deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-11727
Published: 2024-12-12
Description: The NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content settings for notifications in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3205560/notificationx/trunk/includes/FrontEnd/Preview.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/338edb1d-101a-4b6e-ac25-b59bd3e17f8b?source=cve
CVE: CVE-2024-12201
Published: 2024-12-12
Description: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3205245%40hash-form&new=3205245%40hash-form&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/bb81b2ce-583b-411c-b0f5-a233e0d1986b?source=cve
CVE: CVE-2024-12312
Published: 2024-12-12
Description: The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untrusted input through the 'designer-saved-projects' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/print-science-designer/tags/1.3.152/includes/saved-projects.php#L120; https://plugins.trac.wordpress.org/browser/print-science-designer/tags/1.3.153/includes/saved-projects.php#L120; https://www.wordfence.com/threat-intel/vulnerabilities/id/8008b5e2-f3b4-492c-8e50-b673f725b2b1?source=cve
CVE: CVE-2024-12329
Published: 2024-12-12
Description: The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204549%40essential-real-estate&new=3204549%40essential-real-estate&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/fa5b1bf3-344e-4ae6-87b9-2dcaafd417a5?source=cve
CVE: CVE-2024-12564
Published: 2024-12-12
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things about the target application which may help in further investigation and exploitation.
CWE: CWE-200, CWE-276, CWE-732
References: https://www.opendesign.com/security-advisories
CVE: CVE-2024-11760
Published: 2024-12-12
Description: The Currency Converter Widget ⚡ PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'currency-converter-widget-pro' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206549%40currency-converter-widget-pro&new=3206549%40currency-converter-widget-pro&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4f9a0341-5479-4b83-8ce8-eb838a34a448?source=cve
CVE: CVE-2024-12160
Published: 2024-12-12
Description: The Seraphinite Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/seraphinite-discount-for-woocommerce/trunk/Cmn/Plugin.php#L1060; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206551%40seraphinite-discount-for-woocommerce&new=3206551%40seraphinite-discount-for-woocommerce&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/bd748b6c-110a-46b6-a609-64d093dfc3e5?source=cve
CVE: CVE-2024-12333
Published: 2024-12-12
Description: The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_instagram_ajax_query AJAX action. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492; https://www.wordfence.com/threat-intel/vulnerabilities/id/1caa8baa-0783-4bc9-af03-46a3a2cf3538?source=cve
CVE: CVE-2024-12397
Published: 2024-12-12
Description: A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with
certain value-delimiting characters in incoming requests. This issue could
allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie
values or spoof arbitrary additional cookie values, leading to unauthorized
data access or modification. The main threat from this flaw impacts data
confidentiality and integrity.
CVSS Score: 7.4 (HIGH)
CWE: CWE-444
References: https://access.redhat.com/errata/RHSA-2025:0900; https://access.redhat.com/errata/RHSA-2025:3018; https://access.redhat.com/errata/RHSA-2025:8761
CVE: CVE-2024-12401
Published: 2024-12-12
Description: A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/security/cve/CVE-2024-12401; https://bugzilla.redhat.com/show_bug.cgi?id=2327929; https://github.com/cert-manager/cert-manager/pull/7400
CVE: CVE-2024-21574
Published: 2024-12-12
Description: The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://github.com/ltdrdata/ComfyUI-Manager/blob/ffc095a3e5acc1c404773a0510e6d055a6a72b0e/glob/manager_server.py#L798; https://github.com/ltdrdata/ComfyUI-Manager/commit/ffc095a3e5acc1c404773a0510e6d055a6a72b0e
CVE: CVE-2024-4109
Published: 2024-12-12
Description: Rejected reason: Red Hat Product Security has determined that this CVE is not a security vulnerability.
CVE: CVE-2024-10043
Published: 2024-12-12
Description: An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/499577; https://hackerone.com/reports/2774817
CVE: CVE-2024-11274
Published: 2024-12-12
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration.
CVSS Score: 8.7 (HIGH)
CWE: CWE-601
References: https://gitlab.com/gitlab-org/gitlab/-/issues/504707; https://hackerone.com/reports/2813673
CVE: CVE-2024-12292
Published: 2024-12-12
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-532
References: https://gitlab.com/gitlab-org/gitlab/-/issues/475211
CVE: CVE-2024-12570
Published: 2024-12-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2. It may have been possible for an attacker with a victim's `CI_JOB_TOKEN` to obtain a GitLab session token belonging to the victim.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-270
References: https://gitlab.com/gitlab-org/gitlab/-/issues/494694; https://hackerone.com/reports/2724948
CVE: CVE-2024-54096
Published: 2024-12-12
Description: Vulnerability of improper access control in the MTP module
Impact: Successful exploitation of this vulnerability may affect integrity and accuracy.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54097
Published: 2024-12-12
Description: Security vulnerability in the HiView module
Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity.
CVSS Score: 7.3 (HIGH)
CWE: CWE-15
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54098
Published: 2024-12-12
Description: Service logic error vulnerability in the system service module
Impact: Successful exploitation of this vulnerability may affect service integrity.
CVSS Score: 8.5 (HIGH)
CWE: CWE-840
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54099
Published: 2024-12-12
Description: File replacement vulnerability on some devices
Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-552
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54100
Published: 2024-12-12
Description: Vulnerability of improper access control in the secure input module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54101
Published: 2024-12-12
Description: Denial of service (DoS) vulnerability in the installation module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54102
Published: 2024-12-12
Description: Race condition vulnerability in the DDR module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54103
Published: 2024-12-12
Description: Vulnerability of improper access control in the album module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54104
Published: 2024-12-12
Description: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54105
Published: 2024-12-12
Description: Read/Write vulnerability in the image decoding module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54106
Published: 2024-12-12
Description: Null pointer dereference vulnerability in the image decoding module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-248, CWE-476
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54107
Published: 2024-12-12
Description: Read/Write vulnerability in the image decoding module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54108
Published: 2024-12-12
Description: Read/Write vulnerability in the image decoding module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54109
Published: 2024-12-12
Description: Read/Write vulnerability in the image decoding module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54110
Published: 2024-12-12
Description: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1021
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54111
Published: 2024-12-12
Description: Read/Write vulnerability in the image decoding module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-345
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54112
Published: 2024-12-12
Description: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1021
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54113
Published: 2024-12-12
Description: Process residence vulnerability in abnormal scenarios in the print module
Impact: Successful exploitation of this vulnerability may affect power consumption.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54114
Published: 2024-12-12
Description: Out-of-bounds access vulnerability in playback in the DASH module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-754, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54115
Published: 2024-12-12
Description: Out-of-bounds read vulnerability in the DASH module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-754, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54116
Published: 2024-12-12
Description: Out-of-bounds read vulnerability in the M3U8 module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-754, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54117
Published: 2024-12-12
Description: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-8179
Published: 2024-12-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. Improper output encoding could lead to XSS if CSP is not enabled.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/480718; https://hackerone.com/reports/2665929
CVE: CVE-2024-8233
Published: 2024-12-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause a denial of service with requests for diff files on a commit or merge request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407
References: https://gitlab.com/gitlab-org/gitlab/-/issues/480867; https://hackerone.com/reports/2650086
CVE: CVE-2024-8647
Published: 2024-12-12
Description: An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://gitlab.com/gitlab-org/gitlab/-/issues/486051; https://hackerone.com/reports/2666341
CVE: CVE-2024-9367
Published: 2024-12-12
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while parsing templates to generate changelogs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/496631; https://hackerone.com/reports/2735311
CVE: CVE-2024-9387
Published: 2024-12-12
Description: An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-601
References: https://gitlab.com/gitlab-org/gitlab/-/issues/496659; https://hackerone.com/reports/2732235
CVE: CVE-2024-12271
Published: 2024-12-12
Description: The 360 Javascript Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ref’ parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/360deg-javascript-viewer/trunk/includes/class-jsv-360-parser.php#L129; https://plugins.trac.wordpress.org/browser/360deg-javascript-viewer/trunk/includes/class-jsv-360-parser.php#L162; https://plugins.trac.wordpress.org/changeset/3206400/
CVE: CVE-2024-28142
Published: 2024-12-12
Description: Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File Name" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the "file name" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins.









This attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the "Default" User can be changed.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://r.sec-consult.com/imageaccess; https://www.imageaccess.de/?page=SupportPortal&lang=en; http://seclists.org/fulldisclosure/2024/Dec/2
CVE: CVE-2024-36494
Published: 2024-12-12
Description: Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://r.sec-consult.com/imageaccess; https://www.imageaccess.de/?page=SupportPortal&lang=en; http://seclists.org/fulldisclosure/2024/Dec/2
CVE: CVE-2024-36498
Published: 2024-12-12
Description: Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL









https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre

The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. Version 7.40 implemented a fix, but it could be bypassed via URL-encoding the Javascript payload again.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://r.sec-consult.com/imageaccess; https://www.imageaccess.de/?page=SupportPortal&lang=en; http://seclists.org/fulldisclosure/2024/Dec/2
CVE: CVE-2024-47947
Published: 2024-12-12
Description: Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL









https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre

The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://r.sec-consult.com/imageaccess; https://www.imageaccess.de/?page=SupportPortal&lang=en; http://seclists.org/fulldisclosure/2024/Dec/2
CVE: CVE-2024-54118
Published: 2024-12-12
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-54119
Published: 2024-12-12
Description: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2024/12/
CVE: CVE-2024-54122
Published: 2024-12-12
Description: Concurrent variable access vulnerability in the ability module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2024/12/