deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-24926
Published: 2024-02-12
Description: Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/brooklyn/wordpress-brooklyn-theme-4-9-7-6-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/brooklyn/wordpress-brooklyn-theme-4-9-7-6-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-41703
Published: 2024-02-12
Description: User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf; http://seclists.org/fulldisclosure/2024/Feb/10
CVE: CVE-2023-41704
Published: 2024-02-12
Description: Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf; http://seclists.org/fulldisclosure/2024/Feb/10
CVE: CVE-2023-41705
Published: 2024-02-12
Description: Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf; http://seclists.org/fulldisclosure/2024/Feb/10
CVE: CVE-2023-41706
Published: 2024-02-12
Description: Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf; http://seclists.org/fulldisclosure/2024/Feb/10
CVE: CVE-2023-41707
Published: 2024-02-12
Description: Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.
 No publicly available exploits are known.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf; http://seclists.org/fulldisclosure/2024/Feb/10
CVE: CVE-2023-41708
Published: 2024-02-12
Description: References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0007.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6259_7.10.6_2023-12-11.pdf; http://seclists.org/fulldisclosure/2024/Feb/10
CVE: CVE-2023-46615
Published: 2024-02-12
Description: Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/kd-coming-soon/wordpress-kd-coming-soon-plugin-1-7-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/kd-coming-soon/wordpress-kd-coming-soon-plugin-1-7-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-23512
Published: 2024-02-12
Description: Deserialization of Untrusted Data vulnerability in wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks.This issue affects ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks: from n/a through 3.1.4.
CVSS Score: 8.7 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/product-blocks/wordpress-productx-plugin-3-1-4-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/product-blocks/wordpress-productx-plugin-3-1-4-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-24875
Published: 2024-02-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.This issue affects Link Library: from n/a through 7.5.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/link-library/wordpress-link-library-plugin-7-5-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/link-library/wordpress-link-library-plugin-7-5-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-24884
Published: 2024-02-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft Contact Form 7 Connector.This issue affects Contact Form 7 Connector: from n/a through 1.2.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ari-cf7-connector/wordpress-contact-form-7-connector-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ari-cf7-connector/wordpress-contact-form-7-connector-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-24887
Published: 2024-02-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress.This issue affects Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress: from n/a through 21.2.8.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/contest-gallery/wordpress-photos-and-files-contest-gallery-plugin-21-2-8-4-csrf-leading-to-gallery-creation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contest-gallery/wordpress-photos-and-files-contest-gallery-plugin-21-2-8-4-csrf-leading-to-gallery-creation-vulnerability?_s_id=cve
CVE: CVE-2024-24929
Published: 2024-02-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ryan Duff, Peter Westwood WP Contact Form.This issue affects WP Contact Form: from n/a through 1.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-contact-form/wordpress-wp-contact-form-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-contact-form/wordpress-wp-contact-form-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-24935
Published: 2024-02-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wpsimpletools-log-viewer/wordpress-basic-log-viewer-plugin-1-0-4-cross-site-request-forgery-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpsimpletools-log-viewer/wordpress-basic-log-viewer-plugin-1-0-4-cross-site-request-forgery-vulnerability?_s_id=cve
CVE: CVE-2024-1439
Published: 2024-02-12
Description: Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-vulnerability-moodle; https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-vulnerability-moodle
CVE: CVE-2024-1062
Published: 2024-02-12
Description: A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122
References: https://access.redhat.com/errata/RHSA-2024:1074; https://access.redhat.com/errata/RHSA-2024:1372; https://access.redhat.com/errata/RHSA-2024:3047
CVE: CVE-2023-6681
Published: 2024-02-12
Description: A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2024:3267; https://access.redhat.com/errata/RHSA-2024:9281; https://access.redhat.com/security/cve/CVE-2023-6681
CVE: CVE-2024-1420
Published: 2024-02-12
Description: Rejected reason: **REJECT** This is a duplicate of CVE-2024-1049. Please use CVE-2024-1049 instead.
CVE: CVE-2023-6036
Published: 2024-02-12
Description: The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/; https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/
CVE: CVE-2023-6081
Published: 2024-02-12
Description: The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://lynk.nl/; https://wpscan.com/vulnerability/5f011911-5fd1-46d9-b468-3062b4ec6f1e/; https://lynk.nl/
CVE: CVE-2023-6082
Published: 2024-02-12
Description: The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://lynk.nl/; https://wpscan.com/vulnerability/c3d43aac-66c8-4218-b3f0-5256f895eda3/; https://lynk.nl/
CVE: CVE-2023-6294
Published: 2024-02-12
Description: The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-918
References: https://wpscan.com/vulnerability/eaeb5706-b19c-4266-b7df-889558ee2614/; https://wpscan.com/vulnerability/eaeb5706-b19c-4266-b7df-889558ee2614/
CVE: CVE-2023-6499
Published: 2024-02-12
Description: The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/69592e52-92db-4e30-92ca-b7b3d5b9185d/; https://wpscan.com/vulnerability/69592e52-92db-4e30-92ca-b7b3d5b9185d/
CVE: CVE-2023-6501
Published: 2024-02-12
Description: The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://magos-securitas.com/txt/CVE-2023-6501.txt; https://wpscan.com/vulnerability/dd19189b-de04-44b6-8ac9-0c32399a8976/; https://magos-securitas.com/txt/CVE-2023-6501.txt
CVE: CVE-2023-6591
Published: 2024-02-12
Description: The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/f296de1c-b70b-4829-aba7-4afa24f64c51/; https://wpscan.com/vulnerability/f296de1c-b70b-4829-aba7-4afa24f64c51/
CVE: CVE-2023-7233
Published: 2024-02-12
Description: The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/585cb2f2-7adc-431f-89d4-4e947f16af18/; https://wpscan.com/vulnerability/585cb2f2-7adc-431f-89d4-4e947f16af18/
CVE: CVE-2024-0248
Published: 2024-02-12
Description: The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 (https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/) in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was partially fixed in 2.3.9.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/faf50bc0-64c5-4ccc-a8ac-e73ed44a74df/; https://wpscan.com/vulnerability/faf50bc0-64c5-4ccc-a8ac-e73ed44a74df/
CVE: CVE-2024-0250
Published: 2024-02-12
Description: The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://wpscan.com/vulnerability/321b07d1-692f-48e9-a8e5-a15b38efa979/; https://wpscan.com/vulnerability/321b07d1-692f-48e9-a8e5-a15b38efa979/
CVE: CVE-2024-0420
Published: 2024-02-12
Description: The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/b6187ef8-70f4-4911-abd7-42bf6b7e54b7/; https://wpscan.com/vulnerability/b6187ef8-70f4-4911-abd7-42bf6b7e54b7/
CVE: CVE-2024-0421
Published: 2024-02-12
Description: The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://wpscan.com/vulnerability/587acc47-1966-4baf-a380-6aa479a97c82/; https://wpscan.com/vulnerability/587acc47-1966-4baf-a380-6aa479a97c82/
CVE: CVE-2024-0566
Published: 2024-02-12
Description: The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/ca83db95-4a08-4615-aa8d-016022404c32/; https://wpscan.com/vulnerability/ca83db95-4a08-4615-aa8d-016022404c32/
CVE: CVE-2024-25360
Published: 2024-02-12
Description: A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafted request to device_web_ip.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-922
References: https://github.com/leetsun/Hints/tree/main/moto-CX2L/4; https://github.com/leetsun/Hints/tree/main/moto-CX2L/4
CVE: CVE-2022-34310
Published: 2024-02-12
Description: IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  229441.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229441; https://www.ibm.com/support/pages/node/6832922; https://www.ibm.com/support/pages/node/6832924
CVE: CVE-2022-38714
Published: 2024-02-12
Description: IBM DataStage on Cloud Pak for Data 4.0.6 to 4.5.2 stores sensitive credential information that can be read by a privileged user.  IBM X-Force ID:  235060.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235060; https://www.ibm.com/support/pages/node/6618039; https://exchange.xforce.ibmcloud.com/vulnerabilities/235060
CVE: CVE-2022-34309
Published: 2024-02-12
Description: IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  229440.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229440; https://www.ibm.com/support/pages/node/6832814; https://www.ibm.com/support/pages/node/6832918
CVE: CVE-2022-34311
Published: 2024-02-12
Description: IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due to insufficiently protected credentials.  IBM X-Force ID:  229446.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229446; https://www.ibm.com/support/pages/node/6832928; https://www.ibm.com/support/pages/node/6832930
CVE: CVE-2024-0164
Published: 2024-02-12
Description: 
Dell Unity, versions prior to 5.4, contain an OS Command Injection Vulnerability in its svc_topstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary commands with elevated privileges.


CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2024-0165
Published: 2024-02-12
Description: 
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_acldb_dump utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges.


CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2024-0166
Published: 2024-02-12
Description: 
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_tcpdump utility. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands with elevated privileges.


CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2024-0167
Published: 2024-02-12
Description: 
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svc_topstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files on the file system with root privileges.


CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2024-0168
Published: 2024-02-12
Description: 
Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svc_oscheck utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to inject arbitrary operating system commands. This vulnerability allows an authenticated attacker to execute commands with root privileges.


CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2024-0169
Published: 2024-02-12
Description: Dell Unity, version(s) 5.3 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities