deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7724
Published: 2024-08-21
Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23900.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1126/
CVE: CVE-2024-7725
Published: 2024-08-21
Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23928.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1127/
CVE: CVE-2024-7795
Published: 2024-08-21
Description: Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the AppAuthenExchangeRandomNum BLE command. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23384.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-119
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1154/
CVE: CVE-2024-20375
Published: 2024-08-21
Description: A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
 This vulnerability is due to improper parsing of SIP messages. An attacker could exploit this vulnerability by sending a crafted SIP message to an affected Cisco Unified CM or Cisco Unified CM SME device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition that interrupts the communications of reliant voice and video devices.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-dos-kkHq43We
CVE: CVE-2024-33656
Published: 2024-08-21
Description: The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. This could lead to privilege escalation, arbitrary code execution, and bypassing OS security mechanisms
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024003.pdf
CVE: CVE-2024-33657
Published: 2024-08-21
Description: This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAM to kernel space, potentially leading to denial-of-service attacks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024003.pdf
CVE: CVE-2024-40453
Published: 2024-08-21
Description: squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/squirrellyjs/squirrelly; https://github.com/squirrellyjs/squirrelly/pull/262; https://samuzora.com/posts/cve-2024-40453
CVE: CVE-2024-42550
Published: 2024-08-21
Description: A cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/topsky979/3332b6ba95f5a95aec4f635d8bb20f7c
CVE: CVE-2024-43022
Published: 2024-08-21
Description: An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/b0rgch3n/6ba0b04da7e48ead20f10b15088fd244
CVE: CVE-2024-5723
Published: 2024-08-21
Description: Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the updateServiceHost function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-23294.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-24-595/
CVE: CVE-2024-5725
Published: 2024-08-21
Description: Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the initCurveList function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-22683.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-24-597/; https://thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3744
CVE: CVE-2024-5762
Published: 2024-08-21
Description: Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the findPluginAdminPage function. The issue results from the lack of proper validation of user-supplied data prior to passing it to a PHP include function. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-21408.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98, CWE-829
References: https://docs.zen-cart.com/release/whatsnew_2.0.0; https://www.zerodayinitiative.com/advisories/ZDI-24-883/
CVE: CVE-2024-5928
Published: 2024-08-21
Description: VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Patch Management Agent. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22315.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://success.vipre.com/en_US/home-windows-release-notes/home-windows-release-notes-20240227; https://www.zerodayinitiative.com/advisories/ZDI-24-817/
CVE: CVE-2024-5929
Published: 2024-08-21
Description: VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Patch Management Agent. The issue results from loading a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22316.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://success.vipre.com/en_US/home-windows-release-notes/home-windows-release-notes-20240227; https://www.zerodayinitiative.com/advisories/ZDI-24-818/
CVE: CVE-2024-5930
Published: 2024-08-21
Description: VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Anti Malware Service. The issue results from incorrect permissions on a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22345.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://success.vipre.com/en_US/home-windows-release-notes/home-windows-release-notes-20240227; https://www.zerodayinitiative.com/advisories/ZDI-24-819/
CVE: CVE-2024-6141
Published: 2024-08-21
Description: Windscribe Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Windscribe Service. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23441.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://github.com/Windscribe/Desktop-App/blob/90a5cc3c1f50f6545f83969c2ace6b4ac2c91c4e/client/common/changelog.txt#L23; https://www.zerodayinitiative.com/advisories/ZDI-24-820/
CVE: CVE-2024-7448
Published: 2024-08-21
Description: Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must acquire data from a malicious mobile device.

The specific flaw exists within the Android device image acquisition functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23964.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://docs.magnetforensics.com/docs/axiom/release_notes.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1129/
CVE: CVE-2023-29929
Published: 2024-08-21
Description: Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service via the libkemplink.so, isreverse library.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://kemptechnologies.com; http://loadmaster.com; https://github.com/YSaxon/CVE-2023-29929/
CVE: CVE-2024-42777
Published: 2024-08-21
Description: An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20SignUp.pdf
CVE: CVE-2024-42778
Published: 2024-08-21
Description: An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20New%20Playlist.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42779
Published: 2024-08-21
Description: An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20New%20Music%20List.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42780
Published: 2024-08-21
Description: An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20New%20Genre.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42781
Published: 2024-08-21
Description: A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20Login.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42782
Published: 2024-08-21
Description: A SQL injection vulnerability in "/music/ajax.php?action=find_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "search" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20Find%20Music.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42783
Published: 2024-08-21
Description: Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage_playlist_items.php. An attacker can execute arbitrary SQL commands via the "pid" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20Manage%20Playlist.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42784
Published: 2024-08-21
Description: A SQL injection vulnerability in "/music/controller.php?page=view_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20View%20Music%20List.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42785
Published: 2024-08-21
Description: A SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20View%20Playlist.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42786
Published: 2024-08-21
Description: A SQL injection vulnerability in "/music/view_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20View%20Profile.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-20488
Published: 2024-08-21
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-9zmfHyZ
CVE: CVE-2024-41572
Published: 2024-08-21
Description: Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). The application has a specific function that does not filter special characters in URL parameters. Remote attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal user credentials or execute actions such as injecting malicious scripts or redirecting users to malicious sites.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40ChadSecurity/cve-2024-41572-68397fae354b
CVE: CVE-2024-20417
Published: 2024-08-21
Description: Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection attacks.

These vulnerabilities are due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit these vulnerabilities by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rest-5bPKrNtZ
CVE: CVE-2024-20466
Published: 2024-08-21
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. 

This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266, CWE-863
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-vdF8Jbyk
CVE: CVE-2024-20486
Published: 2024-08-21
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.

This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-csrf-y4ZUz5Rj
CVE: CVE-2024-6386
Published: 2024-08-21
Description: The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-1336, CWE-94
References: https://sec.stealthcopter.com/wpml-rce-via-twig-ssti/; https://wpml.org/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f7fc91cc-e529-4362-8269-bf7ee0766e1e?source=cve
CVE: CVE-2024-7964
Published: 2024-08-21
Description: Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/358296941
CVE: CVE-2024-7965
Published: 2024-08-21
Description: Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-358
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/356196918; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7965
CVE: CVE-2024-7966
Published: 2024-08-21
Description: Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-125
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/355465305