deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-48935
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: unregister flowtable hooks on netns exit

Unregister flowtable hooks before they are releases via
nf_tables_flowtable_destroy() otherwise hook core reports UAF.

BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142
Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666

CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106
 dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106
 print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247
 __kasan_report mm/kasan/report.c:433 [inline]
 __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450
 kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450
 nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142
 __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429
 nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571
 nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232
 nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430
 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]
 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652
 nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652

__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which
only unregisters the hooks, then after RCU grace period, it is
guaranteed that no packets add new entries to the flowtable (no flow
offload rules and flowtable hooks are reachable from packet path), so it
is safe to call nf_flow_table_free() which cleans up the remaining
entries from the flowtable (both software and hardware) and it unbinds
the flow_block.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/6069da443bf65f513bb507bb21e2f87cfb1ad0b6; https://git.kernel.org/stable/c/8ffb8ac3448845f65634889b051bd65e4dee484b; https://git.kernel.org/stable/c/b4fcc081e527aa2ce12e956912fc47e251f6bd27
CVE: CVE-2022-48936
Published: 2024-08-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-48938
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

CDC-NCM: avoid overflow in sanity checking

A broken device may give an extreme offset like 0xFFF0
and a reasonable length for a fragment. In the sanity
check as formulated now, this will create an integer
overflow, defeating the sanity check. Both offset
and offset + len need to be checked in such a manner
that no overflow can occur.
And those quantities should be unsigned.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://git.kernel.org/stable/c/49909c9f8458cacb5b241106cba65aba5a6d8f4c; https://git.kernel.org/stable/c/69560efa001397ebb8dc1c3e6a3ce00302bb9f7f; https://git.kernel.org/stable/c/7b737e47b87589031f0d4657f6d7b0b770474925
CVE: CVE-2022-48939
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Add schedule points in batch ops

syzbot reported various soft lockups caused by bpf batch operations.

 INFO: task kworker/1:1:27 blocked for more than 140 seconds.
 INFO: task hung in rcu_barrier

Nothing prevents batch ops to process huge amount of data,
we need to add schedule points in them.

Note that maybe_wait_bpf_programs(map) calls from
generic_map_delete_batch() can be factorized by moving
the call after the loop.

This will be done later in -next tree once we get this fix merged,
unless there is strong opinion doing this optimization sooner.
CVSS Score: 3.3 (LOW)
CWE: CWE-834
References: https://git.kernel.org/stable/c/75134f16e7dd0007aa474b281935c5f42e79f2c8; https://git.kernel.org/stable/c/7e8099967d0e3ff9d1ae043e80b27fbe46c08417; https://git.kernel.org/stable/c/7ef94bfb08fb9e73defafbd5ddef6b5a0e2ee12b
CVE: CVE-2022-48941
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

ice: fix concurrent reset and removal of VFs

Commit c503e63200c6 ("ice: Stop processing VF messages during teardown")
introduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is
intended to prevent some issues with concurrently handling messages from
VFs while tearing down the VFs.

This change was motivated by crashes caused while tearing down and
bringing up VFs in rapid succession.

It turns out that the fix actually introduces issues with the VF driver
caused because the PF no longer responds to any messages sent by the VF
during its .remove routine. This results in the VF potentially removing
its DMA memory before the PF has shut down the device queues.

Additionally, the fix doesn't actually resolve concurrency issues within
the ice driver. It is possible for a VF to initiate a reset just prior
to the ice driver removing VFs. This can result in the remove task
concurrently operating while the VF is being reset. This results in
similar memory corruption and panics purportedly fixed by that commit.

Fix this concurrency at its root by protecting both the reset and
removal flows using the existing VF cfg_lock. This ensures that we
cannot remove the VF while any outstanding critical tasks such as a
virtchnl message or a reset are occurring.

This locking change also fixes the root cause originally fixed by commit
c503e63200c6 ("ice: Stop processing VF messages during teardown"), so we
can simply revert it.

Note that I kept these two changes together because simply reverting the
original commit alone would leave the driver vulnerable to worse race
conditions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/2a3e61de89bab6696aa28b70030eb119968c5586; https://git.kernel.org/stable/c/3c805fce07c9dbc47d8a9129c7c[PII_REDACTED]957; https://git.kernel.org/stable/c/fadead80fe4c033b5e514fcbadd20b55c4494112
CVE: CVE-2022-48942
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

hwmon: Handle failure to register sensor with thermal zone correctly

If an attempt is made to a sensor with a thermal zone and it fails,
the call to devm_thermal_zone_of_sensor_register() may return -ENODEV.
This may result in crashes similar to the following.

Unable to handle kernel NULL pointer dereference at virtual address[PII_REDACTED]0003cd
...
Internal error: Oops: 96000021 [#1] PREEMPT SMP
...
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : mutex_lock+0x18/0x60
lr : thermal_zone_device_update+0x40/0x2e0
sp : ffff800014c4fc60
x29: ffff800014c4fc60 x28: ffff365ee3f6e000 x27: ffffdde218426790
x26: ffff365ee3f6e000 x25: [PII_REDACTED] x24: ffff365ee3f6e000
x23: ffffdde218426870 x22: ffff365ee3f6e000 x21:[PII_REDACTED]0003cd
x20: ffff365ee8bf3308 x19: ffffffffffffffed x18: [PII_REDACTED]
x17: ffffdde21842689c x16: ffffdde1cb7a0b7c x15: [PII_REDACTED]
x14: ffffdde21a4889a0 x13: [PII_REDACTED] x12: [PII_REDACTED]
x11: [PII_REDACTED] x10: [PII_REDACTED] x9 : [PII_REDACTED]
x8 : [PII_REDACTED] x7 : [PII_REDACTED] x6 : [PII_REDACTED]
x5 :[PII_REDACTED]e20f07 x4 : [PII_REDACTED] x3 :[PII_REDACTED]0003cd
x2 : ffff365ee3f6e000 x1 : [PII_REDACTED] x0 :[PII_REDACTED]0003cd
Call trace:
 mutex_lock+0x18/0x60
 hwmon_notify_event+0xfc/0x110
 0xffffdde1cb7a0a90
 0xffffdde1cb7a0b7c
 irq_thread_fn+0x2c/0xa0
 irq_thread+0x134/0x240
 kthread+0x178/0x190
 ret_from_fork+0x10/0x20
Code: d503201f d503201f d2800001 aa0103e4 (c8e47c02)

Jon Hunter reports that the exact call sequence is:

hwmon_notify_event()
  --> hwmon_thermal_notify()
    --> thermal_zone_device_update()
      --> update_temperature()
        --> mutex_lock()

The hwmon core needs to handle all errors returned from calls
to devm_thermal_zone_of_sensor_register(). If the call fails
with -ENODEV, report that the sensor was not attached to a
thermal zone  but continue to register the hwmon device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1b5f517cca36292076d9e38fa6e33a257703e62e; https://git.kernel.org/stable/c/7efe8499cb90651c540753f4269d2d43ede14223; https://git.kernel.org/stable/c/8a1969e14ad93663f9a3ed02ccc2138da9956a0e
CVE: CVE-2022-48943
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: make apf token non-zero to fix bug

In current async pagefault logic, when a page is ready, KVM relies on
kvm_arch_can_dequeue_async_page_present() to determine whether to deliver
a READY event to the Guest. This function test token value of struct
kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a
READY event is finished by Guest. If value is zero meaning that a READY
event is done, so the KVM can deliver another.
But the kvm_arch_setup_async_pf() may produce a valid token with zero
value, which is confused with previous mention and may lead the loss of
this READY event.

This bug may cause task blocked forever in Guest:
 INFO: task stress:7532 blocked for more than 1254 seconds.
       Not tainted 5.10.0 #16
 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 task:stress          state:D stack:    0 pid: 7532 ppid:  1409
 flags:0x00000080
 Call Trace:
  __schedule+0x1e7/0x650
  schedule+0x46/0xb0
  kvm_async_pf_task_wait_schedule+0xad/0xe0
  ? exit_to_user_mode_prepare+0x60/0x70
  __kvm_handle_async_pf+0x4f/0xb0
  ? asm_exc_page_fault+0x8/0x30
  exc_page_fault+0x6f/0x110
  ? asm_exc_page_fault+0x8/0x30
  asm_exc_page_fault+0x1e/0x30
 RIP: 0033:0x402d00
 RSP: 002b:00007ffd31912500 EFLAGS: 00010206
 RAX: [PII_REDACTED] RBX: ffffffffffffffff RCX:[PII_REDACTED]1a32b0
 RDX:[PII_REDACTED]07d011 RSI:[PII_REDACTED]07d000 RDI:[PII_REDACTED]1262b0
 RBP:[PII_REDACTED]1262b0 R08: [PII_REDACTED] R09: [PII_REDACTED]
 R10:[PII_REDACTED]0000eb R11: 00007fefbdf2baa0 R12: [PII_REDACTED]
 R13: [PII_REDACTED] R14:[PII_REDACTED]07d000 R15: [PII_REDACTED]
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/4c3644b6c96c5daa5149e5abddc07234eea47c7c; https://git.kernel.org/stable/c/62040f5cd7d937de547836e747b6aa8212fec573; https://git.kernel.org/stable/c/6f3c1fc53d86d580d8d6d749c4af23705e4f6f79
CVE: CVE-2024-45163
Published: 2024-08-22
Description: The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. Unauthenticated sessions remain open, causing resource consumption. For example, an attacker can send a recognized username (such as root), or can send arbitrary data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-400
References: https://cypressthatkid.medium.com/remote-dos-exploit-found-in-mirai-botnet-source-code-27a1aad284f1; https://flowtriq.com/blog/cve-2024-45163-mirai-botnet-kill-switch; https://pastebin.com/6tqHnCva
CVE: CVE-2024-45165
Published: 2024-08-22
Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is both static and hardcoded. With access to messages, this results in message decryption and encryption by an attacker. Thus, it enables passive and active man-in-the-middle attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798
References: http://download.uci.de/idol2/idol2Client_2_12.exe; https://uci.de/download/idol2-client.html; https://uci.de/products/index.html
CVE: CVE-2024-45166
Published: 2024-08-22
Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer, IDOL2 is vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution. There is an access violation and EIP overwrite after five logins.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400
References: http://download.uci.de/idol2/idol2Client_2_12.exe; https://uci.de/download/idol2-client.html; https://uci.de/products/index.html
CVE: CVE-2024-45167
Published: 2024-08-22
Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer, IDOL2 is vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution. A certain XmlMessage document causes 100% CPU consumption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://download.uci.de/idol2/idol2Client_2_12.exe; https://uci.de/download/idol2-client.html; https://uci.de/products/index.html
CVE: CVE-2024-45168
Published: 2024-08-22
Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is transferred over a raw socket without any authentication mechanism. Thus, communication endpoints are not verifiable.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: http://download.uci.de/idol2/idol2Client_2_12.exe; https://uci.de/download/idol2-client.html; https://uci.de/products/index.html
CVE: CVE-2024-45169
Published: 2024-08-22
Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer, IDOL2 is vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution via the \xB0\x00\x3c byte sequence.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-119
References: http://download.uci.de/idol2/idol2Client_2_12.exe; https://uci.de/download/idol2-client.html; https://uci.de/products/index.html
CVE: CVE-2024-32939
Published: 2024-08-22
Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-312
References: https://mattermost.com/security-updates
CVE: CVE-2024-39810
Published: 2024-08-22
Description: Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the connection, cause the application to crash.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://mattermost.com/security-updates
CVE: CVE-2024-39836
Published: 2024-08-22
Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to  ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-693
References: https://mattermost.com/security-updates
CVE: CVE-2024-40886
Published: 2024-08-22
Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://mattermost.com/security-updates
CVE: CVE-2024-42411
Published: 2024-08-22
Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://mattermost.com/security-updates
CVE: CVE-2024-43813
Published: 2024-08-22
Description: Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates
CVE: CVE-2024-8071
Published: 2024-08-22
Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates
CVE: CVE-2024-8072
Published: 2024-08-22
Description: Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://research.jfrog.com/vulnerabilities/mage-ai-terminal-server-infoleak-jfsa-2[PII_REDACTED]74/
CVE: CVE-2024-6870
Published: 2024-08-22
Description: The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping affecting the rl_upload_image AJAX endpoint. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.4.7/includes/class-remote-library.php#L261; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3137531%40responsive-lightbox&new=3137531%40responsive-lightbox&sfp_email=&sfph_mail=; https://wordpress.org/plugins/responsive-lightbox/#developers
CVE: CVE-2024-7778
Published: 2024-08-22
Description: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.10.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/2.10.36/obfx_modules/custom-fonts/custom_fonts_admin.php#L376; https://plugins.trac.wordpress.org/changeset/3139233/; https://plugins.trac.wordpress.org/changeset/3139233/#file71
CVE: CVE-2024-35151
Published: 2024-08-22
Description: IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-288, CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/292638; https://www.ibm.com/support/pages/node/7165959
CVE: CVE-2024-39744
Published: 2024-08-22
Description: IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/297236; https://www.ibm.com/support/pages/node/7166196
CVE: CVE-2024-39745
Published: 2024-08-22
Description: IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/297312; https://www.ibm.com/support/pages/node/7166195
CVE: CVE-2024-39746
Published: 2024-08-22
Description: IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.ibm.com/support/pages/node/7166018
CVE: CVE-2024-7848
Published: 2024-08-22
Description: The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpk_upvf_update_doc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to gain access to other user's private files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3136913%40user-private-files&new=3136913%40user-private-files&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb06de8-97d6-46c3-83ef-93a209540259?source=cve
CVE: CVE-2024-43331
Published: 2024-08-22
Description: Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-9-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-36443
Published: 2024-08-22
Description: Swissphone DiCal-RED 4009 devices allow a remote attacker to gain read access to almost the whole file system via anonymous FTP.
CVSS Score: 7.6 (HIGH)
CWE: CWE-284
References: https://www.swissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-red/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-036.txt; http://seclists.org/fulldisclosure/2024/Aug/28
CVE: CVE-2024-36439
Published: 2024-08-22
Description: Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without knowing the actual device password.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-269
References: https://www.swissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-red/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-038.txt; http://seclists.org/fulldisclosure/2024/Aug/32
CVE: CVE-2024-36440
Published: 2024-08-22
Description: An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device password via password-cracking methods, because unsalted MD5 is used.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-327, CWE-759, CWE-1393
References: https://www.swissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-red/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-037.txt; http://seclists.org/fulldisclosure/2024/Aug/31
CVE: CVE-2024-36442
Published: 2024-08-22
Description: cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-552
References: https://www.swissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-red/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-039.txt; http://seclists.org/fulldisclosure/2024/Aug/33