deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-38119
Published: 2024-11-22
Description: Possible Reflected Cross-Site Scripting (XSS) Vulnerability

in iManager has been discovered in
OpenText™ iManager 3.2.4.0000.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.netiq.com/documentation/imanager-32/imanager325_releasenotes/data/imanager325_releasenotes.html
CVE: CVE-2021-38134
Published: 2024-11-22
Description: Possible XSS in iManager URL for access Component has been discovered in
OpenText™ iManager 3.2.5.0000.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.netiq.com/documentation/imanager-32/imanager326_releasenotes/data/imanager326_releasenotes.html
CVE: CVE-2021-38135
Published: 2024-11-22
Description: Possible 
External Service Interaction attack

in iManager has been discovered in
OpenText™ iManager 3.2.6.0000.
CVSS Score: 8.6 (HIGH)
CWE: CWE-406, CWE-918
References: https://www.netiq.com/documentation/imanager-32/imanager326_releasenotes/data/imanager326_releasenotes.html
CVE: CVE-2022-26324
Published: 2024-11-22
Description: Possible XSS in iManager URL for access Component has been discovered in
OpenText™ iManager 3.2.6.0000.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch1_releasenotes/imanager326_patch1_releasenotes.pdf
CVE: CVE-2023-24466
Published: 2024-11-22
Description: Possible XML External Entity Injection


 in iManager GET parameter has been discovered in
OpenText™ iManager 3.2.6.0200.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch3_releasenotes/imanager326_patch3_releasenotes.pdf
CVE: CVE-2023-24467
Published: 2024-11-22
Description: Possible Command Injection


 in iManager GET parameter has been discovered in
OpenText™ iManager 3.2.6.0000.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78, CWE-77
References: https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch3_releasenotes/imanager326_patch3_releasenotes.pdf
CVE: CVE-2024-10863
Published: 2024-11-22
Description: : Insufficient Logging vulnerability in OpenText Secure Content Manager on Windows allows Audit Log Manipulation.This issue affects Secure Content Manager: from 10.1 before <24.4.



End-users can potentially exploit the vulnerability to exclude audit trails from being recorded on the client side.
CWE: CWE-778
References: https://portal.microfocus.com/s/article/KM000036389?
CVE: CVE-2024-32767
Published: 2024-11-22
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code.

We have already fixed the vulnerability in the following version:
Photo Station 6.4.3 ( 2024/07/12 ) and later
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-39
CVE: CVE-2024-32768
Published: 2024-11-22
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code.

We have already fixed the vulnerability in the following version:
Photo Station 6.4.3 ( 2024/07/12 ) and later
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-39
CVE: CVE-2024-32769
Published: 2024-11-22
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code.

We have already fixed the vulnerability in the following version:
Photo Station 6.4.3 ( 2024/07/12 ) and later
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-39
CVE: CVE-2024-32770
Published: 2024-11-22
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code.

We have already fixed the vulnerability in the following version:
Photo Station 6.4.3 ( 2024/07/12 ) and later
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-39
CVE: CVE-2024-37041
Published: 2024-11-22
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-120, CWE-122
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-37042
Published: 2024-11-22
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-37043
Published: 2024-11-22
Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read the contents of unexpected files and expose sensitive data.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-37044
Published: 2024-11-22
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-120, CWE-121
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-37045
Published: 2024-11-22
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-37046
Published: 2024-11-22
Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read the contents of unexpected files and expose sensitive data.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-37047
Published: 2024-11-22
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-121
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-37048
Published: 2024-11-22
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-37049
Published: 2024-11-22
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-121
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-37050
Published: 2024-11-22
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-121
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-38643
Published: 2024-11-22
Description: A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to gain access to and execute certain functions.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.7 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.qnap.com/en/security-advisory/qsa-24-36
CVE: CVE-2024-38644
Published: 2024-11-22
Description: An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to execute commands.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.7 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-36
CVE: CVE-2024-38645
Published: 2024-11-22
Description: A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to read application data.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.7 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://www.qnap.com/en/security-advisory/qsa-24-36
CVE: CVE-2024-38646
Published: 2024-11-22
Description: An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow local authenticated attackers who have gained administrator access to read or modify the resource.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.7 and later
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-732
References: https://www.qnap.com/en/security-advisory/qsa-24-36
CVE: CVE-2024-38647
Published: 2024-11-22
Description: An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version:
QNAP AI Core 3.4.1 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-540
References: https://www.qnap.com/en/security-advisory/qsa-24-40
CVE: CVE-2024-48860
Published: 2024-11-22
Description: An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands.

We have already fixed the vulnerability in the following version:
QuRouter 2.4.3.103 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-44
CVE: CVE-2024-48861
Published: 2024-11-22
Description: An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands.

We have already fixed the vulnerability in the following versions:
QuRouter 2.4.4.106 and later
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-78, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-44
CVE: CVE-2024-48862
Published: 2024-11-22
Description: A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files.

We have already fixed the vulnerability in the following versions:
QuLog Center 1.7.0.831 ( 2024/10/15 ) and later
QuLog Center 1.8.0.888 ( 2024/10/15 ) and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-59
References: https://www.qnap.com/en/security-advisory/qsa-24-46
CVE: CVE-2024-50395
Published: 2024-11-22
Description: An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow local network attackers to gain privilege.

We have already fixed the vulnerability in the following version:
Media Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://www.qnap.com/en/security-advisory/qsa-24-47
CVE: CVE-2024-50396
Published: 2024-11-22
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-50397
Published: 2024-11-22
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-50398
Published: 2024-11-22
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-50399
Published: 2024-11-22
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-50400
Published: 2024-11-22
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-50401
Published: 2024-11-22
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-24-43
CVE: CVE-2024-50965
Published: 2024-11-22
Description: Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbitrary code and escalate privileges via a crafted script
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://openjournaltheme.com/urgent-critical-vulnerabilities-in-3-3-0-18-upgrade-your-ojs-now/
CVE: CVE-2024-51072
Published: 2024-11-22
Description: An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service. NOTE: this is disputed by the Supplier because the findings came from a potentially unrealistic test environment (an isolated ECU part that was not in a vehicle), and because the ECUReset specification does not allow a manufacturer to require SecurityAccess and Authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/628b1550f0093f[PII_REDACTED]4b6a5e6ca6f2d04b/CVE/Denial%20of%20Service%20via%20ECU%20Reset%20Service%20For%20KIA%20SELTOS%20CVE-2024-51072.md; https://udsoncan.readthedocs.io/en/latest/udsoncan/services.html; https://www.iso.org/standard/77323.html
CVE: CVE-2024-51073
Published: 2024-11-22
Description: An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to control or disrupt CAN communication between the instrument cluster and CAN bus. NOTE: this is disputed by the Supplier because the findings came from a potentially unrealistic test environment (an isolated ECU part that was not in a vehicle), and because the observed behavior follows the UDS (Unified Diagnostic Services) specification.
CVSS Score: 6.7 (MEDIUM)
References: https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/3755e3f692dce5b1ab06de2d04a2433c907ab21c/CVE/Control%20CAN%20communication%20for%20KIA%20SELTOS%20Cluster%20CVE-2024-51073.md; https://udsoncan.readthedocs.io/en/latest/udsoncan/services.html; https://www.iso.org/standard/77323.html
CVE: CVE-2024-51074
Published: 2024-11-22
Description: Incorrect access control in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to arbitrarily change odometer readings in the vehicle by targeting the instrument cluster through the unsecured CAN network. NOTE: this is disputed by the supplier because the CAN bus is not externally exposed, and because the packets can only increase the odometer reading (which typically has no value to an adversary). Also, this is disputed by the Supplier because the findings came from a potentially unrealistic test environment (an isolated ECU part that was not in a vehicle), and because the observed behavior follows the UDS (Unified Diagnostic Services) specification.
CVSS Score: 6.7 (MEDIUM)
References: https://en.wikipedia.org/wiki/CAN_bus; https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/0446f6fe6299eb39310e996c73d5513e70d76353/CVE/Odometer%20Manipulation%28Increase%29%20for%20KIA%20SELTOS%20Cluster%20CVE-2024-51074.md
CVE: CVE-2024-52723
Published: 2024-11-22
Description: In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://x6000r.com; https://gist.github.com/M4rg4tr01d/e84f8ed8dc27960d7c56ad289f6fb0ff
CVE: CVE-2024-52793
Published: 2024-11-22
Description: The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, `http/file-server`'s `serveDir` with `showDirListing: true` option is vulnerable to cross-site scripting when the attacker is a user who can control file names in the source directory on systems with POSIX file names. Exploitation might also be possible on other systems but less trivial due to e.g. lack of file name support for `<>` in Windows. Version 1.0.11 fixes the issue.
CWE: CWE-79
References: https://github.com/denoland/std/blob/065296ca5a05a47f9741df8f99c32fae4f960070/http/file_server.ts#L507; https://github.com/denoland/std/blob/065296ca5a05a47f9741df8f99c32fae4f960070/http/file_server.ts#L532; https://github.com/denoland/std/security/advisories/GHSA-32fx-h446-h8pf
CVE: CVE-2024-52802
Published: 2024-11-22
Description: RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in `/sys/net/application_layer/dhcpv6/client.c`, has no minimum header length check for `dhcpv6_opt_t` after processing `dhcpv6_msg_t`. This omission could lead to an out-of-bound read, causing system inconsistency. Additionally, the same lack of a header length check is present in the function `_preparse_advertise`, which is called by `_parse_advertise` before handling the request. As of time of publication, no known patched version exists.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xgv3-pcq6-qmrg
CVE: CVE-2024-52804
Published: 2024-11-22
Description: Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/advisories/GHSA-7pwv-g7hj-39pr; https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e[PII_REDACTED]9b198291533; https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c