deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-57648
Published: 2025-01-14
Description: An issue in the itc_set_param_row component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1195
CVE: CVE-2024-57649
Published: 2025-01-14
Description: An issue in the qst_vec_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1206
CVE: CVE-2024-57650
Published: 2025-01-14
Description: An issue in the qi_inst_state_free component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1204
CVE: CVE-2024-57651
Published: 2025-01-14
Description: An issue in the jp_add component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1196
CVE: CVE-2024-57652
Published: 2025-01-14
Description: An issue in the numeric_to_dv component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1198
CVE: CVE-2024-57653
Published: 2025-01-14
Description: An issue in the qst_vec_set_copy component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1208
CVE: CVE-2024-57654
Published: 2025-01-14
Description: An issue in the qst_vec_get_int64 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://github.com/openlink/virtuoso-opensource/issues/1205
CVE: CVE-2024-57655
Published: 2025-01-14
Description: An issue in the dfe_n_in_order component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/openlink/virtuoso-opensource/issues/1216
CVE: CVE-2024-57656
Published: 2025-01-14
Description: An issue in the sqlc_add_distinct_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1210
CVE: CVE-2024-57657
Published: 2025-01-14
Description: An issue in the sqlg_vec_upd component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1219
CVE: CVE-2024-57658
Published: 2025-01-14
Description: An issue in the sql_tree_hash_1 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1209
CVE: CVE-2024-57659
Published: 2025-01-14
Description: An issue in the sqlg_parallel_ts_seq component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://github.com/openlink/virtuoso-opensource/issues/1212
CVE: CVE-2024-57660
Published: 2025-01-14
Description: An issue in the sqlo_expand_jts component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/openlink/virtuoso-opensource/issues/1221
CVE: CVE-2024-57661
Published: 2025-01-14
Description: An issue in the sqlo_df component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://github.com/openlink/virtuoso-opensource/issues/1220
CVE: CVE-2024-57662
Published: 2025-01-14
Description: An issue in the sqlg_hash_source component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/openlink/virtuoso-opensource/issues/1217
CVE: CVE-2024-57663
Published: 2025-01-14
Description: An issue in the sqlg_place_dpipes component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/openlink/virtuoso-opensource/issues/1218
CVE: CVE-2024-57664
Published: 2025-01-14
Description: An issue in the sqlg_group_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/openlink/virtuoso-opensource/issues/1211
CVE: CVE-2025-0053
Published: 2025-01-14
Description: SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://me.sap.com/notes/3536461; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0055
Published: 2025-01-14
Description: SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-497
References: https://me.sap.com/notes/3472837; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0056
Published: 2025-01-14
Description: SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-497
References: https://me.sap.com/notes/3502459; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0057
Published: 2025-01-14
Description: SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-434
References: https://me.sap.com/notes/3514421; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0058
Published: 2025-01-14
Description: In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://me.sap.com/notes/3542698; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0059
Published: 2025-01-14
Description: Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-497
References: https://me.sap.com/notes/3503138; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0060
Published: 2025-01-14
Description: SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://me.sap.com/notes/3474398; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0061
Published: 2025-01-14
Description: SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.
CVSS Score: 8.7 (HIGH)
CWE: CWE-497
References: https://me.sap.com/notes/3474398; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0063
Published: 2025-01-14
Description: SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://me.sap.com/notes/3550816; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0066
Published: 2025-01-14
Description: Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-732
References: https://me.sap.com/notes/3550708; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0067
Published: 2025-01-14
Description: Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3540108; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0068
Published: 2025-01-14
Description: An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3550674; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0069
Published: 2025-01-14
Description: Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account could gain higher privileges. With this, he could move laterally within the network and further compromise the active directory of a company. This leads to high impact on confidentiality, integrity and availability of the Windows server.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://me.sap.com/notes/3542533; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0070
Published: 2025-01-14
Description: SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-287
References: https://me.sap.com/notes/3537476; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-23030
Published: 2025-01-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `cadastro_funcionario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `cpf` parameter. The application fails to validate and sanitize user inputs in the `cpf` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/420b88e7aceed53c42e9eff7d21beee8465f93b8; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-88c9-gpgh-6vvr
CVE: CVE-2025-23031
Published: 2025-01-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_alergia.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `nome` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_alergia.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/f35910cb8b9205a6f038ef1e8b3413ea8eee850b; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-wp4f-qhh2-8vfv
CVE: CVE-2025-23032
Published: 2025-01-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_escala.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `escala` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_escala.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/09affa8ae0dc5f[PII_REDACTED]02f7e3d4636147b0; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6mm4-fcfv-55x3
CVE: CVE-2025-23033
Published: 2025-01-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_situacao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `situacao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_situacao.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/e6bfae095258e1200192f15bea68a933e9f310b9; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-r8fq-hqr2-v5j9
CVE: CVE-2025-23034
Published: 2025-01-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `tags.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_e` parameter. The application fails to validate and sanitize user inputs in the `msg_e` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/8a37021417d9c55e61392b3cc52baa3c73102bab; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v68m-2rvf-8r25
CVE: CVE-2025-23035
Published: 2025-01-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_quadro_horario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_tipo_quadro_horario.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/673d7a36baebb1a0093f421cfd51e3df8a55c84a; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qfmh-qrr2-5c4g
CVE: CVE-2025-23036
Published: 2025-01-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `pre_cadastro_funcionario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_e` parameter. The application fails to validate and sanitize user inputs in the `msg_e` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.7. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/8369b75f88e64916151e5413a8b7d517d438d7a9; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-2vpg-j5jh-j22x; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-2vpg-j5jh-j22x
CVE: CVE-2025-23037
Published: 2025-01-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `control.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `cargo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `control.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/3e4d5a[PII_REDACTED]314edfd6dfdef063dc255cbd; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rjjp-w2wm-7f9j; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rjjp-w2wm-7f9j
CVE: CVE-2025-23038
Published: 2025-01-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `remuneracao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `remuneracao.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/0d81074c6fc0470373ecc85738f47b83357a0a7e; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rp2v-7hpw-m6qc
CVE: CVE-2024-11637
Published: 2025-01-14
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.