deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-22364
Published: 2024-05-03
Description: IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.  IBM X-Force ID:  220903.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-350, CWE-290
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220903; https://www.ibm.com/support/pages/node/7149876; https://exchange.xforce.ibmcloud.com/vulnerabilities/220903
CVE: CVE-2022-33010
Published: 2024-05-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-40695
Published: 2024-05-03
Description: IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.  IBM X-Force ID:  264938.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/264938; https://www.ibm.com/support/pages/node/7149876; https://exchange.xforce.ibmcloud.com/vulnerabilities/264938
CVE: CVE-2024-34455
Published: 2024-05-03
Description: Buildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2024/05/06/2; http://www.openwall.com/lists/oss-security/2024/05/06/4; http://www.openwall.com/lists/oss-security/2024/05/07/4
CVE: CVE-2024-3868
Published: 2024-05-04
Description: The Folders Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's First Name and Last Name in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://premio.io/downloads/folders/; https://www.wordfence.com/threat-intel/vulnerabilities/id/daa48b64-6f89-40be-a31f-31d1481dfc91?source=cve; https://premio.io/downloads/folders/
CVE: CVE-2024-3237
Published: 2024-05-04
Description: The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function in all versions up to, and including, 3.5.25. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to true.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://www.convertplug.com/plus/product/convertplug/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd72420-dca1-455d-92a6-a178b4b26eab?source=cve; https://www.convertplug.com/plus/product/convertplug/
CVE: CVE-2024-3240
Published: 2024-05-04
Description: The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_info_bar' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.convertplug.com/plus/product/convertplug/; https://www.wordfence.com/threat-intel/vulnerabilities/id/fca3259b-bf0e-4b4a-815f-1eb399b8b674?source=cve; https://www.convertplug.com/plus/product/convertplug/
CVE: CVE-2024-34460
Published: 2024-05-04
Description: The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://zenar.io/zenario-9/blog/zenario-9560602-patch-released; https://zenar.io/zenario-9/blog/zenario-9560602-patch-released
CVE: CVE-2024-34461
Published: 2024-05-04
Description: Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://zenar.io/zenario-9/blog/zenario-9560437-patch-released; https://zenar.io/zenario-9/blog/zenario-9560437-patch-released
CVE: CVE-2023-7065
Published: 2024-05-04
Description: The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfs_process AJAX action. This makes it possible for unauthenticated attackers to add arbitrary IPs to the plugin's allowlist and blocklist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3080581%40stop-spammer-registrations-plugin&new=3080581%40stop-spammer-registrations-plugin&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1998cadb-2eb3-4819-aa7c-59e4f777c7f8?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3080581%40stop-spammer-registrations-plugin&new=3080581%40stop-spammer-registrations-plugin&sfp_email=&sfph_mail=
CVE: CVE-2024-1050
Published: 2024-05-04
Description: The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. CVE-2024-34815 is a duplicate of this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/force-reset-password.php#L64; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3077276%40import-users-from-csv-with-meta&new=3077276%40import-users-from-csv-with-meta&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d2fbd599-0a6c-4182-87d9-ad7cf3fb5865?source=cve
CVE: CVE-2023-27283
Published: 2024-05-04
Description: IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies.  IBM X-Force ID:  248545.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248545; https://www.ibm.com/support/pages/node/7150191; https://exchange.xforce.ibmcloud.com/vulnerabilities/248545
CVE: CVE-2024-34462
Published: 2024-05-04
Description: Alinto SOGo through 5.10.0 allows XSS during attachment preview.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Alinto/sogo/commit/2e37e59ed140d4aee0ff2fba579ca5f83f2c5920; https://github.com/Alinto/sogo/commit/2e37e59ed140d4aee0ff2fba579ca5f83f2c5920
CVE: CVE-2024-34467
Published: 2024-05-04
Description: ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/top-think/framework/issues/2996; https://github.com/top-think/framework/issues/2996
CVE: CVE-2024-34468
Published: 2024-05-04
Description: Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://forum.rukovoditel.net/viewtopic.php?t=5071; https://forum.rukovoditel.net/viewtopic.php?t=5071
CVE: CVE-2024-34469
Published: 2024-05-04
Description: Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://forum.rukovoditel.net/viewtopic.php?t=5071; https://forum.rukovoditel.net/viewtopic.php?t=5071
CVE: CVE-2023-52729
Published: 2024-05-04
Description: TCPServer.cpp in SimpleNetwork through 29bc615 has an off-by-one error that causes a buffer overflow when trying to add '\0' to the end of long msg data. It can be exploited via crafted TCP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/kashimAstro/SimpleNetwork/issues/23; https://github.com/kashimAstro/SimpleNetwork/issues/23
CVE: CVE-2024-34473
Published: 2024-05-04
Description: An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message type during xApp registration to disrupt other service components.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://jira.o-ran-sc.org/browse/RIC-1055; https://jira.o-ran-sc.org/browse/RIC-1055
CVE: CVE-2024-34475
Published: 2024-05-05
Description: Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authentication in amf/gmm-sm.c for != OGS_ERROR.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/open5gs/open5gs/compare/v2.7.0...v2.7.1; https://github.com/open5gs/open5gs/pull/3122; https://github.com/open5gs/open5gs/compare/v2.7.0...v2.7.1
CVE: CVE-2024-34476
Published: 2024-05-05
Description: Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs_nas_encrypt in lib/nas/common/security.c for pkbuf->len.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-805
References: https://github.com/open5gs/open5gs/compare/v2.7.0...v2.7.1; https://github.com/open5gs/open5gs/pull/3122; https://github.com/open5gs/open5gs/compare/v2.7.0...v2.7.1
CVE: CVE-2024-4491
Published: 2024-05-05
Description: A vulnerability classified as critical was found in Tenda i21 1.0.0.14(4656). This vulnerability affects the function formGetDiagnoseInfo. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263080. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formGetDiagnoseInfo.md; https://vuldb.com/?ctiid.263080; https://vuldb.com/?id.263080
CVE: CVE-2024-34478
Published: 2024-05-05
Description: btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-436
References: https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455; https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3; https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3
CVE: CVE-2024-4492
Published: 2024-05-05
Description: A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). This issue affects the function formOfflineSet of the file /goform/setStaOffline. The manipulation of the argument GO/ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263081 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formOfflineSet.md; https://vuldb.com/?ctiid.263081; https://vuldb.com/?id.263081
CVE: CVE-2024-34483
Published: 2024-05-05
Description: OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPBucket.len=0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/faucetsdn/ryu/issues/193; https://github.com/faucetsdn/ryu/issues/193
CVE: CVE-2024-34484
Published: 2024-05-05
Description: OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via action.len=0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-835
References: https://github.com/faucetsdn/ryu/issues/194; https://github.com/faucetsdn/ryu/issues/194
CVE: CVE-2024-34486
Published: 2024-05-05
Description: OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-606
References: https://github.com/faucetsdn/ryu/issues/190; https://github.com/faucetsdn/ryu/issues/190
CVE: CVE-2024-34487
Published: 2024-05-05
Description: OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/faucetsdn/ryu/issues/192; https://github.com/faucetsdn/ryu/issues/192
CVE: CVE-2024-34488
Published: 2024-05-05
Description: OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/faucetsdn/ryu/issues/191; https://github.com/faucetsdn/ryu/issues/191
CVE: CVE-2024-34489
Published: 2024-05-05
Description: OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/faucetsdn/ryu/issues/195; https://github.com/faucetsdn/ryu/issues/195
CVE: CVE-2024-34490
Published: 2024-05-05
Description: In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attacker who can create files in advance with these names. This affects, for example, plot2d.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-377
References: https://sourceforge.net/p/maxima/bugs/3755/; https://sourceforge.net/p/maxima/bugs/3755/
CVE: CVE-2024-4493
Published: 2024-05-05
Description: A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). Affected is the function formSetAutoPing. The manipulation of the argument ping1/ping2 leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263082 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formSetAutoPing.md; https://vuldb.com/?ctiid.263082; https://vuldb.com/?id.263082
CVE: CVE-2024-4494
Published: 2024-05-05
Description: A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical. Affected by this vulnerability is the function formSetUplinkInfo of the file /goform/setUplinkInfo. The manipulation of the argument pingHostIp2 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263083. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formSetUplinkInfo.md; https://vuldb.com/?ctiid.263083; https://vuldb.com/?id.263083
CVE: CVE-2024-4495
Published: 2024-05-05
Description: A vulnerability was found in Tenda i21 1.0.0.14(4656) and classified as critical. Affected by this issue is the function formWifiMacFilterGet. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263084. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formWifiMacFilterGet.md; https://vuldb.com/?ctiid.263084; https://vuldb.com/?id.263084
CVE: CVE-2024-4496
Published: 2024-05-05
Description: A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been classified as critical. This affects the function formWifiMacFilterSet. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263085 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formWifiMacFilterSet.md; https://vuldb.com/?ctiid.263085; https://vuldb.com/?id.263085
CVE: CVE-2024-4497
Published: 2024-05-05
Description: A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been declared as critical. This vulnerability affects the function formexeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263086 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formexeCommand.md; https://vuldb.com/?ctiid.263086; https://vuldb.com/?id.263086
CVE: CVE-2024-34474
Published: 2024-05-05
Description: Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://clario.co/download/; https://github.com/Alaatk/CVE-2024-34474; https://clario.co/download/
CVE: CVE-2024-4500
Published: 2024-05-05
Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Employee/edit-photo.php. The manipulation of the argument userImage leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263104.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/yylmm/CVE/blob/main/Prison%20Management%20System/file_upload.md; https://vuldb.com/?ctiid.263104; https://vuldb.com/?id.263104
CVE: CVE-2024-34500
Published: 2024-05-05
Description: An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UnlinkedWikibase/+/1002175; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/; https://phabricator.wikimedia.org/T357203
CVE: CVE-2024-34502
Published: 2024-05-05
Description: An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-352
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikibaseLexeme/+/1013359; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/; https://phabricator.wikimedia.org/T357101
CVE: CVE-2024-34506
Published: 2024-05-05
Description: An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the maximum request time, leading to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/; https://phabricator.wikimedia.org/T357760; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE: CVE-2024-34507
Published: 2024-05-05
Description: An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000.
CVSS Score: 7.4 (HIGH)
CWE: CWE-80
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/; https://phabricator.wikimedia.org/T355538; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE: CVE-2024-34508
Published: 2024-05-05
Description: dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca01f5; https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html; https://support.dcmtk.org/redmine/issues/1114
CVE: CVE-2024-34509
Published: 2024-05-05
Description: dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca01f5; https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html; https://support.dcmtk.org/redmine/issues/1114
CVE: CVE-2024-34510
Published: 2024-05-05
Description: Gradio before 4.20 allows credential leakage on Windows.
CVSS Score: 7.5 (HIGH)
CWE: CWE-116
References: https://github.com/gradio-app/gradio/; https://www.gradio.app/changelog#4-20-0; https://github.com/gradio-app/gradio/
CVE: CVE-2024-34511
Published: 2024-05-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1561. Reason: This candidate is a duplicate of CVE-2024-1561. Notes: All CVE users should reference CVE-2024-1561 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.