deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-6320
Published: 2024-04-09
Description: A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability.

Full versions and TV models affected:
  *  webOS 5.5.0 - 04.50.51 running on OLED55CXPUA 

  *  webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/; https://lgsecurity.lge.com/bulletins/tv#updateDetails; https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/
CVE: CVE-2024-28190
Published: 2024-04-09
Description: Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager; https://github.com/contao/contao/commit/878d28dbe0f408740555d6fc8b634bd3f8febfce; https://github.com/contao/contao/commit/b794e14fff070101bf6a885da9b1a83395093b4d
CVE: CVE-2024-28191
Published: 2024-04-09
Description: Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
CVSS Score: 3.1 (LOW)
CWE: CWE-74, CWE-74
References: https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator; https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919; https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b
CVE: CVE-2024-28234
Published: 2024-04-09
Description: Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://contao.org/en/security-advisories/insufficient-bbcode-sanitization; https://github.com/contao/contao/commit/55b995d8d35da0d36bc6a22c53fe6423ab0c4ae2; https://github.com/contao/contao/commit/6d42e667177c972ae7c219645593c262d7764ce2
CVE: CVE-2023-41677
Published: 2024-04-09
Description: A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17 allows attacker to execute unauthorized code or commands via targeted social engineering attack
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://fortiguard.com/psirt/FG-IR-23-493; https://fortiguard.com/psirt/FG-IR-23-493
CVE: CVE-2023-45590
Published: 2024-04-09
Description: An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking a FortiClientLinux user into visiting a malicious website
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-94
References: https://fortiguard.com/psirt/FG-IR-23-087; https://fortiguard.com/psirt/FG-IR-23-087
CVE: CVE-2023-47540
Published: 2024-04-09
Description: An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.0.5 through 3.0.7 allows attacker to execute unauthorized code or commands via CLI.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-23-411; https://fortiguard.com/psirt/FG-IR-23-411
CVE: CVE-2023-47541
Published: 2024-04-09
Description: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions, FortiSandbox 2.3 all versions, FortiSandbox 2.2 all versions, FortiSandbox 2.1 all versions, FortiSandbox 2.0 all versions allows attacker to execute unauthorized code or commands via CLI.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-22
References: https://fortiguard.com/psirt/FG-IR-23-416; https://fortiguard.com/psirt/FG-IR-23-416
CVE: CVE-2023-47542
Published: 2024-04-09
Description: A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1336, CWE-94
References: https://fortiguard.com/psirt/FG-IR-23-419; https://fortiguard.com/psirt/FG-IR-23-419
CVE: CVE-2023-48724
Published: 2024-04-09
Description: A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted HTTP POST request can lead to denial of service of the device's web interface. An attacker can send an unauthenticated HTTP POST request to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1864
CVE: CVE-2023-48784
Published: 2024-04-09
Description: A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local privileged attacker with super-admin profile and CLI access to execute arbitrary code or commands via specially crafted requests.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-134
References: https://fortiguard.com/psirt/FG-IR-23-413; https://fortiguard.com/psirt/FG-IR-23-413
CVE: CVE-2023-49074
Published: 2024-04-09
Description: A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-749
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1861
CVE: CVE-2023-49133
Published: 2024-04-09
Description: A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.This vulnerability impacts `uclited` on the EAP225(V3) 5.1.0 Build 20220926 of the AC1350 Wireless MU-MIMO Gigabit Access Point.
CVSS Score: 8.1 (HIGH)
CWE: CWE-829, CWE-77
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1862; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1862; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1862
CVE: CVE-2023-49134
Published: 2024-04-09
Description: A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.This vulnerability impacts `uclited` on the EAP115(V4) 5.0.4 Build 20220216 of the N300 Wireless Gigabit Access Point.
CVSS Score: 8.1 (HIGH)
CWE: CWE-829, CWE-77
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1862; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1862; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1862
CVE: CVE-2023-49906
Published: 2024-04-09
Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `ssid` parameter at offset `0x0045ab7c` of the `httpd_portal` binary shipped with v5.1.0 Build 20220926 of the EAP225.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE: CVE-2023-49907
Published: 2024-04-09
Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `band` parameter at offset `0x0045aad8` of the `httpd_portal` binary shipped with v5.1.0 Build 20220926 of the EAP225.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE: CVE-2023-49908
Published: 2024-04-09
Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `profile` parameter at offset `0x0045abc8` of the `httpd_portal` binary shipped with v5.1.0 Build 20220926 of the EAP225.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE: CVE-2023-49909
Published: 2024-04-09
Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `action` parameter at offset `0x0045ab38` of the `httpd_portal` binary shipped with v5.1.0 Build 20220926 of the EAP225.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE: CVE-2023-49910
Published: 2024-04-09
Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `ssid` parameter at offset `0x42247c` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE: CVE-2023-49911
Published: 2024-04-09
Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `band` parameter at offset `0x422420` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE: CVE-2023-49912
Published: 2024-04-09
Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `profile` parameter at offset `0x4224b0` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE: CVE-2023-49913
Published: 2024-04-09
Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `action` parameter at offset `0x422448` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE: CVE-2024-21755
Published: 2024-04-09
Description: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-23-489; https://fortiguard.com/psirt/FG-IR-23-489
CVE: CVE-2024-21756
Published: 2024-04-09
Description: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-23-489; https://fortiguard.com/psirt/FG-IR-23-489
CVE: CVE-2024-23662
Published: 2024-04-09
Description: An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows attacker to information disclosure via HTTP requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://fortiguard.com/psirt/FG-IR-23-224; https://fortiguard.com/psirt/FG-IR-23-224
CVE: CVE-2024-23671
Published: 2024-04-09
Description: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://fortiguard.com/psirt/FG-IR-23-454; https://fortiguard.com/psirt/FG-IR-23-454
CVE: CVE-2024-31487
Published: 2024-04-09
Description: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions allows attacker to information disclosure via crafted http requests.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://fortiguard.com/psirt/FG-IR-24-060; https://fortiguard.com/psirt/FG-IR-24-060
CVE: CVE-2024-28235
Published: 2024-04-09
Description: Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed  options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
CVSS Score: 8.3 (HIGH)
CWE: CWE-200
References: https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler; https://github.com/contao/contao/blob/14e9ef4bc8b82936ba2d0e[PII_REDACTED]5a075e2a/core-bundle/src/Resources/contao/classes/Crawl.php#L129; https://github.com/contao/contao/commit/73a2770e2d3535ec9f1b03d54be00e56ebb8ff16
CVE: CVE-2024-31864
Published: 2024-04-09
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.

The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver.
This issue affects Apache Zeppelin: before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/04/09/8; https://github.com/apache/zeppelin/pull/4709; https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb
CVE: CVE-2024-31865
Published: 2024-04-09
Description: Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges.

This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2024/04/09/9; https://github.com/apache/zeppelin/pull/4631; https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l
CVE: CVE-2024-31866
Published: 2024-04-09
Description: Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116
References: http://www.openwall.com/lists/oss-security/2024/04/09/10; https://github.com/apache/zeppelin/pull/4715; https://lists.apache.org/thread/jpkbq3oktopt34x2n5wnhzc2r1410ddd
CVE: CVE-2024-31868
Published: 2024-04-09
Description: Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.

The attackers can modify helium.json and exposure XSS attacks to normal users.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/apache/zeppelin/pull/4728; https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11; http://www.openwall.com/lists/oss-security/2024/04/09/11
CVE: CVE-2024-3281
Published: 2024-04-09
Description: A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not properly restrict access to a resource from an unauthorized actor.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]8701-16/hpsbpy03929; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-003.txt; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]8701-16/hpsbpy03929
CVE: CVE-2024-20665
Published: 2024-04-09
Description: BitLocker Security Feature Bypass Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20665; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20665
CVE: CVE-2024-20669
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20669; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20669
CVE: CVE-2024-20670
Published: 2024-04-09
Description: Outlook for Windows Spoofing Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20670; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20670
CVE: CVE-2024-20678
Published: 2024-04-09
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20678; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20678
CVE: CVE-2024-20685
Published: 2024-04-09
Description: Azure Private 5G Core Denial of Service Vulnerability
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-130
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20685; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20685
CVE: CVE-2024-20688
Published: 2024-04-09
Description: Secure Boot Security Feature Bypass Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20688; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20688