deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45847
Published: 2024-09-12
Description: An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-95, CWE-94
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45848
Published: 2024-09-12
Description: An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database created with the ChromaDB engine, the code will be passed to an eval function and executed on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-95, CWE-94
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45849
Published: 2024-09-12
Description: An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-95, CWE-94
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45850
Published: 2024-09-12
Description: An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for site column creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-95, CWE-94
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45851
Published: 2024-09-12
Description: An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list item creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-95, CWE-94
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45852
Published: 2024-09-12
Description: Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45853
Published: 2024-09-12
Description: Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.
CVSS Score: 7.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45854
Published: 2024-09-12
Description: Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it.
CVSS Score: 7.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45855
Published: 2024-09-12
Description: Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.
CVSS Score: 7.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45856
Published: 2024-09-12
Description: A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE: CVE-2024-45857
Published: 2024-09-12
Description: Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://hiddenlayer.com/sai-security-advisory/2024-09-cleanlab/
CVE: CVE-2024-28990
Published: 2024-09-12
Description: SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console.

We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-798
References: https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28990
CVE: CVE-2024-28991
Published: 2024-09-12
Description: SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502
References: https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28991
CVE: CVE-2024-40457
Published: 2024-09-12
Description: No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-312
References: https://github.com/jeppojeps/CVE-2024-40457-PoC; https://www.noip.com/support/knowledgebase/install-linux-3-x-dynamic-update-client-duc; https://www.noip.com/support/knowledgebase/running-linux-duc-v3-0-startup-2
CVE: CVE-2024-45824
Published: 2024-09-12
Description: CVE-2024-45824 IMPACT



A remote
code vulnerability exists in the affected products. The vulnerability occurs
when chained with Path Traversal, Command Injection, and XSS Vulnerabilities
and allows for full unauthenticated remote code execution. The link in the
mitigations section below contains patches to fix this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1696.html
CVE: CVE-2024-42483
Published: 2024-09-12
Description: ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW because the caches is not differentiated by message types, it is a single, shared resource for all kinds of messages, whether they are broadcast or unicast, and regardless of whether they are ciphertext or plaintext. This can result an attacker to clear the cache of its legitimate entries, there by creating an opportunity to re-inject previously captured packets. This vulnerability is fixed in 2.5.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-349, CWE-345
References: https://github.com/espressif/esp-now/commit/4e30db50d541b2909d278ef0db05de1a3d7190ef; https://github.com/espressif/esp-now/security/advisories/GHSA-wf6q-c2xr-77xj
CVE: CVE-2024-42484
Published: 2024-09-12
Description: ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound (OOB) vulnerability was discovered in the implementation of the ESP-NOW group type message because there is no check for the addrs_num field of the group type message. This can result in memory corruption related attacks. Normally there are two fields in the group information that need to be checked, i.e., the addrs_num field and the addrs_list fileld. Since we only checked the addrs_list field, an attacker can send a group type message with an invalid addrs_num field, which will cause the message handled by the firmware to be much larger than the current buffer, thus causing a memory corruption issue that goes beyond the payload length.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/espressif/esp-now/commit/b03a1b4593713fa4bf0038a87edca01f10114a7a; https://github.com/espressif/esp-now/security/advisories/GHSA-q6f6-4qc5-vhx5
CVE: CVE-2024-45823
Published: 2024-09-12
Description: CVE-2024-45823 IMPACT



An
authentication bypass vulnerability exists in the affected product. The
vulnerability exists due to shared secrets across accounts and could allow a threat
actor to impersonate a user if the threat actor is able to enumerate additional
information required during authentication.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201698.html
CVE: CVE-2024-45825
Published: 2024-09-12
Description: CVE-2024-45825 IMPACT
A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1699.html
CVE: CVE-2024-45826
Published: 2024-09-12
Description: CVE-2024-45826 IMPACT
Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-610, CWE-610
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1700.html
CVE: CVE-2024-6510
Published: 2024-09-12
Description: Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-732, CWE-749, CWE-427
References: https://www.cirosec.de/sa/sa-2023-008
CVE: CVE-2024-6658
Published: 2024-09-12
Description: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects:



 Product 





Affected Versions 





LoadMaster 





From 7.2.55.0 to 7.2.60.0 (inclusive) 





  





From 7.2.49.0 to 7.2.54.11 (inclusive) 





  





7.2.48.12 and all prior versions 








Multi-Tenant Hypervisor 





7.1.35.11 and all prior versions 










ECS





All prior versions to 7.2.60.0 (inclusive)
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]0701
CVE: CVE-2024-6700
Published: 2024-09-12
Description: Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-c24-vulnerability-remediation-note
CVE: CVE-2024-6701
Published: 2024-09-12
Description: Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-c24-vulnerability-remediation-note
CVE: CVE-2024-6702
Published: 2024-09-12
Description: Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-c24-vulnerability-remediation-note
CVE: CVE-2024-2743
Published: 2024-09-12
Description: An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/451014; https://hackerone.com/reports/2411756; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-4612
Published: 2024-09-12
Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://gitlab.com/gitlab-org/gitlab/-/issues/460707; https://hackerone.com/reports/2479857; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-4660
Published: 2024-09-12
Description: An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/460892; https://hackerone.com/reports/2480126; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-5435
Published: 2024-09-12
Description: An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://gitlab.com/gitlab-org/gitlab/-/issues/464044; https://hackerone.com/reports/2520722; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-6389
Published: 2024-09-12
Description: An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://gitlab.com/gitlab-org/gitlab/-/issues/469367; https://hackerone.com/reports/2573397; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-6446
Published: 2024-09-12
Description: An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application.
CVSS Score: 3.5 (LOW)
CWE: CWE-840
References: https://gitlab.com/gitlab-org/gitlab/-/issues/470144; https://hackerone.com/reports/2573481; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-6840
Published: 2024-09-12
Description: An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-285
References: https://access.redhat.com/errata/RHSA-2024:6428; https://access.redhat.com/security/cve/CVE-2024-6840; https://bugzilla.redhat.com/show_bug.cgi?id=2298492
CVE: CVE-2024-8124
Published: 2024-09-12
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2  which could cause Denial of Service via sending a specific POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/480533; https://hackerone.com/reports/2634880; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-8631
Published: 2024-09-12
Description: A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-267
References: https://gitlab.com/gitlab-org/gitlab/-/issues/462665; https://hackerone.com/reports/2478469; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-8635
Published: 2024-09-12
Description: A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL
CVSS Score: 7.7 (HIGH)
CWE: CWE-918, CWE-918
References: https://gitlab.com/gitlab-org/gitlab/-/issues/455273; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-8640
Published: 2024-09-12
Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server.
CVSS Score: 8.5 (HIGH)
CWE: CWE-77, CWE-77
References: https://gitlab.com/gitlab-org/gitlab/-/issues/486213; https://hackerone.com/reports/2687770; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-8754
Published: 2024-09-12
Description: An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-642
References: https://gitlab.com/gitlab-org/gitlab/-/issues/464062
CVE: CVE-2020-24061
Published: 2024-09-12
Description: Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and steal cookies via a crafted script
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/0xadik/CVEs/tree/main/CVE-2020-24061; https://medium.com/%40sadikul.islam/kasda-kw5515-cross-site-scripting-html-injection-e6cb9f65ae89?sk=5e1ea8e1cba8dbeaff7f9cd710808354
CVE: CVE-2024-41629
Published: 2024-09-12
Description: An issue in Texas Instruments Fusion Digital Power Designer v.7.10.1 allows a local attacker to obtain sensitive information via the plaintext storage of credentials
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-200
References: https://seclists.org/fulldisclosure/2024/Sep/1; http://seclists.org/fulldisclosure/2024/Sep/1
CVE: CVE-2024-8695
Published: 2024-09-12
Description: A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79, CWE-94
References: https://docs.docker.com/desktop/release-notes/#4342
CVE: CVE-2024-8696
Published: 2024-09-12
Description: A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79, CWE-94
References: https://docs.docker.com/desktop/release-notes/#4342
CVE: CVE-2024-25270
Published: 2024-09-12
Description: An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the exposure of sensitive user data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/fbkcs/CVE-2024-25270
CVE: CVE-2024-34334
Published: 2024-09-12
Description: ORDAT FOSS-Online before v2.24.01 was discovered to contain a SQL injection vulnerability via the forgot password function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: http://foss-online.com; http://ordat.com; https://mind-bytes.de/sql-injection-in-foss-online-cve-2024-34334/
CVE: CVE-2024-34335
Published: 2024-09-12
Description: ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://foss-online.com; http://ordat.com; https://mind-bytes.de/cross-site-scripting-in-foss-online-cve-2024-34335/
CVE: CVE-2024-34336
Published: 2024-09-12
Description: User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-204
References: http://foss-online.com; http://ordat.com; https://mind-bytes.de/offenlegung-existierender-benutzerkonten-in-foss-online-cve-2024-34336/
CVE: CVE-2024-36066
Published: 2024-09-12
Description: The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication (the other option is certificate-based). RFC 4211 section 4.4 requires that password-based MAC parameters use a salt with a random value of at least 8 octets. This helps to inhibit dictionary attacks. Because the standalone CMP client originally was developed as test code, the salt was instead hardcoded and only 6 octets long.
CVSS Score: 3.1 (LOW)
References: https://datatracker.ietf.org/doc/html/rfc4211#section-4.4; https://support.keyfactor.com/hc/en-us/articles/[PII_REDACTED]1595-EJBCA-Security-Advisory-EJBCA-standalone-CMP-CLI-client
CVE: CVE-2024-45181
Published: 2024-09-12
Description: An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70. An improper bounds check allows crafted packets to cause an arbitrary address write, resulting in kernel memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-119
References: https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-94453.pdf; https://wibu.com
CVE: CVE-2024-45182
Published: 2024-09-12
Description: An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70 An improper bounds check allows specially crafted packets to cause an arbitrary address read, resulting in Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-404
References: https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-94453.pdf; https://wibu.com