deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-50207
Published: 2024-11-08
Description: In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix reader locking when changing the sub buffer order

The function ring_buffer_subbuf_order_set() updates each
ring_buffer_per_cpu and installs new sub buffers that match the requested
page order. This operation may be invoked concurrently with readers that
rely on some of the modified data, such as the head bit (RB_PAGE_HEAD), or
the ring_buffer_per_cpu.pages and reader_page pointers. However, no
exclusive access is acquired by ring_buffer_subbuf_order_set(). Modifying
the mentioned data while a reader also operates on them can then result in
incorrect memory access and various crashes.

Fix the problem by taking the reader_lock when updating a specific
ring_buffer_per_cpu in ring_buffer_subbuf_order_set().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/09661f75e75cb6c1d2d8326a70c311d46729235f; https://git.kernel.org/stable/c/a569290525a05162d5dd26d9845591eaf46e5802
CVE: CVE-2024-50208
Published: 2024-11-08
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages

Avoid memory corruption while setting up Level-2 PBL pages for the non MR
resources when num_pages > 256K.

There will be a single PDE page address (contiguous pages in the case of >
PAGE_SIZE), but, current logic assumes multiple pages, leading to invalid
memory access after 256K PBL entries in the PDE.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/7988bdbbb85ac85a847baf09879edcd0f70521dc; https://git.kernel.org/stable/c/87cb3b0054e53e0155b630bdf8fb714ded62565f; https://git.kernel.org/stable/c/daac56dd98e1ba814c878ac0acd482a37f2ab94b
CVE: CVE-2024-50209
Published: 2024-11-08
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Add a check for memory allocation

__alloc_pbl() can return error when memory allocation fails.
Driver is not checking the status on one of the instances.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/322a19baaaa25a1fe8ce9fceaed9409ad847844c; https://git.kernel.org/stable/c/76dd679c3b148d23f72dcf6c3cde3d5f746b2c07; https://git.kernel.org/stable/c/ba9045887b435a4c5551245ae034b8791b4e4aaa
CVE: CVE-2024-50210
Published: 2024-11-08
Description: In the Linux kernel, the following vulnerability has been resolved:

posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()

If get_clock_desc() succeeds, it calls fget() for the clockid's fd,
and get the clk->rwsem read lock, so the error path should release
the lock to make the lock balance and fput the clockid's fd to make
the refcount balance and release the fd related resource.

However the below commit left the error path locked behind resulting in
unbalanced locking. Check timespec64_valid_strict() before
get_clock_desc() to fix it, because the "ts" is not changed
after that.

[pabeni@redhat.com: fixed commit message typo]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/1ba33b327c3f88a7baee598979d73ab5b44d41cc; https://git.kernel.org/stable/c/5f063bbf1ee6b01611c016b54e050a41506eb794; https://git.kernel.org/stable/c/6e62807c7fbb3c758d233018caf94dfea9c65dbd
CVE: CVE-2024-50211
Published: 2024-11-08
Description: In the Linux kernel, the following vulnerability has been resolved:

udf: refactor inode_bmap() to handle error

Refactor inode_bmap() to handle error since udf_next_aext() can return
error now. On situations like ftruncate, udf_extend_file() can now
detect errors and bail out early without resorting to checking for
particular offsets and assuming internal behavior of these functions.
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/493447dd8336607fce426f7879e581095f6c606e; https://git.kernel.org/stable/c/b22d9a5698abf04341f8fbc30141e0673863c3a6; https://git.kernel.org/stable/c/c226964ec786f3797ed389a16392ce4357697d24
CVE: CVE-2024-7982
Published: 2024-11-08
Description: The Registrations for the Events Calendar  WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d79e1e9c-980d-4974-bfbd-d87d6e28d9a6/
CVE: CVE-2024-10269
Published: 2024-11-08
Description: The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3181757/; https://wordpress.org/plugins/easy-svg/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbc0866-1e9d-457a-8ef3-fb046c89c1dd?source=cve
CVE: CVE-2024-10995
Published: 2024-11-08
Description: A vulnerability was found in Codezips Hospital Appointment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /removeDoctorResult.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Hacker0xone/CVE/issues/2; https://vuldb.com/?ctiid.283460; https://vuldb.com/?id.283460
CVE: CVE-2024-10996
Published: 2024-11-08
Description: A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/process_category_edit.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ppp-src/CVE/issues/32; https://vuldb.com/?ctiid.283461; https://vuldb.com/?id.283461
CVE: CVE-2024-10997
Published: 2024-11-08
Description: A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /book_list.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Sy0ung-cmd/CVE/blob/main/vendors/1000projects/bookstore-management-system/SQLi-1.md; https://vuldb.com/?ctiid.283462; https://vuldb.com/?id.283462
CVE: CVE-2024-10998
Published: 2024-11-08
Description: A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/process_category_add.php. The manipulation of the argument cat leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/090913/CVE/issues/1; https://vuldb.com/?ctiid.283463; https://vuldb.com/?id.283463
CVE: CVE-2024-10999
Published: 2024-11-08
Description: A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /aboutadd.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://codeastro.com/; https://github.com/EmilGallajov/zero-day/blob/main/codeastro_real_estate_ms_authenticated_rce.md; https://vuldb.com/?ctiid.283464
CVE: CVE-2024-11000
Published: 2024-11-08
Description: A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aboutedit.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://codeastro.com/; https://github.com/EmilGallajov/zero-day/blob/main/codeastro_real_estate_ms_authenticated_rce.md; https://vuldb.com/?ctiid.283465
CVE: CVE-2024-24409
Published: 2024-11-08
Description: Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2024-24409.html
CVE: CVE-2024-50588
Published: 2024-11-08
Description: An unauthenticated attacker with access to the local network of the 
medical office can use known default credentials to gain remote DBA 
access to the Elefant Firebird database. The data in the database 
includes patient data and login credentials among other sensitive data. 
In addition, this enables an attacker to create and overwrite arbitrary 
files on the server filesystem with the rights of the Firebird database 
("NT AUTHORITY\SYSTEM").
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-419, CWE-1393
References: https://hasomed.de/produkte/elefant/; https://r.sec-consult.com/hasomed; http://seclists.org/fulldisclosure/2024/Nov/3
CVE: CVE-2024-10187
Published: 2024-11-08
Description: The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_link shortcode in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3183178/; https://wordpress.org/plugins/mycred/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/23a081d4-443d-4b3b-8c89-9eb0e23c961e?source=cve
CVE: CVE-2024-10839
Published: 2024-11-08
Description: Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.
CVSS Score: 8.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.manageengine.com/sharepoint-management-reporting/advisory/CVE-2024-10839.html
CVE: CVE-2024-10325
Published: 2024-11-08
Description: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3182862/; https://wordpress.org/plugins/header-footer-elementor/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/7773fd3a-2417-415e-97b0-735e99e62097?source=cve
CVE: CVE-2024-50589
Published: 2024-11-08
Description: An unauthenticated attacker with access to the local network of the 
medical office can query an unprotected Fast Healthcare Interoperability
 Resources (FHIR) API to get access to sensitive electronic health 
records (EHR).
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://hasomed.de/produkte/elefant/; https://r.sec-consult.com/hasomed; http://seclists.org/fulldisclosure/2024/Nov/3
CVE: CVE-2024-50590
Published: 2024-11-08
Description: Attackers with local access to the medical office computer can 
escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by 
overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is 
writable for all users. In addition, the Elefant installer registers two
 Firebird database services which are running as “NT AUTHORITY\SYSTEM”. 

Path: C:\Elefant1\Firebird_2\bin\fbserver.exe

Path: C:\Elefant1\Firebird_2\bin\fbguard.exe


Both service binaries are user writable. This means that a local 
attacker can rename one of the service binaries, replace the service 
executable with a new executable, and then restart the system. Once the 
system has rebooted, the new service binary is executed as "NT 
AUTHORITY\SYSTEM".
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-276, CWE-732
References: https://hasomed.de/produkte/elefant/; https://r.sec-consult.com/hasomed; http://seclists.org/fulldisclosure/2024/Nov/3
CVE: CVE-2024-50591
Published: 2024-11-08
Description: An attacker with local access the to medical office computer can 
escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by 
exploiting a command injection vulnerability in the Elefant Update 
Service. The command injection can be exploited by communicating with 
the Elefant Update Service which is running as "SYSTEM" via Windows 
Named Pipes.The Elefant Software Updater (ESU) consists of two components. An ESU
 service which runs as "NT AUTHORITY\SYSTEM" and an ESU tray client 
which communicates with the service to update or repair the installation
 and is running with user permissions. The communication is implemented 
using named pipes. A crafted message of type 
"MessageType.SupportServiceInfos" can be sent to the local ESU service 
to inject commands, which are then executed as "NT AUTHORITY\SYSTEM".
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://hasomed.de/produkte/elefant/; https://r.sec-consult.com/hasomed; http://seclists.org/fulldisclosure/2024/Nov/3
CVE: CVE-2024-50593
Published: 2024-11-08
Description: An attacker with local access to the medical office computer can 
access restricted functions of the Elefant Service tool by using a 
hard-coded "Hotline" password in the Elefant service binary, which is shipped with the software.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://hasomed.de/produkte/elefant/; https://r.sec-consult.com/hasomed; http://seclists.org/fulldisclosure/2024/Nov/3
CVE: CVE-2024-50592
Published: 2024-11-08
Description: An attacker with local access the to medical office computer can 
escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by 
exploiting a race condition in the Elefant Update Service during the 
repair or update process. When using the repair function, the service queries the server for a 
list of files and their hashes. In addition, instructions to execute 
binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are 
copied over to the user writable installation folder (C:\Elefant1). This
 means that a user can overwrite either "PostESUUpdate.exe" or 
"Update_OpenJava.exe" in the time frame after the copy and before the 
execution of the final repair step. The overwritten executable is then executed as "NT AUTHORITY\SYSTEM".
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://hasomed.de/produkte/elefant/; https://r.sec-consult.com/hasomed; http://seclists.org/fulldisclosure/2024/Nov/3
CVE: CVE-2024-50378
Published: 2024-11-08
Description: Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-201
References: https://github.com/apache/airflow/pull/43123; https://lists.apache.org/thread/17rxys384lzfd6nhm3fztzgvk47zy7jb; http://www.openwall.com/lists/oss-security/2024/11/08/5
CVE: CVE-2024-45764
Published: 2024-11-08
Description: Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This is a critical severity vulnerability so Dell recommends customers to upgrade at the earliest opportunity.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-304
References: https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities
CVE: CVE-2024-45765
Published: 2024-11-08
Description: Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. This is a critical severity vulnerability as it allows high privilege OS commands to be executed with a less privileged role; so Dell recommends customers to upgrade at the earliest opportunity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities
CVE: CVE-2024-46947
Published: 2024-11-08
Description: Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://mender.io/blog/cve-2024-46947-cve-2024-47190-ssrf-issues-in-mender-enterprise-server
CVE: CVE-2024-46948
Published: 2024-11-08
Description: Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mender.io/blog/cve-2024-46948
CVE: CVE-2024-47190
Published: 2024-11-08
Description: Northern.tech Hosted Mender before 2024.07.11 allows SSRF.
CVSS Score: 2.7 (LOW)
CWE: CWE-918
References: https://mender.io/blog/cve-2024-46947-cve-2024-47190-ssrf-issues-in-mender-enterprise-server
CVE: CVE-2024-50966
Published: 2024-11-08
Description: dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-352
References: https://github.com/evenomn/YangYiWen/tree/main/11
CVE: CVE-2024-25431
Published: 2024-11-08
Description: An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file to the check_was_abi_compatibility function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://gist.github.com/haruki3hhh/bd228e6dcaf8c18140e[PII_REDACTED]b39; https://github.com/bytecodealliance/wasm-micro-runtime/issues/3122; https://github.com/bytecodealliance/wasm-micro-runtime/pull/3126
CVE: CVE-2024-45763
Published: 2024-11-08
Description: Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. This is a critical severity vulnerability so Dell recommends customers to upgrade at the earliest opportunity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities
CVE: CVE-2024-50634
Published: 2024-11-08
Description: A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319
References: https://github.com/yamerooo123/CVE/tree/main/CVE-2024-50634; https://youtu.be/wnULru0WdtA
CVE: CVE-2024-40239
Published: 2024-11-08
Description: An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.
CVSS Score: 6.8 (MEDIUM)
References: https://play.google.com/store/apps/details?id=com.hitbytes.minidiarynotes; https://zzzxiin.github.io/post/life-personal-diary/
CVE: CVE-2024-40240
Published: 2024-11-08
Description: An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.
CVSS Score: 6.8 (MEDIUM)
References: http://homeserve.com; https://apkpure.com/homeserve-home-repair/com.homeserveapp.homeserve; https://zzzxiin.github.io/post/homeserve/
CVE: CVE-2024-51030
Published: 2024-11-08
Description: A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, leading to unauthorized access and potential compromise of sensitive data within the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/vighneshnair7/CVE-2024-51030; https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html
CVE: CVE-2024-51031
Published: 2024-11-08
Description: A Cross-site Scripting (XSS) vulnerability in manage_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "First Name," "Middle Name," and "Last Name" fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/vighneshnair7/CVE-2024-51031; https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html
CVE: CVE-2024-51032
Published: 2024-11-08
Description: A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "owner" input field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Shree-Chandragiri/CVE-2024-51032; https://www.sourcecodester.com/php/15304/toll-tax-management-system-phpoop-free-source-code.html
CVE: CVE-2024-51152
Published: 2024-11-08
Description: File Upload vulnerability in Laravel CMS v.1.4.7 and before allows a remote attacker to execute arbitrary code via the shell.php a component.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://co-a1natas.feishu.cn/docx/GuYjd2lDEoxNhVxPa9Yc1akknee
CVE: CVE-2024-9841
Published: 2024-11-08
Description: A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://portal.microfocus.com/s/article/KM000035977
CVE: CVE-2024-44765
Published: 2024-11-08
Description: An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://mgt-commerce.com; https://github.com/EagleTube/CloudPanel/tree/main/CVE-2024-44765