All versions before 21.4R2-EVO,
  *  22.1 versions before 22.1R2-EVO.





Please note that this issue is similar to, but different from CVE-2024-47505 and CVE-2024-47508.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://supportportal.juniper.net/
CVE: CVE-2024-48813
Published: 2024-10-11
Description: SQL injection vulnerability in employee-management-system-php-and-mysql-free-download.html taskmatic 1.0 allows a remote attacker to execute arbitrary code via the admin_id parameter of the /update-employee.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gitee.com/lssrain/taskmatic/issues/IAUXOL
CVE: CVE-2024-48827
Published: 2024-10-11
Description: An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://github.com/sbondCo/Watcharr; https://github.com/sbondCo/Watcharr/releases/tag/v1.43.0; https://github.com/yamerooo123/CVE/blob/main/CVE-2024-48827/Description.md
CVE: CVE-2024-4089
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-4130
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-4131
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-4132
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-5474
Published: 2024-10-11
Description: A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2.0.0.2 that could allow a local attacker to read files on the system with elevated privileges during installation of the package. Previously installed versions are not affected by this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-158394
CVE: CVE-2024-6985
Published: 2024-10-11
Description: A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-23
References: https://github.com/parisneo/lollms/commit/28ee567a9a120967215ff19b96ab7515ce469620; https://huntr.com/bounties/79c11579-47d8-4e68-8466-b47c3bf5ef6a
CVE: CVE-2024-8376
Published: 2024-10-11
Description: In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-416, CWE-755, CWE-401, CWE-416
References: https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17; https://github.com/eclipse/mosquitto/releases/tag/v2.0.19; https://gitlab.eclipse.org/security/cve-assignement/-/issues/26
CVE: CVE-2024-9046
Published: 2024-10-11
Description: A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://iknow.lenovo.com.cn/detail/423563
CVE: CVE-2024-42018
Published: 2024-10-11
Description: An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nodes. These parameters embed credentials whose integrity and confidentiality may be important to the security of the HPC configuration. Because these parameters are needed for initialization, there is no available mechanism to ensure access control on the management node, and a mitigation measure is normally put in place to prevent access to unprivileged users. It was discovered that this mitigation measure does not survive a reboot of diskful nodes. (Diskless nodes are not at risk.) The mistake lies in the cloudinit configuration: the iptables configuration should have been in the bootcmd instead of the runcmd section.
CVSS Score: 7.7 (HIGH)
CWE: CWE-922
References: https://eviden.com; https://support.bull.com/ols/product/security/psirt/security-bulletins/misconfiguration-of-smc-xscale-leads-to-sensitive-data-exposure-psirt-1369-tlp-clear-version-2-6-cve-2024-42018/view
CVE: CVE-2024-44413
Published: 2024-10-11
Description: A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_filter.asp file. Manipulation of the path parameter can lead to command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/IotChan/cve/blob/main/dlink/di-8300/CVE-2024-44413; https://github.com/IotChan/cve/blob/main/dlink/di-8300/di-8200.md
CVE: CVE-2024-44414
Published: 2024-10-11
Description: A vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. This issue affects the sub_4901E0 function in the msp_info.htm file. Manipulation of the path parameter can lead to command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/IotChan/cve/blob/main/wayos/FBM_292W/CVE-2024-44414; https://github.com/IotChan/cve/blob/main/wayos/FBM_292W/wayos%20FBM_292W.md
CVE: CVE-2024-44415
Published: 2024-10-11
Description: A vulnerability was discovered in DI_8200-16.07.26A1, There is a buffer overflow in the dbsrv_asp function; The strcpy function is executed without checking the length of the string, leading to a buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/IotChan/cve/blob/main/dlink/DI-8200/CVE-2024-44415; https://github.com/IotChan/cve/blob/main/dlink/DI-8200/Dlink%20DI-8200.md
CVE: CVE-2024-44731
Published: 2024-10-11
Description: Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary code via sending crafted payloads in messages to other users over RTC connections.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://a7.de/blog/schwachstellen-in-videokonferenzsystemen/; https://aware7.com/de/blog/schwachstellen-in-videokonferenzsystemen/; https://github.com/miroslavpejic85
CVE: CVE-2024-44734
Published: 2024-10-11
Description: Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction request to the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://aware7.com/de/blog/schwachstellen-in-videokonferenzsystemen/; https://github.com/miroslavpejic85; https://github.com/miroslavpejic85/mirotalk
CVE: CVE-2024-46215
Published: 2024-10-11
Description: A vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub_445BDC() function within the /usr/sbin/goahead program; The strcpy function is executed without checking the length of the string, leading to a buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/IotChan/cve/blob/main/KT/CVE-2024-46215; https://github.com/IotChan/cve/blob/main/KT/KT%20KM08-708H.md
CVE: CVE-2024-47877
Published: 2024-10-11
Description: Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-61
References: https://github.com/codeclysm/extract/commit/4a98568021b8e289345c7f526ccbd7ed732cf286; https://github.com/codeclysm/extract/security/advisories/GHSA-8rm2-93mq-jqhc
CVE: CVE-2024-9859
Published: 2024-10-11
Description: Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843, CWE-843
References: https://issues.chromium.org/issues/346197738
CVE: CVE-2024-44157
Published: 2024-10-11
Description: A stack buffer overflow was addressed through improved input validation. This issue is fixed in Apple TV 1.5.0.152 for Windows, iTunes 12.13.3 for Windows. Parsing a maliciously crafted video file may lead to unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-120
References: https://support.apple.com/en-us/121328; https://support.apple.com/en-us/121441
CVE: CVE-2024-44807
Published: 2024-10-11
Description: A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of the uploaded files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: http://basercms.com; http://burgereditor.com; https://burger.d-zero.co.jp/blogs/archives/2
CVE: CVE-2024-46532
Published: 2024-10-11
Description: SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://openhis.com; https://github.com/[PII_REDACTED]/OpenHIS?tab=readme-ov-file; https://github.com/KamenRiderDarker/CVE-2024-46532/tree/main/README.md
CVE: CVE-2024-9539
Published: 2024-10-11
Description: An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to upload malicious SVG files and phish a victim user to click on that uploaded asset URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.2, 3.13.5, 3.12.10, 3.11.16. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.16; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.10; https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.5
CVE: CVE-2024-47331
Published: 2024-10-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through <= 2.7.7.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/cf7-multi-step/vulnerability/wordpress-multi-step-for-contact-form-plugin-2-7-7-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-47353
Published: 2024-10-11
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite.This issue affects ElementsReady Addons for Elementor: from n/a through 6.4.2.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/element-ready-lite/vulnerability/wordpress-elementsready-addons-for-elementor-plugin-6-4-2-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-48020
Published: 2024-10-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-time-capsule/vulnerability/wordpress-backup-and-staging-by-wp-time-capsule-plugin-1-22-21-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-48033
Published: 2024-10-11
Description: Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkback: from n/a through <= 1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/talkback-secure-linkback-protocol/vulnerability/wordpress-talkback-plugin-1-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-48040
Published: 2024-10-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows SQL Injection.This issue affects Tainacan: from n/a through <= 0.21.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/tainacan/vulnerability/wordpress-tainacan-plugin-0-21-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-48041
Published: 2024-10-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary enhanced-tooltipglossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through <= 4.3.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/enhanced-tooltipglossary/vulnerability/wordpress-cm-tooltip-glossary-plugin-4-3-9-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-8912
Published: 2024-10-11
Description: An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users.

There are two Looker versions that are hosted by Looker:

  *  Looker (Google Cloud core) was found to be vulnerable. This issue has already been mitigated and our investigation has found no signs of exploitation.
  *  Looker (original) was not vulnerable to this issue.


Customer-hosted Looker instances were found to be vulnerable and must be upgraded.

This vulnerability has been patched in all supported versions of customer-hosted Looker, which are available on the  Looker download page https://download.looker.com/ .

For Looker customer-hosted instances, please update to the latest supported version of Looker as soon as possible. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page:

  *  23.12 -> 23.12.123+
  *  23.18 -> 23.18.117+
  *  24.0 -> 24.0.92+
  *  24.6 -> 24.6.77+
  *  24.8 -> 24.8.66+
  *  24.10 -> 24.10.78+
  *  24.12 -> 24.12.56+
  *  24.14 -> 24.14.37+
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://cloud.google.com/looker/docs/best-practices/security-bulletin-09-16-24