deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1558
Published: 2024-04-16
Description: A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the mlflow/mlflow repository, due to improper validation of the `source` parameter. Attackers can exploit this vulnerability by crafting a `source` parameter that bypasses the `_validate_non_local_source_contains_relative_paths(source)` function's checks, allowing for arbitrary file read access on the server. The issue arises from the handling of unquoted URL characters and the subsequent misuse of the original `source` value for model version creation, leading to the exposure of sensitive files when interacting with the `/model-versions/get-artifact` handler.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/7f4dbcc5-b6b3-43dd-b310-e2d0556a8081; https://huntr.com/bounties/7f4dbcc5-b6b3-43dd-b310-e2d0556a8081
CVE: CVE-2024-1560
Published: 2024-04-16
Description: A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path validation by exploiting the double decoding process in the `_delete_artifact_mlflow_artifacts` handler and `local_file_uri_to_path` function, allowing for the deletion of arbitrary directories on the server's filesystem. This vulnerability is due to an extra unquote operation in the `delete_artifacts` function of `local_artifact_repo.py`, which fails to properly sanitize user-supplied paths. The issue is present up to version 2.9.2, despite attempts to fix a similar issue in CVE-2023-6831.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/4a34259c-3c8f-4872-b178-f27fbc876b98; https://huntr.com/bounties/4a34259c-3c8f-4872-b178-f27fbc876b98
CVE: CVE-2024-1561
Published: 2024-04-16
Description: An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with attacker-controlled arguments. Specifically, by exploiting the `move_resource_to_block_cache()` method of the `Block` class, an attacker can copy any file on the filesystem to a temporary directory and subsequently retrieve it. This vulnerability enables unauthorized local file read access, posing a significant risk especially when the application is exposed to the internet via `launch(share=True)`, thereby allowing remote attackers to read files on the host machine. Furthermore, gradio apps hosted on `huggingface.co` are also affected, potentially leading to the exposure of sensitive information such as API keys and credentials stored in environment variables.
CVSS Score: 7.5 (HIGH)
CWE: CWE-29
References: https://github.com/gradio-app/gradio/commit/24a[PII_REDACTED]67ca8b8b02959c441818bdb34a2; https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338; https://www.gradio.app/changelog#4-13-0
CVE: CVE-2024-1569
Published: 2024-04-16
Description: parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/parisneo/lollms-webui/commit/354cf766835396b7fc0d5105ed3b77572a653149; https://huntr.com/bounties/369d1694-47e4-49bc-bb35-931ce4a5148e; https://github.com/parisneo/lollms-webui/commit/354cf766835396b7fc0d5105ed3b77572a653149
CVE: CVE-2024-1593
Published: 2024-04-16
Description: A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using the ';' character in URLs, attackers can manipulate the 'params' portion of the URL to gain unauthorized access to files or directories. This vulnerability allows for arbitrary data smuggling into the 'params' part of the URL, enabling attacks similar to those described in previous reports but utilizing the ';' character for parameter smuggling. Successful exploitation could lead to unauthorized information disclosure or server compromise.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/dbdc6bd6-d09a-46f2-9d9c-5138a14b6e31; https://huntr.com/bounties/dbdc6bd6-d09a-46f2-9d9c-5138a14b6e31
CVE: CVE-2024-1594
Published: 2024-04-16
Description: A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component `#` in the artifact location URI to read arbitrary files on the server in the context of the server's process. This issue is similar to CVE-2023-6909 but utilizes a different component of the URI to achieve the same effect. 
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/424b6f6b-e778-4a2b-b860-39730d396f3e; https://huntr.com/bounties/424b6f6b-e778-4a2b-b860-39730d396f3e
CVE: CVE-2024-1601
Published: 2024-04-16
Description: An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data. The vulnerability is exploitable via a crafted HTTP POST request to the `/delete_discussion` endpoint, which internally calls the vulnerable `delete_discussion()` function. By sending a specially crafted payload in the 'id' parameter, an attacker can manipulate SQL queries to delete all records from the 'discussion' and 'message' tables. This issue is due to improper neutralization of special elements used in an SQL command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/parisneo/lollms-webui/commit/f0bc8f2babdfd4770a5adbf3b60ec612e4f1db46; https://huntr.com/bounties/652a176e-6bd7-4161-8775-63a34ecc71d5; https://github.com/parisneo/lollms-webui/commit/f0bc8f2babdfd4770a5adbf3b60ec612e4f1db46
CVE: CVE-2024-1626
Published: 2024-04-16
Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, within the project update endpoint. The vulnerability allows authenticated users to modify the name of any project within the system without proper authorization checks, by directly referencing the project's ID in the PATCH request to the '/v1/projects/:projectId' endpoint. This issue arises because the endpoint does not verify if the provided project ID belongs to the currently authenticated user, enabling unauthorized modifications across different organizational projects.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/lunary-ai/lunary/commit/9eb9e526edff8bf82ae032f7a04867c8d58572bc; https://huntr.com/bounties/ccc291db-ae9c-403c-b6b5-6fe3f4800933; https://github.com/lunary-ai/lunary/commit/9eb9e526edff8bf82ae032f7a04867c8d58572bc
CVE: CVE-2024-1646
Published: 2024-04-16
Description: parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized access to endpoints such as '/restart_program', '/update_software', '/check_update', '/start_recording', and '/stop_recording'. This vulnerability can lead to denial of service, unauthorized disabling or overriding of recordings, and potentially other impacts if certain features are enabled in the configuration.
CVSS Score: 8.2 (HIGH)
CWE: CWE-288
References: https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8; https://huntr.com/bounties/2f769c46-aa85-4ab8-8b08-fe791313b7ba; https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8
CVE: CVE-2024-1665
Published: 2024-04-16
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-1666
Published: 2024-04-16
Description: In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result, attackers can bypass the intended account upgrade requirement by directly sending crafted requests to the server, enabling the creation of an unlimited number of radars without payment.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54; https://huntr.com/bounties/0f310501-b5b0-4be0-ae38-d6b836f71ff0; https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54
CVE: CVE-2024-1738
Published: 2024-04-16
Description: An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoint. This vulnerability allows unauthorized users to retrieve the results of any organization's evaluation by simply knowing the evaluation ID, due to the lack of project ID verification in the SQL query. As a result, attackers can gain access to potentially private data contained within the evaluation results.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/lunary-ai/lunary/commit/a4e61122e61dc31460cfbe54d15fae389cc440ce; https://huntr.com/bounties/f68ef361-7a5d-4272-9c2f-414baf074309; https://github.com/lunary-ai/lunary/commit/a4e61122e61dc31460cfbe54d15fae389cc440ce
CVE: CVE-2024-1739
Published: 2024-04-16
Description: lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-821
References: https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695; https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300; https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695
CVE: CVE-2024-1961
Published: 2024-04-16
Description: vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers can exploit this vulnerability to write arbitrary files anywhere in the file system by manipulating the 'artifact_path' parameter. This flaw can lead to Remote Code Execution (RCE) by overwriting critical files, such as the application's configuration file, especially when the application is run outside of Docker. The vulnerability is present in the NFSController.java and NFSService.java components of the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3; https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3
CVE: CVE-2024-2083
Published: 2024-04-16
Description: A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-29
References: https://github.com/zenml-io/zenml/commit/00e934f33a243a554f5f65b80eefd5ea5117367b; https://huntr.com/bounties/f24b2216-6a4b-42a1-becb-9b47e6cf117f; https://github.com/zenml-io/zenml/commit/00e934f33a243a554f5f65b80eefd5ea5117367b
CVE: CVE-2024-2260
Published: 2024-04-16
Description: A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-384
References: https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e; https://huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167; https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e
CVE: CVE-2024-2912
Published: 2024-04-16
Description: An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is triggered when a serialized object, crafted to execute OS commands upon deserialization, is sent to any valid BentoML endpoint. This issue poses a significant security risk, enabling attackers to compromise the server and potentially gain unauthorized access or control.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1188
References: https://github.com/bentoml/bentoml/commit/fd70379733c57c6368cc022ac1f841b7b426db7b; https://huntr.com/bounties/349a1cce-6bb5-4345-82a5-bf7041b65a68; https://github.com/bentoml/bentoml/commit/fd70379733c57c6368cc022ac1f841b7b426db7b
CVE: CVE-2024-30567
Published: 2024-04-16
Description: An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network Troubleshooting functionality.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://gist.github.com/s4fv4n/f0e8eccd0ce4bd1ac109fa2481c90ee6; https://gist.github.com/s4fv4n/f0e8eccd0ce4bd1ac109fa2481c90ee6
CVE: CVE-2024-3028
Published: 2024-04-16
Description: mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5ce; https://huntr.com/bounties/41016b86-eabb-4161-ac81-40a1ca8e82ac; https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5ce
CVE: CVE-2024-3029
Published: 2024-04-16
Description: In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multi_user_mode'. The vulnerability allows an attacker to remove all existing users and potentially create a new admin user without requiring a password, leading to unauthorized access and control over the application.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20
References: https://github.com/mintplex-labs/anything-llm/commit/99cfee1e7025fe9a0919a4d506ba1e1b819f6073; https://huntr.com/bounties/7189a7a0-9830-459d-b853-bdc2559999a0; https://github.com/mintplex-labs/anything-llm/commit/99cfee1e7025fe9a0919a4d506ba1e1b819f6073
CVE: CVE-2024-3271
Published: 2024-04-16
Description: A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by crafting input that does not contain an underscore but still results in the execution of OS commands. The vulnerability allows for remote code execution (RCE) on the server hosting the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475; https://huntr.com/bounties/9b32490e-7cf9-470e-8d49-ba083ae7a279; https://github.com/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475
CVE: CVE-2024-3571
Published: 2024-04-16
Description: langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to information disclosure or remote code execution. The issue lies in the handling of file paths in the mset and mget methods, where user-supplied input is not adequately sanitized, allowing directory traversal sequences to reach unintended directories.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/langchain-ai/langchain/commit/aad3d8bd47d7f5598156ff2bdcc8f736f24a7412; https://huntr.com/bounties/2df3acdc-ee4f-4257-bbf8-a7de3870a9d8; https://github.com/langchain-ai/langchain/commit/aad3d8bd47d7f5598156ff2bdcc8f736f24a7412
CVE: CVE-2024-3572
Published: 2024-04-16
Description: The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data. 
CVSS Score: 7.5 (HIGH)
CWE: CWE-409
References: https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f; https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb; https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f
CVE: CVE-2024-3573
Published: 2024-04-16
Description: mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-29, CWE-22
References: https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc; https://huntr.com/bounties/8ea058a7-4ef8-4baf-9198-bc0147fc543c; https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc
CVE: CVE-2024-3574
Published: 2024-04-16
Description: In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75; https://huntr.com/bounties/49[PII_REDACTED]-43e3-a152-62b16eed72a9; https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75
CVE: CVE-2024-3575
Published: 2024-04-16
Description: Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://huntr.com/bounties/5f720b48-ddeb-4f2a-830f-a3dd15d5daa2; https://huntr.com/bounties/5f720b48-ddeb-4f2a-830f-a3dd15d5daa2
CVE: CVE-2024-31634
Published: 2024-04-16
Description: Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/buchilajiao1/CVE/blob/main/xunruicms/xunruicms.md; https://github.com/buchilajiao1/CVE/blob/main/xunruicms/xunruicms.md
CVE: CVE-2024-31783
Published: 2024-04-16
Description: Cross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensitive information via a crafted script during markdown file creation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/0x0fc/TyporaXSS/blob/main/TyporaXSS.md; https://github.com/0x0fc/TyporaXSS/blob/main/TyporaXSS.md
CVE: CVE-2024-31784
Published: 2024-04-16
Description: An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-290
References: https://github.com/0x0fc/TyporaIframe/blob/main/TyporaIframeVuln.md; https://github.com/0x0fc/TyporaIframe/blob/main/TyporaIframeVuln.md
CVE: CVE-2024-22262
Published: 2024-04-16
Description: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as  CVE-2024-22259 https://spring.io/security/cve-2024-22259  and  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVSS Score: 8.1 (HIGH)
CWE: CWE-601, CWE-918
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://spring.io/security/cve-2024-22262; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-32557
Published: 2024-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons Exclusive Addons Elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/exclusive-addons-for-elementor/wordpress-exclusive-addons-for-elementor-plugin-2-6-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/exclusive-addons-for-elementor/wordpress-exclusive-addons-for-elementor-plugin-2-6-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32625
Published: 2024-04-16
Description: In OffloadAMRWriter, a scalar field is not initialized so will contain an arbitrary value left over from earlier computations
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-457
References: https://www.asrmicro.com/en/goods/psirt?cid=38; https://www.asrmicro.com/en/goods/psirt?cid=38
CVE: CVE-2024-32631
Published: 2024-04-16
Description: Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-125
References: https://www.asrmicro.com/en/goods/psirt?cid=38; https://www.asrmicro.com/en/goods/psirt?cid=38
CVE: CVE-2024-32632
Published: 2024-04-16
Description: A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-686
References: https://www.asrmicro.com/en/goods/psirt?cid=38; https://www.asrmicro.com/en/goods/psirt?cid=38
CVE: CVE-2024-32633
Published: 2024-04-16
Description: An unsigned value can never be negative, so eMMC full disk test will always evaluate the same way.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-570
References: https://www.asrmicro.com/en/goods/psirt?cid=38; https://www.asrmicro.com/en/goods/psirt?cid=38