deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-23606
Published: 2024-02-20
Description: An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-131, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1925; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW/; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1925
CVE: CVE-2024-23809
Published: 2024-02-20
Description: A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .vdhr file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1919; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW/; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1919
CVE: CVE-2024-25274
Published: 2024-02-20
Description: An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gist.github.com/capable-Hub/725c294f1aeac729fa314a32fef55d5a; https://reference1.example.com/login; https://gist.github.com/capable-Hub/725c294f1aeac729fa314a32fef55d5a
CVE: CVE-2024-25366
Published: 2024-02-20
Description: Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServer_handleGetNameListRequest function to the mms_getnamelist_service component.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-190
References: https://github.com/mz-automation/libiec61850; https://github.com/mz-automation/libiec61850/issues/492; https://www.mz-automation.de/
CVE: CVE-2023-47635
Published: 2024-02-20
Description: Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public. The issue is fixed in version 0.27.5 and 0.28.0. As a workaround, disable the templates functionality or remove all available templates.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-918, CWE-352
References: https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11; https://github.com/decidim/decidim/commit/5542227be66e3b6d7530f5b536069bce09376660; https://github.com/decidim/decidim/commit/57a4b[PII_REDACTED]07b5d9b01ce6e2c8502e121ac
CVE: CVE-2023-48220
Published: 2024-02-20
Description: Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from the database.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-672, CWE-672
References: https://github.com/decidim/decidim/blob/d2d[PII_REDACTED]72d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134; https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34; https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454
CVE: CVE-2023-51447
Published: 2024-02-20
Description: Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it would require the attacker to control the whole session of the particular user but in any case, this needs to be fixed. Successful exploit of this vulnerability would require the user to have successfully uploaded a file blob to the server with a malicious file name and then have the possibility to direct the other user to the edit page of the record where the attachment is attached. The users are able to craft the direct upload requests themselves controlling the file name that gets stored to the database. The attacker is able to change the filename e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source. Versions 0.27.5 and 0.28.0 contain a patch for this issue. As a workaround, disable dynamic uploads for the instance, e.g. from proposals.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/decidim/decidim/commit/aaf72787cf18beeeb6a771c1f7cbb7654b073423; https://github.com/decidim/decidim/pull/11612; https://github.com/decidim/decidim/releases/tag/v0.27.5
CVE: CVE-2023-52434
Published: 2024-02-20
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential OOBs in smb2_parse_contexts()

Validate offsets and lengths before dereferencing create contexts in
smb2_parse_contexts().

This fixes following oops when accessing invalid create contexts from
server:

  BUG: unable to handle page fault for address: ffff8881178d8cc3
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 4a01067 P4D 4a01067 PUD 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
  RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]
  Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00
  00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7
  7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00
  RSP: 0018:ffffc900007939e0 EFLAGS: 00010216
  RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90
  RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000
  RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: [PII_REDACTED]
  R10: ffff8880180cc000 R11: [PII_REDACTED] R12: [PII_REDACTED]
  R13: [PII_REDACTED] R14: [PII_REDACTED] R15: ffffc90000793c22
  FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)
  knlGS:[PII_REDACTED]
  CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  CR2: ffff8881178d8cc3 CR3:[PII_REDACTED]1ca000 CR4:[PII_REDACTED]750ef0
  PKRU: 55555554
  Call Trace:
   <TASK>
   ? __die+0x23/0x70
   ? page_fault_oops+0x181/0x480
   ? search_module_extables+0x19/0x60
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? exc_page_fault+0x1b6/0x1c0
   ? asm_exc_page_fault+0x26/0x30
   ? smb2_parse_contexts+0xa0/0x3a0 [cifs]
   SMB2_open+0x38d/0x5f0 [cifs]
   ? smb2_is_path_accessible+0x138/0x260 [cifs]
   smb2_is_path_accessible+0x138/0x260 [cifs]
   cifs_is_path_remote+0x8d/0x230 [cifs]
   cifs_mount+0x7e/0x350 [cifs]
   cifs_smb3_do_mount+0x128/0x780 [cifs]
   smb3_get_tree+0xd9/0x290 [cifs]
   vfs_get_tree+0x2c/0x100
   ? capable+0x37/0x70
   path_mount+0x2d7/0xb80
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? _raw_spin_unlock_irqrestore+0x44/0x60
   __x64_sys_mount+0x11a/0x150
   do_syscall_64+0x47/0xf0
   entry_SYSCALL_64_after_hwframe+0x6f/0x77
  RIP: 0033:0x7f8737657b1e
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: https://git.kernel.org/stable/c/13fb0fc4917621f3dfa285a27eaf7151d770b5e5; https://git.kernel.org/stable/c/17a0f64cc02d4972e21c733d9f21d1c512963afa; https://git.kernel.org/stable/c/1ae3c59355dc9882e09c020afe8ffbd895ad0f29
CVE: CVE-2024-0794
Published: 2024-02-20
Description: Certain HP LaserJet Pro, HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to Remote Code Execution due to buffer overflow when rendering fonts embedded in a PDF file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]4074-16/; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]8670-16
CVE: CVE-2024-21678
Published: 2024-02-20
Description: This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center.

This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires no user interaction.
Data Center

Atlassian recommends that Confluence Data Center customers upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
||Affected versions||Fixed versions||
|from 8.7.0 to 8.7.1|8.8.0 recommended or 8.7.2|
|from 8.6.0 to 8.6.1|8.8.0 recommended|
|from 8.5.0 to 8.5.4 LTS|8.8.0 recommended or 8.5.5 LTS or 8.5.6 LTS|
|from 8.4.0 to 8.4.5|8.8.0 recommended or 8.5.6 LTS|
|from 8.3.0 to 8.3.4|8.8.0 recommended or 8.5.6 LTS|
|from 8.2.0 to 8.2.3|8.8.0 recommended or 8.5.6 LTS|
|from 8.1.0 to 8.1.4|8.8.0 recommended or 8.5.6 LTS|
|from 8.0.0 to 8.0.4|8.8.0 recommended or 8.5.6 LTS|
|from 7.20.0 to 7.20.3|8.8.0 recommended or 8.5.6 LTS|
|from 7.19.0 to 7.19.17 LTS|8.8.0 recommended or 8.5.6 LTS or 7.19.18 LTS or 7.19.19 LTS|
|from 7.18.0 to 7.18.3|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS|
|from 7.17.0 to 7.17.5|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS|
|Any earlier versions|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS|
Server

Atlassian recommends that Confluence Server customers upgrade to the latest 8.5.x LTS version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

 
||Affected versions||Fixed versions||
|from 8.5.0 to 8.5.4 LTS|8.5.5 LTS or 8.5.6 LTS recommended |
|from 8.4.0 to 8.4.5|8.5.6 LTS recommended|
|from 8.3.0 to 8.3.4|8.5.6 LTS recommended|
|from 8.2.0 to 8.2.3|8.5.6 LTS recommended|
|from 8.1.0 to 8.1.4|8.5.6 LTS recommended|
|from 8.0.0 to 8.0.4|8.5.6 LTS recommended|
|from 7.20.0 to 7.20.3|8.5.6 LTS recommended|
|from 7.19.0 to 7.19.17 LTS|8.5.6 LTS recommended or 7.19.18 LTS or 7.19.19 LTS|
|from 7.18.0 to 7.18.3|8.5.6 LTS recommended or 7.19.19 LTS|
|from 7.17.0 to 7.17.5|8.5.6 LTS recommended or 7.19.19 LTS|
|Any earlier versions|8.5.6 LTS recommended or 7.19.19 LTS|

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Bug Bounty program.
CVSS Score: 8.5 (HIGH)
CWE: CWE-79
References: https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/CONFSERVER-94513; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]
CVE: CVE-2024-21682
Published: 2024-02-20
Description: This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). 

Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network.

This Injection vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to modify the actions taken by a system call which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.

Atlassian recommends that Assets Discovery customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions

See the release notes (https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center[PII_REDACTED].html). You can download the latest version of Assets Discovery from the Atlassian Marketplace (https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation).

This vulnerability was reported via our Penetration Testing program.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center[PII_REDACTED].html; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/JSDSERVER-15067
CVE: CVE-2024-22054
Published: 2024-02-20
Description: A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.


Affected Products:
UniFi Access Points
UniFi Switches
UniFi LTE Backup
UniFi Express (Only Mesh Mode, Router mode is not affected)

  
Mitigation:
Update UniFi Access Points to Version 6.6.55 or later.
Update UniFi Switches to Version 6.6.61 or later.
Update UniFi LTE Backup to Version 6.6.57 or later.
Update UniFi Express to Version 3.2.5 or later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://community.ui.com/releases/Security-Advisory-Bulletin-037-037/9aeeccef-ca4a-4f10-9f66-1eb400b3d027; https://community.ui.com/releases/Security-Advisory-Bulletin-037-037/9aeeccef-ca4a-4f10-9f66-1eb400b3d027
CVE: CVE-2024-22245
Published: 2024-02-20
Description: Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287
References: https://www.vmware.com/security/advisories/VMSA-2024-0003.html; https://www.vmware.com/security/advisories/VMSA-2024-0003.html
CVE: CVE-2024-22250
Published: 2024-02-20
Description: Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-384
References: https://www.vmware.com/security/advisories/VMSA-2024-0003.html; https://www.vmware.com/security/advisories/VMSA-2024-0003.html
CVE: CVE-2024-24474
Published: 2024-02-20
Description: QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-191
References: https://gist.github.com/[PII_REDACTED]/5ce07b9d387095c276b1cd234ae5615e; https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52; https://gitlab.com/qemu-project/qemu/-/issues/1810
CVE: CVE-2024-24763
Published: 2024-02-20
Description: JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/jumpserver/jumpserver/releases/tag/v3.10.0; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5; https://github.com/jumpserver/jumpserver/releases/tag/v3.10.0
CVE: CVE-2024-25260
Published: 2024-02-20
Description: elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-476
References: https://github.com/schsiung/fuzzer_issues/issues/1; https://sourceware.org/bugzilla/show_bug.cgi?id=31058; https://sourceware.org/elfutils/
CVE: CVE-2024-25630
Published: 2024-02-20
Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-311, CWE-319
References: https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg; https://github.com/cilium/cilium/releases/tag/v1.14.7; https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82
CVE: CVE-2024-25631
Published: 2024-02-20
Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-311, CWE-319
References: https://docs.cilium.io/en/stable/installation/k8s-install-external-etcd/#when-do-i-need-to-use-a-kvstore; https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg; https://github.com/cilium/cilium/releases/tag/v1.14.7
CVE: CVE-2024-26135
Published: 2024-02-20
Description: MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is exploitable when an attacker is able to convince a victim end-user to click on a malicious link to a page hosting an attacker-controlled site. The attacker can then originate a cross-site websocket connection using client-side JavaScript code to connect to `control.ashx` as the victim user within MeshCentral. Version 1.1.21 contains a patch for this issue.
CVSS Score: 8.3 (HIGH)
CWE: CWE-346, CWE-346
References: https://github.com/Ylianst/MeshCentral/commit/f2e43cc6da9f5447dbff0948e6c6024c8a315af3; https://github.com/Ylianst/MeshCentral/security/advisories/GHSA-cp68-qrhr-g9h8; https://github.com/Ylianst/MeshCentral/commit/f2e43cc6da9f5447dbff0948e6c6024c8a315af3
CVE: CVE-2023-46967
Published: 2024-02-20
Description: Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted support ticket.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.sonarsource.com/blog/pitfalls-of-desanitization-leaking-customer-data-from-osticket/; https://www.sonarsource.com/blog/pitfalls-of-desanitization-leaking-customer-data-from-osticket/
CVE: CVE-2023-49034
Published: 2024-02-20
Description: Cross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/thedroidgeek/0a9b8189b74f968b5d7b84ec12b8f8f5; https://gist.github.com/thedroidgeek/0a9b8189b74f968b5d7b84ec12b8f8f5
CVE: CVE-2023-52436
Published: 2024-02-20
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: explicitly null-terminate the xattr list

When setting an xattr, explicitly null-terminate the xattr list.  This
eliminates the fragile assumption that the unused xattr space is always
zeroed.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/12cf91e23b126718a96b914f949f2cdfeadc7b2a; https://git.kernel.org/stable/c/16ae3132ff[PII_REDACTED]927c[PII_REDACTED]b89135; https://git.kernel.org/stable/c/2525d1ba225b5c167162fa344013c408e8b4de36
CVE: CVE-2023-52437
Published: 2024-02-20
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.