deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-21312
Published: 2024-01-09
Description: .NET Framework Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21312; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21312; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-21313
Published: 2024-01-09
Description: Windows TCP/IP Information Disclosure Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21313; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21313
CVE: CVE-2024-21314
Published: 2024-01-09
Description: Microsoft Message Queuing Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21314; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21314
CVE: CVE-2024-21316
Published: 2024-01-09
Description: Windows Server Key Distribution Service Security Feature Bypass
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21316; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21316
CVE: CVE-2024-21318
Published: 2024-01-09
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21318; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21318
CVE: CVE-2024-21320
Published: 2024-01-09
Description: Windows Themes Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21320; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21320; https://www.vicarius.io/vsociety/posts/cve-2024-21320-detection-script-windows-themes-spoofing-vulnerability
CVE: CVE-2024-21325
Published: 2024-01-09
Description: Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21325; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21325
CVE: CVE-2024-0341
Published: 2024-01-09
Description: A vulnerability was found in Inis up to 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /app/api/controller/default/File.php of the component GET Request Handler. The manipulation of the argument path leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The identifier VDB-250109 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-24, CWE-22
References: https://note.zhaoj.in/share/VYx8H9u8gyHw; https://vuldb.com/?ctiid.250109; https://vuldb.com/?id.250109
CVE: CVE-2024-21319
Published: 2024-01-09
Description: Microsoft Identity Denial of service vulnerability
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319
CVE: CVE-2024-21668
Published: 2024-01-09
Description: react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d; https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0; https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp
CVE: CVE-2023-7032
Published: 2024-01-09
Description: 
A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker
logged in with a user level account to gain higher privileges by providing a harmful serialized
object.


CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-009-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-009-02.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-009-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-009-02.pdf
CVE: CVE-2024-0342
Published: 2024-01-09
Description: A vulnerability classified as critical has been found in Inis up to 2.0.1. Affected is an unknown function of the file /app/api/controller/default/Sqlite.php. The manipulation of the argument sql leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250110 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/nWYJHrmUqv7i; https://vuldb.com/?ctiid.250110; https://vuldb.com/?id.250110
CVE: CVE-2024-0343
Published: 2024-01-09
Description: A vulnerability classified as problematic was found in CodeAstro Simple House Rental System 5.6. Affected by this vulnerability is an unknown functionality of the component Login Panel. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250111.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1NHdebIGiV8FybYFGXIqWHjdVGzZCQqAm/view?usp=sharing; https://vuldb.com/?ctiid.250111; https://vuldb.com/?id.250111
CVE: CVE-2024-21664
Published: 2024-01-09
Description: jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: https://github.com/lestrrat-go/jwx/commit/0e8802ce[PII_REDACTED]d651456493e7c87625601f; https://github.com/lestrrat-go/jwx/commit/8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65; https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcd
CVE: CVE-2024-0344
Published: 2024-01-09
Description: A vulnerability, which was classified as critical, has been found in soxft TimeMail up to 1.1. Affected by this issue is some unknown functionality of the file check.php. The manipulation of the argument c leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250112.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/VSutvlpgCJkD; https://vuldb.com/?ctiid.250112; https://vuldb.com/?id.250112
CVE: CVE-2024-0345
Published: 2024-01-09
Description: A vulnerability, which was classified as problematic, was found in CodeAstro Vehicle Booking System 1.0. This affects an unknown part of the file usr/usr-register.php of the component User Registration. The manipulation of the argument Full_Name/Last_Name/Address with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250113 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1ihxLw4kzbAbDhHtca3UnTaB-iMWHi5DJ/view?usp=sharing; https://vuldb.com/?ctiid.250113; https://vuldb.com/?id.250113
CVE: CVE-2023-38827
Published: 2024-01-09
Description: Cross Site Scripting vulnerability in Follet School Solutions Destiny v.20_0_1_AU4 and later allows a remote attacker to run arbitrary code via presentonesearchresultsform.do.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Oracle-Security/CVEs/tree/main/Follett%20Learning%20Solutions/Destiny/CVE-2023-38827; https://github.com/Oracle-Security/CVEs/tree/main/Follett%20Learning%20Solutions/Destiny/CVE-2023-38827
CVE: CVE-2023-50136
Published: 2024-01-09
Description: Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/yukino-hiki/CVE/blob/main/2/There%20is%20a%20stored%20xss%20at%20the%20custom%20table.md; https://github.com/yukino-hiki/CVE/blob/main/2/There%20is%20a%20stored%20xss%20at%20the%20custom%20table.md
CVE: CVE-2023-5770
Published: 2024-01-09
Description: Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject.  The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-838, CWE-838
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009
CVE: CVE-2023-6476
Published: 2024-01-09
Description: A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://access.redhat.com/errata/RHSA-2024:0195; https://access.redhat.com/errata/RHSA-2024:0207; https://access.redhat.com/security/cve/CVE-2023-6476
CVE: CVE-2024-0346
Published: 2024-01-09
Description: A vulnerability has been found in CodeAstro Vehicle Booking System 1.0 and classified as problematic. This vulnerability affects unknown code of the file usr/user-give-feedback.php of the component Feedback Page. The manipulation of the argument My Testemonial leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250114 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://drive.google.com/file/d/1bao4YK4GwvAvCdCrsW5UpJZdvREdc_Yj/view?usp=sharing; https://vuldb.com/?ctiid.250114; https://vuldb.com/?id.250114
CVE: CVE-2024-0347
Published: 2024-01-09
Description: A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file signup_teacher.php. The manipulation of the argument Password leads to weak password requirements. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250115.
CVSS Score: 3.7 (LOW)
CWE: CWE-521
References: https://mega.nz/file/2d8GiY4Z#QSKItMUgIsW1-A-QPs9dgUSd2SCZfDg4aHORttFpUF0; https://vuldb.com/?ctiid.250115; https://vuldb.com/?id.250115
CVE: CVE-2024-0348
Published: 2024-01-09
Description: A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the component File Upload Handler. The manipulation leads to resource consumption. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250116.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://mega.nz/file/HNkn2QbI#EjefwKgFoAjtWcxrQFMgBfhVQ1LAf2hq7Jg-nDsE-P4; https://vuldb.com/?ctiid.250116; https://vuldb.com/?id.250116
CVE: CVE-2023-34332
Published: 2024-01-09
Description: 










AMI’s SPx contains
a vulnerability in the BMC where an Attacker
may cause an untrusted pointer to dereference by a local network. A successful
exploitation of this vulnerability may lead to a loss of confidentiality,
integrity, and/or availability. 

















 







 







 







 







 








CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-119
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE: CVE-2023-34333
Published: 2024-01-09
Description: 










AMI’s SPx contains
a vulnerability in the BMC where an Attacker may cause an
untrusted pointer to dereference via a local network. A successful exploitation
of this vulnerability may lead to a loss of confidentiality, integrity, and/or
availability.









 







 







 







 







 








CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-119
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE: CVE-2023-37293
Published: 2024-01-09
Description: AMI’s SPx contains
a vulnerability in the BMC where an Attacker may cause a
stack-based buffer overflow via an adjacent network. A successful exploitation
of this vulnerability may lead to a loss of confidentiality, integrity, and/or
availability. 








CVSS Score: 9.6 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE: CVE-2023-37294
Published: 2024-01-09
Description: 






AMI’s
SPx contains a vulnerability in the BMC where an Attacker may
cause a heap memory corruption via an adjacent network. A successful exploitation
of this vulnerability may lead to a loss of confidentiality, integrity, and/or
availability. 







 







 







 







 








CVSS Score: 8.3 (HIGH)
CWE: CWE-122, CWE-787
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE: CVE-2023-37295
Published: 2024-01-09
Description: 




AMI’s
SPx contains a vulnerability in the BMC where an Attacker may
cause a heap memory corruption via an adjacent network. A successful exploitation
of this vulnerability may lead to a loss of confidentiality, integrity, and/or
availability. 







 







 







 








CVSS Score: 8.3 (HIGH)
CWE: CWE-122, CWE-787
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE: CVE-2023-37296
Published: 2024-01-09
Description: 


AMI’s
SPx contains a vulnerability in the BMC where an Attacker may
cause a stack memory corruption via an adjacent network. A successful exploitation
of this vulnerability may lead to a loss of confidentiality, integrity, and/or
availability. 







 







 








CVSS Score: 8.3 (HIGH)
CWE: CWE-121, CWE-787
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE: CVE-2023-37297
Published: 2024-01-09
Description: 
AMI’s
SPx contains a vulnerability in the BMC where an Attacker may
cause a heap memory corruption via an adjacent network. A successful exploitation
of this vulnerability may lead to a loss of confidentiality, integrity, and/or
availability. 







 








CVSS Score: 8.3 (HIGH)
CWE: CWE-122, CWE-787
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE: CVE-2023-3043
Published: 2024-01-09
Description: 








AMI’s SPx contains
a vulnerability in the BMC where an Attacker may
cause a stack-based buffer overflow via an adjacent network. A successful exploitation
of this vulnerability may lead to a loss of confidentiality, integrity, and/or
availability. 







 







 







 







 







 








CVSS Score: 9.6 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE: CVE-2023-47992
Published: 2024-01-09
Description: An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a denial-of-service attacks and/or run arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47992; https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47992
CVE: CVE-2023-47993
Published: 2024-01-09
Description: A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47993; https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47993
CVE: CVE-2023-47994
Published: 2024-01-09
Description: An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a denial of service and/or run arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47994; https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47994
CVE: CVE-2023-47995
Published: 2024-01-09
Description: Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47995; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDK7DSADYUHJFNVSRGJHEFJGMWRGGDLM/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3ZNVRL5PCTMMA3ZBDKH5WH4RT4ST3HW/
CVE: CVE-2023-47996
Published: 2024-01-09
Description: An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47996; https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47996
CVE: CVE-2024-0349
Published: 2024-01-09
Description: A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to sensitive cookie without secure attribute. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-250117 was assigned to this vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-614
References: https://mega.nz/file/TU1X3TIQ#7bPvxEP0KrdoDZVg-dqinNC5fEQrG5uu58jWzPGh904; https://vuldb.com/?ctiid.250117; https://vuldb.com/?id.250117
CVE: CVE-2024-0350
Published: 2024-01-09
Description: A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-250118 is the identifier assigned to this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-613
References: https://mega.nz/file/fckFBASJ#lffaC0xY44ri9Ln-7hrUbUtq2GTiE8roiW8guR7QeVE; https://vuldb.com/?ctiid.250118; https://vuldb.com/?id.250118
CVE: CVE-2024-0351
Published: 2024-01-09
Description: A vulnerability classified as problematic has been found in SourceCodester Engineers Online Portal 1.0. This affects an unknown part. The manipulation leads to session fixiation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250119.
CVSS Score: 3.1 (LOW)
CWE: CWE-384
References: https://mega.nz/file/LJlBQLhR#Ix4yNMdtVtlJFQP6Ae6fbXmnyH4bXTTAWN_JT5kzXzg; https://vuldb.com/?ctiid.250119; https://vuldb.com/?id.250119
CVE: CVE-2024-0352
Published: 2024-01-09
Description: A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250120.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://note.zhaoj.in/share/ciwYj7QXC4sZ; https://vuldb.com/?ctiid.250120; https://vuldb.com/?id.250120
CVE: CVE-2023-47997
Published: 2024-01-10
Description: An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47997; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDK7DSADYUHJFNVSRGJHEFJGMWRGGDLM/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3ZNVRL5PCTMMA3ZBDKH5WH4RT4ST3HW/
CVE: CVE-2024-0354
Published: 2024-01-10
Description: A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the file index.php. The manipulation of the argument f leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250121 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://note.zhaoj.in/share/nHD5xiHQgHG0; https://vuldb.com/?ctiid.250121; https://vuldb.com/?id.250121
CVE: CVE-2024-0355
Published: 2024-01-10
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System up to 1.1. Affected is an unknown function of the file add-category.php. The manipulation of the argument category leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250122 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://medium.com/@heishou/dfsms-has-sql-injection-vulnerability-e9cfbc375be8; https://vuldb.com/?ctiid.250122; https://vuldb.com/?id.250122