deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-30082
Published: 2024-06-11
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30082; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30082
CVE: CVE-2024-30083
Published: 2024-06-11
Description: Windows Standards-Based Storage Management Service Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30083; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30083
CVE: CVE-2024-30084
Published: 2024-06-11
Description: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30084; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30084
CVE: CVE-2024-30085
Published: 2024-06-11
Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30085; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30085
CVE: CVE-2024-30086
Published: 2024-06-11
Description: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30086; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30086
CVE: CVE-2024-30087
Published: 2024-06-11
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30087; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30087
CVE: CVE-2024-30088
Published: 2024-06-11
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-30088
CVE: CVE-2024-30089
Published: 2024-06-11
Description: Microsoft Streaming Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30089; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30089
CVE: CVE-2024-30090
Published: 2024-06-11
Description: Microsoft Streaming Service Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-822, CWE-119
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30090; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30090
CVE: CVE-2024-30091
Published: 2024-06-11
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30091; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30091
CVE: CVE-2024-30093
Published: 2024-06-11
Description: Windows Storage Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-59, CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30093; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30093
CVE: CVE-2024-30094
Published: 2024-06-11
Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30094; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30094
CVE: CVE-2024-30095
Published: 2024-06-11
Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30095; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30095
CVE: CVE-2024-30096
Published: 2024-06-11
Description: Windows Cryptographic Services Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30096; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30096
CVE: CVE-2024-30097
Published: 2024-06-11
Description: Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30097; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30097
CVE: CVE-2024-30099
Published: 2024-06-11
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30099; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30099
CVE: CVE-2024-30100
Published: 2024-06-11
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30100; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30100
CVE: CVE-2024-30101
Published: 2024-06-11
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30101; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30101
CVE: CVE-2024-30102
Published: 2024-06-11
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-416, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30102; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30102
CVE: CVE-2024-30103
Published: 2024-06-11
Description: Microsoft Outlook Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-184
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30103; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30103
CVE: CVE-2024-30104
Published: 2024-06-11
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30104; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30104
CVE: CVE-2024-32143
Published: 2024-06-11
Description: Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-4-1-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-4-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32146
Published: 2024-06-11
Description: Missing Authorization vulnerability in Aspose.Cloud Marketplace Aspose.Words Exporter.This issue affects Aspose.Words Exporter: from n/a through 6.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/aspose-doc-exporter/wordpress-aspose-words-import-and-export-word-documents-plugin-6-3-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/aspose-doc-exporter/wordpress-aspose-words-import-and-export-word-documents-plugin-6-3-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34758
Published: 2024-06-11
Description: Missing Authorization vulnerability in Wpmet WP Fundraising Donation and Crowdfunding Platform.This issue affects WP Fundraising Donation and Crowdfunding Platform: from n/a through 1.6.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-fundraising-donation/wordpress-fundengine-donation-and-crowdfunding-platform-plugin-1-6-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-fundraising-donation/wordpress-fundengine-donation-and-crowdfunding-platform-plugin-1-6-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34763
Published: 2024-06-11
Description: Missing Authorization vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through <= 1.01.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-product-reviews-shortcode/vulnerability/wordpress-builder-for-woocommerce-reviews-shortcodes-reviewshort-plugin-1-01-5-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-product-reviews-shortcode/wordpress-builder-for-woocommerce-reviews-shortcodes-reviewshort-plugin-1-01-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34768
Published: 2024-06-11
Description: Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/fastly/wordpress-fastly-plugin-1-2-25-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fastly/wordpress-fastly-plugin-1-2-25-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34799
Published: 2024-06-11
Description: Missing Authorization vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.82.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/bookingpress-appointment-booking/wordpress-bookingpress-plugin-1-0-82-appointment-duration-manipulation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bookingpress-appointment-booking/wordpress-bookingpress-plugin-1-0-82-appointment-duration-manipulation-vulnerability?_s_id=cve
CVE: CVE-2024-34804
Published: 2024-06-11
Description: Missing Authorization vulnerability in Tagembed.This issue affects Tagembed: from n/a through 5.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/tagembed-widget/wordpress-tagembed-plugin-5-5-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tagembed-widget/wordpress-tagembed-plugin-5-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34815
Published: 2024-06-11
Description: Missing Authorization vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/import-users-from-csv-with-meta/vulnerability/wordpress-import-and-export-users-and-customers-plugin-1-26-5-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/import-users-from-csv-with-meta/wordpress-import-and-export-users-and-customers-plugin-1-26-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35248
Published: 2024-06-11
Description: Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-1390, CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35248; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35248
CVE: CVE-2024-35249
Published: 2024-06-11
Description: Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35249; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35249
CVE: CVE-2024-35250
Published: 2024-06-11
Description: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-35250
CVE: CVE-2024-35252
Published: 2024-06-11
Description: Azure Storage Movement Client Library Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-1104
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35252; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35252
CVE: CVE-2024-35253
Published: 2024-06-11
Description: Microsoft Azure File Sync Elevation of Privilege Vulnerability
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35253; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35253
CVE: CVE-2024-35254
Published: 2024-06-11
Description: Azure Monitor Agent Elevation of Privilege Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-59, CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35254; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35254
CVE: CVE-2024-35255
Published: 2024-06-11
Description: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255
CVE: CVE-2024-35263
Published: 2024-06-11
Description: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35263; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35263
CVE: CVE-2024-35265
Published: 2024-06-11
Description: Windows Perception Service Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35265; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35265
CVE: CVE-2024-37293
Published: 2024-06-11
Description: The AWS Deployment Framework (ADF) is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations while taking advantage of services such as AWS CodePipeline, AWS CodeBuild, and AWS CodeCommit to alleviate the heavy lifting and management compared to a traditional CI/CD setup. ADF contains a bootstrap process that is responsible to deploy ADF's bootstrap stacks to facilitate multi-account cross-region deployments. The ADF bootstrap process relies on elevated privileges to perform this task. Two versions of the bootstrap process exist; a code-change driven pipeline using AWS CodeBuild and an event-driven state machine using AWS Lambda. If an actor has permissions to change the behavior of the CodeBuild project or the Lambda function, they would be able to escalate their privileges.

Prior to version 4.0.0, the bootstrap CodeBuild role provides access to the `sts:AssumeRole` operation without further restrictions. Therefore, it is able to assume into any AWS Account in the AWS Organization with the elevated privileges provided by the cross-account access role. By default, this role is not restricted when it is created by AWS Organizations, providing Administrator level access to the AWS resources in the AWS Account. The patches for this issue are included in `aws-deployment-framework` version 4.0.0.

As a temporary mitigation, add a permissions boundary to the roles created by ADF in the management account. The permissions boundary should deny all IAM and STS actions. This permissions boundary should be in place until you upgrade ADF or bootstrap a new account. While the permissions boundary is in place, the account management and bootstrapping of accounts are unable to create, update, or assume into roles. This mitigates the privilege escalation risk, but also disables ADF's ability to create, manage, and bootstrap accounts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-266
References: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html; https://github.com/awslabs/aws-deployment-framework/pull/732; https://github.com/awslabs/aws-deployment-framework/releases/tag/v4.0.0
CVE: CVE-2024-37325
Published: 2024-06-11
Description: Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37325; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37325
CVE: CVE-2024-36821
Published: 2024-06-11
Description: Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-732, CWE-379
References: https://downloads.linksys.com/support/assets/releasenotes/WHW01_VLP01_1.1.13.202617_Customer_Release_Notes.txt; https://github.com/IvanGlinkin/CVE-2024-36821; https://downloads.linksys.com/support/assets/releasenotes/WHW01_VLP01_1.1.13.202617_Customer_Release_Notes.txt
CVE: CVE-2024-4190
Published: 2024-06-11
Description: Stored Cross-Site Scripting (XSS) vulnerabilities have been identified in OpenText ArcSight Logger. The vulnerabilities could be remotely exploited.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://portal.microfocus.com/s/article/KM000030655; https://portal.microfocus.com/s/article/KM000030655
CVE: CVE-2024-5851
Published: 2024-06-11
Description: A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=feature_schedule&op=list of the component SMS Schedule Handler. The manipulation of the argument name/message leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.8 is able to address this issue. The name of the patch is 7a88920f6b536c6a91512e739bcb4e8adefeed2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-267912. NOTE: The code maintainer was contacted early about this disclosure and was eager to prepare a fix as quickly as possible.
CVSS Score: 3.5 (LOW)
CWE: CWE-80
References: https://github.com/playsms/playsms/commit/7a88920f6b536c6a91512e739bcb4e8adefeed2b; https://vuldb.com/?ctiid.267912; https://vuldb.com/?id.267912
CVE: CVE-2024-28020
Published: 2024-06-11
Description: A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application
and server management. If exploited a malicious high-privileged
user could use the passwords and login information through complex routines to extend access on the server and other services.
CVSS Score: 8.0 (HIGH)
CWE: CWE-286
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true
CVE: CVE-2024-28022
Published: 2024-06-11
Description: A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of
authentication attempts using different passwords, and eventually
gain access to other components in the same security realm using
the targeted account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true
CVE: CVE-2024-28024
Published: 2024-06-11
Description: A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is 
stored in cleartext within a resource that might be accessible to another control sphere.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true
CVE: CVE-2024-34405
Published: 2024-06-11
Description: Improper deep link validation in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to launch an arbitrary URL within the app.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html; https://www.mcafee.com/support/?page=shell&shell=article-view&articleId=000002403; https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html
CVE: CVE-2024-34406
Published: 2024-06-11
Description: Improper exception handling in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to cause a denial of service through the use of a malformed deep link.
CVSS Score: 5.3 (MEDIUM)
References: https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html; https://www.mcafee.com/support/?page=shell&shell=article-view&articleId=000002403; https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html
CVE: CVE-2024-35213
Published: 2024-06-11
Description: An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause a denial-of-service condition or execute code in the context of the image processing process.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-1287
References: https://support.blackberry.com/pkb/s/article/139914; https://support.blackberry.com/pkb/s/article/139914
CVE: CVE-2024-36702
Published: 2024-06-11
Description: libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder_encodeLength function at /asn1/ber_encoder.c.
CVSS Score: 7.4 (HIGH)
CWE: CWE-787, CWE-122
References: http://libiec61850.com; https://github.com/mz-automation/libiec61850; https://github.com/mz-automation/libiec61850/issues/505
CVE: CVE-2024-37301
Published: 2024-06-11
Description: Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1336
References: https://github.com/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074; https://github.com/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6; https://github.com/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074
CVE: CVE-2023-4727
Published: 2024-06-11
Description: A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.
CVSS Score: 7.5 (HIGH)
CWE: CWE-305
References: https://access.redhat.com/errata/RHSA-2024:4051; https://access.redhat.com/errata/RHSA-2024:4070; https://access.redhat.com/errata/RHSA-2024:4164