deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1186
Published: 2024-02-02
Description: A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the component Registration Key Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252676. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-404
References: https://fitoxs.com/vuldb/12-exploit-perl.txt; https://vuldb.com/?ctiid.252676; https://vuldb.com/?id.252676
CVE: CVE-2024-23635
Published: 2024-02-02
Description: AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patched in AntiSamy 1.7.5 and later. 
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nahsra/antisamy/security/advisories/GHSA-2mrq-w8pv-5pvq; https://github.com/nahsra/antisamy/security/advisories/GHSA-2mrq-w8pv-5pvq
CVE: CVE-2024-24560
Published: 2024-02-02
Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer to start at byte 0 (overlapping with the input buffer). When checking RETURNDATASIZE for dynamic types, the size is compared only to the minimum allowed size for that type, and not to the returned value's length. As a result, malformed return data can cause the contract to mistake data from the input buffer for returndata.  When the called contract returns invalid ABIv2 encoded data, the calling contract can read different invalid data (from the dirty buffer) than the called contract returned.
CVSS Score: 3.7 (LOW)
CWE: CWE-119
References: https://github.com/vyperlang/vyper/security/advisories/GHSA-gp3w-2v2m-p686; https://github.com/vyperlang/vyper/security/advisories/GHSA-gp3w-2v2m-p686
CVE: CVE-2024-1187
Published: 2024-02-02
Description: A vulnerability, which was classified as problematic, has been found in Munsoft Easy Outlook Express Recovery 2.0. This issue affects some unknown processing of the component Registration Key Handler. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-252677 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-404
References: https://fitoxs.com/vuldb/13-exploit-perl.txt; https://vuldb.com/?ctiid.252677; https://vuldb.com/?id.252677
CVE: CVE-2024-1188
Published: 2024-02-02
Description: A vulnerability, which was classified as problematic, was found in Rizone Soft Notepad3 1.0.2.350. Affected is an unknown function of the component Encryption Passphrase Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-252678 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-404
References: https://fitoxs.com/vuldb/14-exploit-perl.txt; https://vuldb.com/?ctiid.252678; https://vuldb.com/?id.252678
CVE: CVE-2023-37527
Published: 2024-02-02
Description: A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page. 

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209
CVE: CVE-2024-1189
Published: 2024-02-02
Description: A vulnerability has been found in AMPPS 2.7 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Encryption Passphrase Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-252679. NOTE: The vendor explains that AMPPS 4.0 is a complete overhaul and the code was re-written.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://fitoxs.com/vuldb/15-exploit-perl.txt; https://vuldb.com/?ctiid.252679; https://vuldb.com/?id.252679
CVE: CVE-2024-1190
Published: 2024-02-02
Description: A vulnerability was found in Global Scape CuteFTP 9.3.0.3 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument Host/Username/Password leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252680. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-404
References: https://fitoxs.com/vuldb/16-exploit-perl.txt; https://vuldb.com/?ctiid.252680; https://vuldb.com/?id.252680
CVE: CVE-2024-1193
Published: 2024-02-02
Description: A vulnerability was found in Navicat 12.0.29. It has been rated as problematic. This issue affects some unknown processing of the component MySQL Conecction Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252683. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-404
References: https://fitoxs.com/vuldb/24-exploit-perl.txt; https://vuldb.com/?ctiid.252683; https://vuldb.com/?id.252683
CVE: CVE-2024-1194
Published: 2024-02-02
Description: A vulnerability classified as problematic has been found in Armcode AlienIP 2.41. Affected is an unknown function of the component Locate Host Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252684. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-404
References: https://fitoxs.com/vuldb/25-exploit-perl.txt; https://vuldb.com/?ctiid.252684; https://vuldb.com/?id.252684
CVE: CVE-2024-23553
Published: 2024-02-02
Description: A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute. 

CVSS Score: 3.0 (LOW)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209
CVE: CVE-2024-1195
Published: 2024-02-02
Description: A vulnerability classified as critical was found in iTop VPN up to 4.0.0.1. Affected by this vulnerability is an unknown functionality in the library ITopVpnCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The identifier VDB-252685 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://vuldb.com/?ctiid.252685; https://vuldb.com/?id.252685; https://www.youtube.com/watch?v=JdQMINPVJd8
CVE: CVE-2024-1196
Published: 2024-02-02
Description: A vulnerability classified as problematic was found in SourceCodester Testimonial Page Manager 1.0. This vulnerability affects unknown code of the file add-testimonial.php of the component HTTP POST Request Handler. The manipulation of the argument name/description/testimony leads to cross site scripting. The attack can be initiated remotely. VDB-252694 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://vuldb.com/?ctiid.252694; https://vuldb.com/?id.252694; https://vuldb.com/?ctiid.252694
CVE: CVE-2024-1197
Published: 2024-02-02
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Testimonial Page Manager 1.0. This issue affects some unknown processing of the file delete-testimonial.php of the component HTTP GET Request Handler. The manipulation of the argument testimony leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-252695.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?ctiid.252695; https://vuldb.com/?id.252695; https://vuldb.com/?ctiid.252695
CVE: CVE-2024-1198
Published: 2024-02-03
Description: A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User.php of the component Phar Handler. The manipulation of the argument outimgurl leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252696.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://note.zhaoj.in/share/qFXZZfp1NLa3; https://vuldb.com/?ctiid.252696; https://vuldb.com/?id.252696
CVE: CVE-2024-1199
Published: 2024-02-03
Description: A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file \employee-tasks-php\attendance-info.php. The manipulation of the argument aten_id leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252697 was assigned to this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-404
References: https://docs.qq.com/doc/DYnhIWEdkZXViTXdD; https://vuldb.com/?ctiid.252697; https://vuldb.com/?id.252697
CVE: CVE-2023-30999
Published: 2024-02-03
Description: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow an attacker to cause a denial of service due to uncontrolled resource consumption.  IBM X-Force ID:  254651.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254651; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-31004
Published: 2024-02-03
Description: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote attacker to gain access to the underlying system using man in the middle techniques.  IBM X-Force ID:  254765.
CVSS Score: 8.3 (HIGH)
CWE: CWE-300
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254765; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-31005
Published: 2024-02-03
Description: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a local user to escalate their privileges due to an improper security configuration.  IBM X-Force ID:  254767.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254767; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-31006
Published: 2024-02-03
Description: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to a denial of service attacks on the DSC server.  IBM X-Force ID:  254776.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254776; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-32327
Published: 2024-02-03
Description: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  254783.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254783; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-32329
Published: 2024-02-03
Description: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a user to download files from an incorrect repository due to improper file validation.  IBM X-Force ID:  254972.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-345
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254972; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-43016
Published: 2024-02-03
Description: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account with an empty password.  IBM X-Force ID:  266154.
CVSS Score: 7.3 (HIGH)
CWE: CWE-258, CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266154; https://www.ibm.com/support/pages/node/7106586; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2024-1200
Published: 2024-02-03
Description: A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /template/1/default/. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252698 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/sweatxi/BugHub/blob/main/Nanchang%20Lanzhi%20Technology%20Co.pdf; https://vuldb.com/?ctiid.252698; https://vuldb.com/?id.252698
CVE: CVE-2023-37528
Published: 2024-02-03
Description: A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report. 

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209
CVE: CVE-2024-0895
Published: 2024-02-03
Description: The PDF Flipbook, 3D Flipbook – DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to, and including, 2.2.26 due to insufficient input sanitization and output escaping on user supplied data. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/inc/metaboxes.php#L483; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030441%403d-flipbook-dflip-lite&new=3030441%403d-flipbook-dflip-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/92e37b28-1a17-417a-b40f-cb4bbe6ec759?source=cve
CVE: CVE-2024-0909
Published: 2024-02-03
Description: The Anonymous Restricted Content plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.6.2. This is due to insufficient restrictions through the REST API on the posts/pages that protections are being place on. This makes it possible for unauthenticated attackers to access protected content.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030199%40anonymous-restricted-content&new=3030199%40anonymous-restricted-content&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030608%40anonymous-restricted-content&new=3030608%40anonymous-restricted-content&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f478ff7c-7193-4c59-a84f-c7cafff9b6c0?source=cve
CVE: CVE-2024-23550
Published: 2024-02-03
Description: HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent.

CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110334; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110334
CVE: CVE-2023-43183
Published: 2024-02-03
Description: Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows read-only users to arbitrarily change the password of an admin and hijack their account.
CVSS Score: 8.8 (HIGH)
References: http://seclists.org/fulldisclosure/2024/Jan/43; https://packetstormsecurity.com/files/176841/Reprise-License-Manager-15.1-Privilege-Escalation-File-Write.html; http://packetstormsecurity.com/files/176841/Reprise-License-Manager-15.1-Privilege-Escalation-File-Write.html
CVE: CVE-2023-44031
Published: 2024-02-03
Description: Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitive files in insecure locations via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2024/Jan/43; https://packetstormsecurity.com/files/176841/Reprise-License-Manager-15.1-Privilege-Escalation-File-Write.html; http://packetstormsecurity.com/files/176841/Reprise-License-Manager-15.1-Privilege-Escalation-File-Write.html
CVE: CVE-2023-49950
Published: 2024-02-03
Description: The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting (XSS) payload and send it to any system or device that sends logs to the SIEM. If an alert is created, the payload will execute upon the alert data being viewed with that template, which can lead to sensitive data disclosure.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/shrikeinfosec/cve-2023-49950/blob/main/cve-2023-49950.md; https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]437-Stored-XSS-Vulnerability-in-Alerts-via-Log-Injection; https://github.com/shrikeinfosec/cve-2023-49950/blob/main/cve-2023-49950.md
CVE: CVE-2024-1064
Published: 2024-02-03
Description: A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header
CVSS Score: 7.5 (HIGH)
CWE: CWE-644, CWE-116
References: https://gitlab.com/crafty-controller/crafty-4/-/issues/327; https://gitlab.com/crafty-controller/crafty-4/-/issues/327
CVE: CVE-2024-0853
Published: 2024-02-03
Description: curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to
the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://curl.se/docs/CVE-2024-0853.html; https://curl.se/docs/CVE-2024-0853.json; https://hackerone.com/reports/2298922
CVE: CVE-2024-1215
Published: 2024-02-03
Description: A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file fetch_data.php. The manipulation of the argument username/city leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252782 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/PrecursorYork/crud-without-refresh-reload-Reflected_XSS-POC/blob/main/README.md; https://vuldb.com/?ctiid.252782; https://vuldb.com/?id.252782
CVE: CVE-2023-33851
Published: 2024-02-04
Description: IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could reveal sensitive partition data to a system administrator.  IBM X-Force ID:  257135.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257135; https://www.ibm.com/support/pages/node/7114491; https://exchange.xforce.ibmcloud.com/vulnerabilities/257135
CVE: CVE-2023-50947
Published: 2024-02-04
Description: IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  275665.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275665; https://www.ibm.com/support/pages/node/7114419; https://www.ibm.com/support/pages/node/7114430
CVE: CVE-2015-10129
Published: 2024-02-04
Description: A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 6ad38c58a45642eb8c7844e2f272ef199f59550d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-252716.
CVSS Score: 3.7 (LOW)
CWE: CWE-697
References: https://github.com/samwilson/planet-freo/commit/6ad38c58a45642eb8c7844e2f272ef199f59550d; https://vuldb.com/?ctiid.252716; https://vuldb.com/?id.252716