deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-52814
Published: 2024-11-22
Description: Argo Helm is a collection of community maintained charts for `argoproj.github.io` projects. Prior to version 0.45.0, the `workflow-role`) lacks granularity in its privileges, giving permissions to `workflowtasksets` and `workflowartifactgctasks` to all workflow Pods, when only certain types of Pods created by the Controller require these privileges. The impact is minimal, as an attack could only affect status reporting for certain types of Pods and templates. Version 0.45.0 fixes the issue.
CVSS Score: 2.8 (LOW)
CWE: CWE-1220
References: https://github.com/argoproj/argo-helm/blob/2653aef414ab6a5d8617af75f04190a8f7da28dc/charts/argo-workflows/templates/controller/workflow-role.yaml; https://github.com/argoproj/argo-helm/blob/2653aef414ab6a5d8617af75f04190a8f7da28dc/charts/argo-workflows/templates/controller/workflow-role.yaml#L45-L56; https://github.com/argoproj/argo-helm/security/advisories/GHSA-h974-w8pg-cx73
CVE: CVE-2024-10220
Published: 2024-11-22
Description: The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://github.com/kubernetes/kubernetes/issues/128885; https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko; http://www.openwall.com/lists/oss-security/2024/11/20/1
CVE: CVE-2024-44786
Published: 2024-11-22
Description: Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://gist.github.com/luluhackme/8356703c7295d03d6e68a1ca652441b9
CVE: CVE-2024-53438
Published: 2024-11-22
Description: EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/ChurchCRM/CRM/issues/6988; https://github.com/advisories/GHSA-gr5x-8j97-qq23
CVE: CVE-2024-37782
Published: 2024-11-22
Description: An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or execute arbitrary commands via a crafted payload injected into the username field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://gist.githubusercontent.com/Draoken/ab5465fc339df7a1e42281540b61f887/raw/fb28d4148e311e8cde9778dee4f8b2e64e27ea92/CVE-2024-37782.txt; https://medium.com/%40jkoreamo/centrestack-vulnerability-disclosure-d28dc8f21a56; https://www.centrestack.com/p/gce_latest_release.html
CVE: CVE-2024-37783
Published: 2024-11-22
Description: A reflected cross-site scripting (XSS) vulnerability in Gladinet CentreStack v13.12.9934.54690 allows attackers to inject malicious JavaScript into the web browser of a victim via the sessionId parameter at /portal/ForgotPassword.aspx.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.githubusercontent.com/Draoken/9526cd338b7941340b7bf[PII_REDACTED]/raw/f32c03ee229210f9f039293bd2f3c7fe1d9be8c4/CVE-2024-37783.txt; https://medium.com/%40jkoreamo/centrestack-vulnerability-disclosure-d28dc8f21a56; https://www.centrestack.com/p/gce_latest_release.html
CVE: CVE-2024-50657
Published: 2024-11-22
Description: An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the checkPassCodeIsValid method
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-276
References: https://drive.google.com/drive/folders/1C-ZYjYhmKRGvWs9YN51XOiAS2WxxwdQd?usp=sharing; https://github.com/SAHALLL/CVE-2024-50657
CVE: CVE-2024-11618
Published: 2024-11-22
Description: A vulnerability classified as critical was found in IPC Unigy Management System 04.03.00.08.0027. Affected by this vulnerability is an unknown functionality of the component HTTP Request Handler. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918
References: https://github.com/br484/br484.github.io/blob/main/archives/WEB/CVE%20-%20IPC%20Unigy%20-%20ingles.md; https://vuldb.com/?ctiid.285841; https://vuldb.com/?id.285841
CVE: CVE-2024-52726
Published: 2024-11-22
Description: CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://gist.github.com/sec-Kode/bb71138619b22de28c6b0ba986ad58e5; https://github.com/sec-Kode/cve3/blob/main/cve3.md
CVE: CVE-2024-52998
Published: 2024-11-22
Description: Substance3D - Stager versions 3.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb24-60.html
CVE: CVE-2023-39470
Published: 2024-11-22
Description: PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability.

The specific flaw exists within the management of the print.script.sandboxed setting. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20965.
CVSS Score: 7.2 (HIGH)
CWE: CWE-749
References: https://www.papercut.com/kb/Main/SecurityBulletinJune2023/; https://www.zerodayinitiative.com/advisories/ZDI-24-786/
CVE: CVE-2023-51634
Published: 2024-11-22
Description: NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR RAX30  routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-19589.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://kb.netgear.com/000065928/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0139; https://www.zerodayinitiative.com/advisories/ZDI-24-583/
CVE: CVE-2023-51635
Published: 2024-11-22
Description: NETGEAR RAX30 fing_dil Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within fing_dil service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19843.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://kb.netgear.com/000065928/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0139; https://www.zerodayinitiative.com/advisories/ZDI-24-584/
CVE: CVE-2023-51638
Published: 2024-11-22
Description: Allegra Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. 

The specific flaw exists within the configuration of a database. The issue results from the use of a hardcoded password. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22360.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-111/
CVE: CVE-2023-51639
Published: 2024-11-22
Description: Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. 

The specific flaw exists within the downloadExportedChart action. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22361.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-110/
CVE: CVE-2023-51640
Published: 2024-11-22
Description: Allegra extarctZippedFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the extarctZippedFile [sic] method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22504.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-107/
CVE: CVE-2023-51641
Published: 2024-11-22
Description: Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level.

The specific flaw exists within the renderFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22505.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-106/
CVE: CVE-2023-51642
Published: 2024-11-22
Description: Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level.

The specific flaw exists within the loadFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22506.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-105/
CVE: CVE-2023-51643
Published: 2024-11-22
Description: Allegra uploadFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the uploadFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22510.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-103/
CVE: CVE-2023-51644
Published: 2024-11-22
Description: Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is not required to exploit this vulnerability. 

The specific flaw exists within the configuration of Struts. The issue results from improper access control. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22512.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-102/
CVE: CVE-2023-51645
Published: 2024-11-22
Description: Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22513.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-101/
CVE: CVE-2023-51646
Published: 2024-11-22
Description: Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the uploadSimpleFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22527.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-109/
CVE: CVE-2023-51647
Published: 2024-11-22
Description: Allegra saveInlineEdit Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the saveInlineEdit method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22528.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-108/
CVE: CVE-2023-51648
Published: 2024-11-22
Description: Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the product implements a registration mechanism that can be used to create a new user with a sufficient privilege level.

The specific flaw exists within the getFileContentAsString method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22530.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-099/
CVE: CVE-2023-52332
Published: 2024-11-22
Description: Allegra serveMathJaxLibraries Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Authentication is not required to exploit this vulnerability. 

The specific flaw exists within the serveMathJaxLibraries method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22532.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-100/
CVE: CVE-2023-52333
Published: 2024-11-22
Description: Allegra saveFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level.

The specific flaw exists within the saveFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22548.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-104/
CVE: CVE-2023-52334
Published: 2024-11-22
Description: Allegra downloadAttachmentGlobal Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level.

The specific flaw exists within the downloadAttachmentGlobal action. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22507.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html; https://www.zerodayinitiative.com/advisories/ZDI-24-112/
CVE: CVE-2023-52335
Published: 2024-11-22
Description: Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the ConfigurationServlet servlet, which listens on TCP port 8080 by default. When parsing the column_value element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-17863.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.advantech.com/zh-tw/support/details/firmware?id=1-HIPU-183; https://www.zerodayinitiative.com/advisories/ZDI-24-610/
CVE: CVE-2024-1867
Published: 2024-11-22
Description: G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the G DATA Backup Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22312.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-24-559/
CVE: CVE-2024-1868
Published: 2024-11-22
Description: G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the G DATA Backup Service. By creating a symbolic link, an attacker can abuse the service to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22313.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-24-558/
CVE: CVE-2024-30372
Published: 2024-11-22
Description: Allegra getLinkText Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of getLinkText method. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23609.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1336
References: https://alltena.com/en/resources/release-notes/relnotes-7-5-2; https://www.zerodayinitiative.com/advisories/ZDI-24-1165/
CVE: CVE-2024-30376
Published: 2024-11-22
Description: Famatech Advanced IP Scanner Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Famatech Advanced IP Scanner. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the application's use of Qt. The application loads Qt plugins from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of an administrator. Was ZDI-CAN-20768.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://www.zerodayinitiative.com/advisories/ZDI-24-670/