deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7127
Published: 2024-07-30
Description: Improper Neutralization of Input During Web Page Generation vulnerability in Stackposts Social Marketing Tool allows Cross-site Scripting (XSS) attack. By submitting the payload in the username during registration, it can be executed later in the application panel. This could lead to the unauthorised acquisition of information (e.g. cookies from a logged-in user). After multiple attempts to contact the vendor we did not receive any answer. Our team has confirmed the existence of this vulnerability. We suppose this issue affects Social Marketing Tool in all versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert.pl/en/posts/2024/07/CVE-2024-7127/; https://cert.pl/posts/2024/07/CVE-2024-7127/; https://codecanyon.net/comments/30802802
CVE: CVE-2024-6699
Published: 2024-07-30
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection.This issue affects Mikafon MA7: from v3.0 before v3.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1105; https://www.usom.gov.tr/bildirim/tr-24-1105
CVE: CVE-2024-23091
Published: 2024-07-30
Description: Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916, CWE-916
References: https://medium.com/%40cnetsec/security-advisory-cve-2024-23091-weak-password-hashing-using-md5-f18a6fe3a473; https://www.hoteldruid.com/en/download.html; https://medium.com/%40cnetsec/security-advisory-cve-2024-23091-weak-password-hashing-using-md5-f18a6fe3a473
CVE: CVE-2024-38909
Published: 2024-07-30
Description: Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://elfinder.com; https://github.com/B0D0B0P0T/CVE/blob/main/CVE-2024-38909; http://elfinder.com
CVE: CVE-2024-37165
Published: 2024-07-30
Description: Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd; https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2; https://github.com/discourse/discourse/security/advisories/GHSA-cx83-5p6x-9qh9
CVE: CVE-2024-37299
Published: 2024-07-30
Description: Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/discourse/discourse/commit/188cb58daa833839c54c266ce22db150a3f3a210; https://github.com/discourse/discourse/commit/76f06f6b1491db6bd09a4017d2c5591431b3b16e; https://github.com/discourse/discourse/security/advisories/GHSA-4j6h-9pjp-5476
CVE: CVE-2024-39320
Published: 2024-07-30
Description: Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74, CWE-1021, CWE-1021
References: https://github.com/discourse/discourse/commit/188cb58daa833839c54c266ce22db150a3f3a210; https://github.com/discourse/discourse/commit/76f06f6b1491db6bd09a4017d2c5591431b3b16e; https://github.com/discourse/discourse/security/advisories/GHSA-4p82-xh38-gq4p
CVE: CVE-2024-41109
Published: 2024-07-30
Description: Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.  This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40; https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0; https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2
CVE: CVE-2024-4188
Published: 2024-07-30
Description: Unprotected Transport of Credentials vulnerability in OpenText™ Documentum™ Server could allow Credential Stuffing.This issue affects Documentum™ Server: from 16.7 through 23.4.
CWE: CWE-523
References: https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0815868; https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0815868
CVE: CVE-2024-41802
Published: 2024-07-30
Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the APIs for importing JSON and importing a Layout containing DataSet data.
Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/xibosignage/xibo-cms/commit/b7a5899338cd841a39702e3fcaff76aa0ffe4075; https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-x4qm-vvhp-g7c2; https://xibosignage.com/blog/security-advisory-2024-07
CVE: CVE-2024-41803
Published: 2024-07-30
Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for viewing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patch; https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-hpc5-mxfq-44hv; https://xibosignage.com/blog/security-advisory-2024-07
CVE: CVE-2024-41804
Published: 2024-07-30
Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `formula` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patch; https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-4pp3-4mw7-qfwr; https://xibosignage.com/blog/security-advisory-2024-07
CVE: CVE-2022-33167
Published: 2024-07-30
Description: IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.  IBM X-Force ID:  228587.
CVSS Score: 3.7 (LOW)
CWE: CWE-1004, CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228587; https://www.ibm.com/support/pages/node/7161469; https://exchange.xforce.ibmcloud.com/vulnerabilities/228587
CVE: CVE-2023-26288
Published: 2024-07-30
Description: IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system.  IBM X-Force ID:  248477.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248477; https://www.ibm.com/support/pages/node/7161538; https://exchange.xforce.ibmcloud.com/vulnerabilities/248477
CVE: CVE-2023-26289
Published: 2024-07-30
Description: IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.  IBM X-Force ID:  248478.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-644, CWE-116
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248478; https://www.ibm.com/support/pages/node/7161537; https://exchange.xforce.ibmcloud.com/vulnerabilities/248478
CVE: CVE-2023-38001
Published: 2024-07-30
Description: IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  260206.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260206; https://www.ibm.com/support/pages/node/7161538; https://exchange.xforce.ibmcloud.com/vulnerabilities/260206
CVE: CVE-2024-41915
Published: 2024-07-30
Description: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04675en_us&docLocale=en_US; https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04675en_us&docLocale=en_US
CVE: CVE-2024-41916
Published: 2024-07-30
Description: A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
CVSS Score: 6.8 (MEDIUM)
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04675en_us&docLocale=en_US; https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04675en_us&docLocale=en_US
CVE: CVE-2024-41944
Published: 2024-07-30
Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `sortBy` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/xibosignage/xibo-cms/commit/c60cfd8727da77b9db10297148eadd697ebec353.patch; https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6q4-h869-gm3r; https://xibosignage.com/blog/security-advisory-2024-07
CVE: CVE-2024-5486
Published: 2024-07-30
Description: A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager
CVSS Score: 5.8 (MEDIUM)
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04675en_us&docLocale=en_US; https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04675en_us&docLocale=en_US
CVE: CVE-2024-7208
Published: 2024-07-30
Description: A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided by DMARC (or SPF or DKIM) policies.
CVSS Score: 6.5 (MEDIUM)
References: https://kb.cert.org/vuls/id/244112; https://kb.cert.org/vuls/id/244112; https://www.kb.cert.org/vuls/id/244112
CVE: CVE-2024-7209
Published: 2024-07-30
Description: A vulnerability exists in the use of shared SPF records in multi-tenant hosting providers, allowing attackers to use network authorization to be abused to spoof the email identify of the sender.
CVSS Score: 6.5 (MEDIUM)
References: https://kb.cert.org/vuls/id/244112; https://www.kb.cert.org/vuls/id/244112; https://kb.cert.org/vuls/id/244112
CVE: CVE-2024-7297
Published: 2024-07-30
Description: Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-913
References: https://www.tenable.com/security/research/tra-2024-26; https://www.tenable.com/security/research/tra-2024-26
CVE: CVE-2024-41304
Published: 2024-07-30
Description: An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://github.com/patrickdeanramos/WonderCMS-version-3.4.3-SVG-Stored-Cross-Site-Scripting; https://github.com/patrickdeanramos/WonderCMS-version-3.4.3-SVG-Stored-Cross-Site-Scripting
CVE: CVE-2024-41305
Published: 2024-07-30
Description: A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-918, CWE-352
References: https://github.com/patrickdeanramos/WonderCMS-version-3.4.3-is-vulnerable-to-Server-Side-Request-Forgery; https://github.com/patrickdeanramos/WonderCMS-version-3.4.3-is-vulnerable-to-Server-Side-Request-Forgery
CVE: CVE-2024-41943
Published: 2024-07-30
Description: I, Librarian is an open-source version of a PDF managing SaaS. PDF notes are displayed on the Item Summary page without any form of validation or sanitation. An attacker can exploit this vulnerability by inserting a payload in the PDF notes that contains malicious code or script. This code will then be executed when the page is loaded in the browser. The vulnerability was fixed in version 5.11.1.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/mkucej/i-librarian-free/commit/b4570103d21fc4fdd2483689aafc6028d9f6a76d; https://github.com/mkucej/i-librarian-free/security/advisories/GHSA-h5hx-fm7f-2xmx; https://github.com/mkucej/i-librarian-free/commit/b4570103d21fc4fdd2483689aafc6028d9f6a76d
CVE: CVE-2024-3930
Published: 2024-07-30
Description: In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://portal.perforce.com/s/detail/a91PA000001SUKLYA4; https://portal.perforce.com/s/detail/a91PA000001SUKLYA4
CVE: CVE-2024-41437
Published: 2024-07-30
Description: A heap buffer overflow in the function cp_unfilter() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-122
References: https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/poc/sample6.png; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/vulDescription.assets/image[PII_REDACTED]3857985.png; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/vulDescription.md
CVE: CVE-2024-41438
Published: 2024-07-30
Description: A heap buffer overflow in the function cp_stored() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-122
References: https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.assets/image[PII_REDACTED]4723547.png; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.assets/image[PII_REDACTED]4848743.png
CVE: CVE-2024-41439
Published: 2024-07-30
Description: A heap buffer overflow in the function cp_block() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w98-cp_block-5c0-cute_png-642c5; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w98-cp_block-5c0-cute_png-642c5/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w98-cp_block-5c0-cute_png-642c5/poc/sample13.png
CVE: CVE-2024-41440
Published: 2024-07-30
Description: A heap buffer overflow in the function png_quantize() of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-122
References: https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w1-png_quantize-cli-220c32; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w1-png_quantize-cli-220c32/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w1-png_quantize-cli-220c32/poc/sample18.png
CVE: CVE-2024-41443
Published: 2024-07-30
Description: A stack overflow in the function cp_dynamic() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/stkof-w133-cp_dynamic-cute_png-603; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/stkof-w133-cp_dynamic-cute_png-603/poc; https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/stkof-w133-cp_dynamic-cute_png-603/poc/sample16.png
CVE: CVE-2024-5249
Published: 2024-07-30
Description: In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-294, CWE-294
References: https://portal.perforce.com/s/detail/a91PA000001SUH7YAO; https://portal.perforce.com/s/detail/a91PA000001SUH7YAO
CVE: CVE-2024-5250
Published: 2024-07-30
Description: In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations
CVSS Score: 3.5 (LOW)
CWE: CWE-209, CWE-209
References: https://portal.perforce.com/s/detail/a91PA000001SUIjYAO; https://portal.perforce.com/s/detail/a91PA000001SUIjYAO
CVE: CVE-2023-33976
Published: 2024-07-30
Description: TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/tensorflow/tensorflow/commit/6fa05df43b00038b048f4f0e51ef522da6532fec; https://github.com/tensorflow/tensorflow/commit/915884fdf5df34aaedd00fc6ace33a2cfdefa586; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gjh7-xx4r-x345
CVE: CVE-2024-36572
Published: 2024-07-30
Description: Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://gist.github.com/mestrtee/1771ab4fba733ca898b6e2463dc6ed19; https://github.com/allpro/form-manager/issues/1; https://gist.github.com/mestrtee/1771ab4fba733ca898b6e2463dc6ed19
CVE: CVE-2024-38984
Published: 2024-07-30
Description: Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://gist.github.com/mestrtee/97a9a7d73fc8b38fcf01322239dd5fb1; https://gist.github.com/mestrtee/97a9a7d73fc8b38fcf01322239dd5fb1
CVE: CVE-2024-38986
Published: 2024-07-30
Description: Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://gist.github.com/mestrtee/b20c3aee8bea16e[PII_REDACTED]da6e4cb; https://gist.github.com/mestrtee/b20c3aee8bea16e[PII_REDACTED]da6e4cb
CVE: CVE-2024-39010
Published: 2024-07-30
Description: chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://gist.github.com/mestrtee/af7a746df91ab5e944bd7a186816c262; https://gist.github.com/mestrtee/af7a746df91ab5e944bd7a186816c262
CVE: CVE-2024-39011
Published: 2024-07-30
Description: Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://gist.github.com/mestrtee/693ef1c8b0a5ff1ae19f253381711f3e; https://gist.github.com/mestrtee/693ef1c8b0a5ff1ae19f253381711f3e
CVE: CVE-2024-39012
Published: 2024-07-30
Description: ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://gist.github.com/mestrtee/acfbd724a4b73bfb5d030575b653453c; https://gist.github.com/mestrtee/acfbd724a4b73bfb5d030575b653453c
CVE: CVE-2024-41610
Published: 2024-07-30
Description: D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/Nop3z/CVE/blob/main/dlink/dir-820/Dlink-820LW-hardcoded-vulnerability.md; https://www.dlink.com/en/security-bulletin/; https://github.com/Nop3z/CVE/blob/main/dlink/dir-820/Dlink-820LW-hardcoded-vulnerability.md
CVE: CVE-2024-41611
Published: 2024-07-30
Description: In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/Nop3z/CVE/blob/main/dlink/dir-820/Dlink-860L-hardcoded-vulnerability.md; https://www.dlink.com/en/security-bulletin/; https://github.com/Nop3z/CVE/blob/main/dlink/dir-820/Dlink-860L-hardcoded-vulnerability.md