deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9086
Published: 2024-09-22
Description: A vulnerability classified as critical has been found in code-projects Restaurant Reservation System 1.0. Affected is an unknown function of the file /filter.php. The manipulation of the argument from/to leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "from" to be affected. But it must be assumed that parameter "to" is affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/ppp-src/a/issues/20; https://vuldb.com/?ctiid.278262
CVE: CVE-2024-9087
Published: 2024-09-22
Description: A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. This affects an unknown part of the file /edit1.php. The manipulation of the argument sno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/ppp-src/a/issues/19; https://vuldb.com/?ctiid.278265
CVE: CVE-2024-9088
Published: 2024-09-22
Description: A vulnerability has been found in SourceCodester Telecom Billing Management System 1.0 and classified as critical. This vulnerability affects the function login. The manipulation of the argument uname leads to buffer overflow. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/CveSecLook/cve/issues/61; https://vuldb.com/?ctiid.278266; https://vuldb.com/?id.278266
CVE: CVE-2024-43989
Published: 2024-09-23
Description: Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through <= 4.6.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/justified-image-grid/vulnerability/wordpress-justified-image-grid-plugin-4-6-1-unauthenticated-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-9089
Published: 2024-09-23
Description: A vulnerability was found in SourceCodester Modern Loan Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file update_loan_record.php. The manipulation of the argument amount leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.278267; https://vuldb.com/?id.278267; https://vuldb.com/?submit.411877
CVE: CVE-2024-9090
Published: 2024-09-23
Description: A vulnerability was found in SourceCodester Modern Loan Management System 1.0. It has been classified as critical. Affected is an unknown function of the file search_member.php. The manipulation of the argument searchMember leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?ctiid.278268; https://vuldb.com/?id.278268; https://vuldb.com/?submit.411879
CVE: CVE-2024-9091
Published: 2024-09-23
Description: A vulnerability was found in code-projects Student Record System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument regno leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/ppp-src/a/issues/21; https://vuldb.com/?ctiid.278269
CVE: CVE-2024-43996
Published: 2024-09-23
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.This issue affects ElementsKit Pro: from n/a through 3.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/elementskit/wordpress-elementskit-pro-plugin-3-6-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-44048
Published: 2024-09-23
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through <= 1.9.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/woo-product-carousel-slider-and-grid-ultimate/vulnerability/wordpress-product-carousel-slider-grid-ultimate-for-woocommerce-plugin-1-9-10-authenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-45453
Published: 2024-09-23
Description: Authentication Bypass by Spoofing vulnerability in Peter Hardy-vanDoorn Maintenance Redirect jf3-maintenance-mode.This issue affects Maintenance Redirect: from n/a through <= 2.0.1.
CVSS Score: 3.7 (LOW)
CWE: CWE-290
References: https://patchstack.com/database/Wordpress/Plugin/jf3-maintenance-mode/vulnerability/wordpress-maintenance-redirect-plugin-2-0-1-ip-bypass-vulnerability?_s_id=cve
CVE: CVE-2024-9092
Published: 2024-09-23
Description: A vulnerability was found in SourceCodester Profile Registration without Reload Refresh 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file add.php of the component Registration Form. The manipulation of the argument full_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/jadu101/CVE/blob/main/SourceCodester_Profile_Registration_add_php_XSS.md; https://vuldb.com/?ctiid.278270; https://vuldb.com/?id.278270
CVE: CVE-2024-9093
Published: 2024-09-23
Description: A vulnerability classified as critical has been found in SourceCodester Profile Registration without Reload Refresh 1.0. This affects an unknown part of the file del.php of the component GET Parameter Handler. The manipulation of the argument list leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/SourceCodester_Profile_Registration_without_Reload_Refresh_1.0_SQLi.md; https://vuldb.com/?ctiid.278271; https://vuldb.com/?id.278271
CVE: CVE-2024-9094
Published: 2024-09-23
Description: A vulnerability classified as critical was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file /admin/blood/update/o-.php. The manipulation of the argument bloodname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/ByKevin1/CVE/blob/main/sql1.md; https://vuldb.com/?ctiid.278272
CVE: CVE-2024-47227
Published: 2024-09-23
Description: iRedAdmin before 2.6 allows XSS, e.g., via order_name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docs.iredmail.org/upgrade.iredmail.1.6.8-1.7.0.html#upgrade-iredadmin-open-source-edition-to-the-latest-stable-release-26; https://github.com/iredmail/iRedAdmin/commit/3c72b438d412ea3ee0270f6956e19b1098c19191; https://github.com/iredmail/iRedAdmin/commit/b537e71ecf522d7f10180f5f0aab4a98a881893a
CVE: CVE-2024-7846
Published: 2024-09-23
Description: YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/86f7a136-d09b-4637-97ae-2cdaaff172a3/
CVE: CVE-2024-8758
Published: 2024-09-23
Description: The Quiz and Survey Master (QSM)  WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d74ecae2-3a1e-4fc7-9dd3-04cef631ecd9/
CVE: CVE-2024-8606
Published: 2024-09-23
Description: Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://checkmk.com/werk/16218
CVE: CVE-2024-45348
Published: 2024-09-23
Description: Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=547
CVE: CVE-2024-8903
Published: 2024-09-23
Description: Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows, macOS) before build 38565.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-250
References: https://security-advisory.acronis.com/advisories/SEC-7510
CVE: CVE-2022-48945
Published: 2024-09-23
Description: In the Linux kernel, the following vulnerability has been resolved:

media: vivid: fix compose size exceed boundary

syzkaller found a bug:

 BUG: unable to handle page fault for address: ffffc9000a3b1000
 #PF: supervisor write access in kernel mode
 #PF: error_code(0x0002) - not-present page
 PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0
 Oops: 0002 [#1] PREEMPT SMP
 CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
 RIP: 0010:memcpy_erms+0x6/0x10
[...]
 Call Trace:
  <TASK>
  ? tpg_fill_plane_buffer+0x856/0x15b0
  vivid_fillbuff+0x8ac/0x1110
  vivid_thread_vid_cap_tick+0x361/0xc90
  vivid_thread_vid_cap+0x21a/0x3a0
  kthread+0x143/0x180
  ret_from_fork+0x1f/0x30
  </TASK>

This is because we forget to check boundary after adjust compose->height
int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem
for this case.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2f558c5208b0f70c8140e08ce09fcc84da48e789; https://git.kernel.org/stable/c/54f259906039dbfe46c550011409fa16f72370f6; https://git.kernel.org/stable/c/5edc[PII_REDACTED]da8da0fb092b71d7dce07d848a
CVE: CVE-2024-46544
Published: 2024-09-23
Description: Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service.

This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected.

Users are recommended to upgrade to version 1.2.50, which fixes the issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-276
References: https://lists.apache.org/thread/q1gp7cc38hs1r8gj8gfnopwznd5fpr4d; http://www.openwall.com/lists/oss-security/2024/09/23/1; https://lists.debian.org/debian-lts-announce/2024/10/msg00010.html
CVE: CVE-2024-7735
Published: 2024-09-23
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Exnet Informatics Software Ferry Reservation System allows SQL Injection.This issue affects Ferry Reservation System: before 240805-002.
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1518
CVE: CVE-2024-7835
Published: 2024-09-23
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Exnet Informatics Software Ferry Reservation System allows Reflected XSS.This issue affects Ferry Reservation System: before 240805-002.
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-1518
CVE: CVE-2024-46241
Published: 2024-09-23
Description: PHPGurukul Dairy Farm Shop Management System v1.1 is vulnerable to Cross-Site Scripting (XSS) via the pname parameter in add_product.php and edit_product.php.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/npemma2/PHP_DairyFarm_XSS
CVE: CVE-2024-23922
Published: 2024-09-23
Description: Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of software update packages. An attacker can leverage this vulnerability to execute code in the context of the device.

Was ZDI-CAN-22939
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156; https://www.zerodayinitiative.com/advisories/ZDI-24-874/
CVE: CVE-2024-23933
Published: 2024-09-23
Description: Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of 	Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the Apple CarPlay protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

Was ZDI-CAN-23238
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121
References: https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156; https://www.zerodayinitiative.com/advisories/ZDI-24-877/
CVE: CVE-2024-23934
Published: 2024-09-23
Description: Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of WMV/ASF files. A crafted Extended Content Description Object in a WMV media file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

. Was ZDI-CAN-22994.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156; https://www.zerodayinitiative.com/advisories/ZDI-24-875/
CVE: CVE-2024-23972
Published: 2024-09-23
Description: Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the USB host driver. A crafted USB configuration descriptor can trigger an overflow of a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

Was ZDI-CAN-23185
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156; https://www.zerodayinitiative.com/advisories/ZDI-24-876/
CVE: CVE-2024-34331
Published: 2024-09-23
Description: A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, because Parallels Service is setuid root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://kb.parallels.com/129860; https://khronokernel.com/macos/2024/05/30/CVE-2024-34331.html
CVE: CVE-2024-41228
Published: 2024-09-23
Description: A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary files.
CVSS Score: 7.6 (HIGH)
CWE: CWE-269
References: https://gist.github.com/cafan/68ed2d065a4b9c1c37c70a18077ad27b
CVE: CVE-2024-46985
Published: 2024-09-23
Description: DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/dataease/dataease/security/advisories/GHSA-4m9p-7xg6-f4mm
CVE: CVE-2024-46997
Published: 2024-09-23
Description: DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/dataease/dataease/security/advisories/GHSA-h7mj-m72h-qm8w
CVE: CVE-2024-47066
Published: 2024-09-23
Description: Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to internal resources like a private network or loopback address. Version 1.19.13 contains an improved fix for the issue.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-918
References: https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts; https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf; https://github.com/lobehub/lobe-chat/security/advisories/GHSA-3fc8-2r3f-8wrg
CVE: CVE-2024-47068
Published: 2024-09-23
Description: Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4  contain a patch for the vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162; https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185; https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4
CVE: CVE-2024-47069
Published: 2024-09-23
Description: Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the `block/locale` endpoint does not properly sanitize the user-controlled `locale` input before including it in the backend's HTTP response, thereby causing reflected cross-site scripting. Versions 1.16.3 and 2.1.3 contain a patch for the vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html; https://github.com/oveleon/contao-cookiebar/blob/2.x/src/Controller/CookiebarController.php; https://github.com/oveleon/contao-cookiebar/commit/1d57470be5878f66d5e1e23f624dd387564b9b8d
CVE: CVE-2024-40441
Published: 2024-09-23
Description: An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-918
References: https://github.com/doccano/auto-labeling-pipeline/releases/tag/v0.1.23; https://github.com/doccano/doccano/releases/tag/v1.8.4; https://github.com/gian2dchris/CVEs/tree/main/CVE-2024-40441
CVE: CVE-2024-40442
Published: 2024-09-23
Description: An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via a crafted REST Request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/doccano/auto-labeling-pipeline/releases/tag/v0.1.23; https://github.com/doccano/doccano/releases/tag/v1.8.4; https://github.com/gian2dchris/CVEs/tree/main/CVE-2024-40442
CVE: CVE-2024-9014
Published: 2024-09-23
Description: pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-522
References: https://github.com/pgadmin-org/pgadmin4/issues/7945
CVE: CVE-2023-46948
Published: 2024-09-23
Description: A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitrary JavaScript code via the skin parameter in the about.jsp and genrequest.jsp components.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://temenos.com; https://github.com/AzraelsBlade/CVE-2023-46948
CVE: CVE-2024-0001
Published: 2024-09-23
Description: A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1188, CWE-1188
References: https://purestorage.com/security
CVE: CVE-2024-0002
Published: 2024-09-23
Description: A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287
References: https://purestorage.com/security
CVE: CVE-2024-0003
Published: 2024-09-23
Description: A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269
References: https://purestorage.com/security
CVE: CVE-2024-0004
Published: 2024-09-23
Description: A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://purestorage.com/security
CVE: CVE-2024-0005
Published: 2024-09-23
Description: A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://purestorage.com/security