deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-42367
Published: 2024-08-12
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default).  It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-61
References: https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_fileresponse.py#L177; https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_urldispatcher.py#L674; https://github.com/aio-libs/aiohttp/commit/ce2e[PII_REDACTED]589b10759a20783fb03b98339f
CVE: CVE-2024-42370
Published: 2024-08-12
Description: Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.
CVSS Score: 8.3 (HIGH)
CWE: CWE-78
References: https://github.com/litestar-org/litestar/actions/runs/[PII_REDACTED]/job/[PII_REDACTED]8#step:1:17; https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml; https://github.com/litestar-org/litestar/commit/84d351e96aaa2a1338006d6e7221eded161f517b
CVE: CVE-2024-42467
Published: 2024-08-12
Description: openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, the proxy endpoint of openHAB's CometVisu add-on can be accessed without authentication. This proxy-feature can be exploited as Server-Side Request Forgery (SSRF) to induce GET HTTP requests to internal-only servers, in case openHAB is exposed in a non-private network. Furthermore, this proxy-feature can also be exploited as a Cross-Site Scripting (XSS) vulnerability, as an attacker is able to re-route a request to their server and return a page with malicious JavaScript code. Since the browser receives this data directly from the openHAB CometVisu UI, this JavaScript code will be executed with the origin of the CometVisu UI. This allows an attacker to exploit call endpoints on an openHAB server even if the openHAB server is located in a private network. (e.g. by sending an openHAB admin a link that proxies malicious JavaScript.) This issue may lead up to Remote Code Execution (RCE) when chained with other vulnerabilities. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/backend/rest/ProxyResource.java#L83; https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2; https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3
CVE: CVE-2024-42468
Published: 2024-08-12
Description: openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75; https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2; https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w
CVE: CVE-2024-42469
Published: 2024-08-12
Description: openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing file is susceptible to path traversal. This makes it possible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script that is executed at a later time, this vulnerability can allow remote code execution by an attacker. Users should upgrade to version 4.2.1 to receive a patch.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2; https://github.com/openhab/openhab-webui/security/advisories/GHSA-f729-58x4-gqgf
CVE: CVE-2024-42470
Published: 2024-08-12
Description: openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2; https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rj
CVE: CVE-2024-42473
Published: 2024-08-12
Description: OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `but not` and `from` expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As of time of publication, a patch is not available but OpenFGA's maintainers are planning a patch for inclusion in a future release.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/openfga/openfga/security/advisories/GHSA-3f6g-m4hr-59h8
CVE: CVE-2024-43167
Published: 2024-08-12
Description: DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly.
CVSS Score: 2.8 (LOW)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2024-43167; https://bugzilla.redhat.com/show_bug.cgi?id=2303456; https://github.com/NLnetLabs/unbound/issues/1072
CVE: CVE-2024-43168
Published: 2024-08-12
Description: DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-122
References: https://access.redhat.com/security/cve/CVE-2024-43168; https://bugzilla.redhat.com/show_bug.cgi?id=2303462; https://github.com/NLnetLabs/unbound/issues/1039
CVE: CVE-2024-4350
Published: 2024-08-12
Description: Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. A rogue administrator could inject malicious code into fields due to insufficient input validation. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 5.1 with vector   https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Thanks, m3dium for reporting. (CNA updated this risk rank on 17 Jan 2025 by lowering the AC based on CVSS 4.0 documentation that access privileges should not be considered for AC)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/933-release-notes?pk_vid=e367a434ef[PII_REDACTED]060415d52041; https://documentation.concretecms.org/developers/introduction/version-history/8518-release-notes?pk_vid=e367a434ef[PII_REDACTED]055758d52041; https://github.com/concretecms/concretecms/commit/c08d9671cec4e7afdabb547339c4bc0bed8eab06
CVE: CVE-2024-4359
Published: 2024-08-12
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 5.7.2 via the SVG widget and a lack of sufficient file validation in the render_svg function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-98, CWE-829
References: https://plugins.trac.wordpress.org/changeset/3133714/bdthemes-element-pack-lite/trunk/modules/svg-image/widgets/svg-image.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a55cfeb3-7632-4a88-ac71-8e119b060721?source=cve
CVE: CVE-2024-4360
Published: 2024-08-12
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'title_tag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/custom-gallery/skins/skin-abetis.php#L164; https://plugins.trac.wordpress.org/changeset/3140736/bdthemes-element-pack-lite/trunk/modules/custom-gallery/skins/skin-abetis.php; https://plugins.trac.wordpress.org/changeset/3145280/bdthemes-element-pack-lite/trunk/modules/custom-gallery/skins/skin-abetis.php
CVE: CVE-2024-5445
Published: 2024-08-12
Description: Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position.
CVSS Score: 3.8 (LOW)
CWE: CWE-295
References: https://me.n-able.com/s/article/How-to-check-Ecosystem-Agent-Version-in-N-sight; https://me.n-able.com/s/article/How-to-check-Ecosystem-Agent-version-in-N-central; https://me.n-able.com/s/security-advisory/aArVy0000000BhpKAE/cve20245445-ecosystem-agent-insufficient-transport-layer-security
CVE: CVE-2024-5487
Published: 2024-08-12
Description: Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-5487.html
CVE: CVE-2024-5527
Published: 2024-08-12
Description: Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-5527.html
CVE: CVE-2024-5651
Published: 2024-08-12
Description: A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. A low-privilege user, for example, a user with developer access, can create a specially crafted FenceAgentsRemediation for a fence agent supporting  --ssh-path/--telnet-path arguments to execute arbitrary commands on the operator's pod. This RCE leads to a privilege escalation, first as the service account running the operator, then to another service account with cluster-admin privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://access.redhat.com/errata/RHSA-2024:5453; https://access.redhat.com/security/cve/CVE-2024-5651; https://bugzilla.redhat.com/show_bug.cgi?id=2290540
CVE: CVE-2024-5800
Published: 2024-08-12
Description: Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack of B&R Automation Runtime versions before 6.0.2, allowing a network attacker to decrypt the SSL/TLS communication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://www.br-automation.com/fileadmin/SA24P011-d8aaf02f.pdf
CVE: CVE-2024-5801
Published: 2024-08-12
Description: Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based packets through the host, potentially by-passing firewall, router, or NAC filtering.
CWE: CWE-653, CWE-1188
References: https://www.br-automation.com/fileadmin/SA24P011-d8aaf02f.pdf
CVE: CVE-2024-6133
Published: 2024-08-12
Description: The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fd613e1e-557c-4383-a3e9-4c14bc0be0c5/
CVE: CVE-2024-6134
Published: 2024-08-12
Description: The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/34d61f7e-90eb-4a64-a8a7-18f2d6518118/
CVE: CVE-2024-6136
Published: 2024-08-12
Description: The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/7d85cfe4-4878-4530-ba78-7cfe33f3a8d5/
CVE: CVE-2024-6158
Published: 2024-08-12
Description: The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8adb219f-f0a6-4e87-8626-db26e300c220/
CVE: CVE-2024-6562
Published: 2024-08-12
Description: The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This is due display_errors being set to true . This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/trunk/lib/apai-io/exeu/apai-io/samples/Search/SimpleSearch.php?rev=1502240; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3148552%40affiliate-toolkit-starter&new=3148552%40affiliate-toolkit-starter&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f810cc65-5a19-4ad7-a6b6-41a9b4f30f4c?source=cve
CVE: CVE-2024-6640
Published: 2024-08-12
Description: In ICMPv6 Neighbor Discovery (ND), the ID is always 0.  When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after a Neighbor Solicitation (NS) can trigger an Echo Reply.  The packet has to come from the same host as the NS and have a zero as identifier to match the state created by the Neighbor Discovery and allow replies to be generated.

ICMPv6 packets with identifier value of zero bypass firewall rules written on the assumption that the incoming packets are going to create a state in the state table.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-276
References: https://security.freebsd.org/advisories/FreeBSD-SA-24:05.pf.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-6684
Published: 2024-08-12
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass.This issue affects inohom Nova Panel N7: through 1.9.9.6. NOTE: The vendor was contacted and it was learned that the product is not supported.
CWE: CWE-288
References: https://www.usom.gov.tr/bildirim/tr-24-1194
CVE: CVE-2024-6691
Published: 2024-08-12
Description: The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3131805/easy-digital-downloads/tags/3.3.3/src/Admin/Settings/Sanitize.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0459a6bd-334d-43b7-b[PII_REDACTED]64a53?source=cve
CVE: CVE-2024-6692
Published: 2024-08-12
Description: The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Agreement Text value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 3.3 (LOW)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3131805/easy-digital-downloads/tags/3.3.3/includes/checkout/template.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e54d5ab2-40ba-4ad8-9a77-44aba37f0283?source=cve
CVE: CVE-2024-6758
Published: 2024-08-12
Description: Improper Privilege Management in Sprecher Automation SPRECON-E below version 8.71j allows a remote attacker with low privileges to save unauthorized protection assignments.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266
References: https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2407171_de.pdf
CVE: CVE-2024-6759
Published: 2024-08-12
Description: When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/".  This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.

The lack of validation described above gives rise to a confused deputy problem.  For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-6760
Published: 2024-08-12
Description: A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs.

The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://security.freebsd.org/advisories/FreeBSD-SA-24:06.ktrace.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-7006
Published: 2024-08-12
Description: A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2024:6360; https://access.redhat.com/errata/RHSA-2024:8833; https://access.redhat.com/errata/RHSA-2024:8914