deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4679
Published: 2024-07-02
Description: Incorrect Default Permissions vulnerability in Hitachi JP1/Extensible SNMP Agent for Windows, Hitachi JP1/Extensible SNMP Agent on Windows, Hitachi Job Management Partner1/Extensible SNMP Agent on Windows allows File Manipulation.This issue affects JP1/Extensible SNMP Agent for Windows: from 12-00 before 12-00-01, from 11-00 through 11-00-*; JP1/Extensible SNMP Agent: from 10-10 through 10-10-01, from 10-00 through 10-00-02, from 09-00 through 09-00-04; Job Management Partner1/Extensible SNMP Agent: from 10-10 through 10-10-01, from 10-00 through 10-00-02, from 09-00 through 09-00-04.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-127/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-127/index.html
CVE: CVE-2024-5938
Published: 2024-07-02
Description: The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://themes.trac.wordpress.org/browser/boot-store/1.6.4/admin/bootstrap-shortcode.php#L63; https://www.wordfence.com/threat-intel/vulnerabilities/id/8256b8e4-f8c5-4feb-b6e4-668ed3b6fccd?source=cve; https://themes.trac.wordpress.org/browser/boot-store/1.6.4/admin/bootstrap-shortcode.php#L63
CVE: CVE-2024-5419
Published: 2024-07-02
Description: The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_redirect_page' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/cf7-widget-elementor/tags/2.4/widgets/void-section-cf7.php#L1672; https://plugins.trac.wordpress.org/changeset/3109802/#file6; https://www.wordfence.com/threat-intel/vulnerabilities/id/2837c9b2-419e-453a-b011-5ec1ef050d62?source=cve
CVE: CVE-2024-5349
Published: 2024-07-02
Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'map_style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset/3108501/lastudio-element-kit/trunk/includes/addons/google-maps.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/2e29a67b-2b67-4cd5-a5ae-a931900c75cd?source=cve; https://plugins.trac.wordpress.org/changeset/3108501/lastudio-element-kit/trunk/includes/addons/google-maps.php
CVE: CVE-2024-1427
Published: 2024-07-02
Description: The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the section title tag attribute in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/the-post-grid/tags/7.4.2/app/Helpers/Fns.php#L1051; https://plugins.trac.wordpress.org/changeset/3080313/#file347; https://www.wordfence.com/threat-intel/vulnerabilities/id/fc870ce5-1352-43f2-b80b-45065ceed750?source=cve
CVE: CVE-2024-3999
Published: 2024-07-02
Description: The EazyDocs  WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6a8a1deb-6836-40f1-856b-7b3e4ba867d6/; https://wpscan.com/vulnerability/6a8a1deb-6836-40f1-856b-7b3e4ba867d6/
CVE: CVE-2024-4627
Published: 2024-07-02
Description: The Rank Math SEO  WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings (by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO  WordPress plugin before 1.0.219) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c0058fcc-36f6-40bf-9848-fbe2d751d754/; https://wpscan.com/vulnerability/c0058fcc-36f6-40bf-9848-fbe2d751d754/
CVE: CVE-2024-5606
Published: 2024-07-02
Description: The Quiz and Survey Master (QSM)  WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/e3eee6bc-1f69-4be1-b323-0c9b5fe7535e/; https://wpscan.com/vulnerability/e3eee6bc-1f69-4be1-b323-0c9b5fe7535e/
CVE: CVE-2024-5767
Published: 2024-07-02
Description: The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/e4ba26b4-5f4f-4c9e-aa37-885b30ef8088/; https://wpscan.com/vulnerability/e4ba26b4-5f4f-4c9e-aa37-885b30ef8088/
CVE: CVE-2024-0158
Published: 2024-07-02
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability to modify a UEFI variable, leading to denial of service and escalation of privileges
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: https://www.dell.com/support/kbdoc/en-in/000220141/dsa-2024-030-security-update-for-dell-client-bios-for-an-improper-input-validation-vulnerability; https://www.dell.com/support/kbdoc/en-in/000220141/dsa-2024-030-security-update-for-dell-client-bios-for-an-improper-input-validation-vulnerability
CVE: CVE-2024-32852
Published: 2024-07-02
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network malicious attacker could potentially exploit this vulnerability, leading to data leaks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-32853
Published: 2024-07-02
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-250
References: https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-32854
Published: 2024-07-02
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to privilege escalation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-5219
Published: 2024-07-02
Description: The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 1.11.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/google-maps-easy/tags/1.11.15/modules/icons/mod.php; https://plugins.trac.wordpress.org/changeset/3105921/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4af9c623-1539-4afc-9dcd-3f97d29aa4f3?source=cve
CVE: CVE-2024-6172
Published: 2024-07-02
Description: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37252 appears to be a duplicate of this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/includes/db/class-es-db-contacts.php#L834; https://plugins.trac.wordpress.org/changeset/3107964/email-subscribers#file4; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3107964%40email-subscribers%2Ftrunk&old=3104864%40email-subscribers%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-41917
Published: 2024-07-02
Description: Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2023-41918
Published: 2024-07-02
Description: A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2023-41919
Published: 2024-07-02
Description: Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2023-41920
Published: 2024-07-02
Description: The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2023-41921
Published: 2024-07-02
Description: A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-494
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2023-41922
Published: 2024-07-02
Description: A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation, resulting in multiple instances of Stored XSS vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2023-41923
Published: 2024-07-02
Description: The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.
CVSS Score: 7.2 (HIGH)
CWE: CWE-521
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2023-41926
Published: 2024-07-02
Description: The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2023-41927
Published: 2024-07-02
Description: The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2023-41928
Published: 2024-07-02
Description: The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273; https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE: CVE-2024-37126
Published: 2024-07-02
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to unauthorized gain of root-level access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-37132
Published: 2024-07-02
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an incorrect privilege assignment vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service and Elevation of privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-266
References: https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-37133
Published: 2024-07-02
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to unauthorized gain of root-level access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-37134
Published: 2024-07-02
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potentially exploit this vulnerability to gain root-level access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-266
References: https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-37479
Published: 2024-07-02
Description: Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "progress_type" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-38857
Published: 2024-07-02
Description: Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://checkmk.com/werk/17059; https://checkmk.com/werk/17059
CVE: CVE-2024-3513
Published: 2024-07-02
Description: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag (postTitleTag) parameter in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-6362 appears to be a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3108401%40ultimate-blocks%2Ftrunk&old=3102541%40ultimate-blocks%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/428b4d6b-a4db-4e60-8c15-24efdfe6aea1?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3108401%40ultimate-blocks%2Ftrunk&old=3102541%40ultimate-blocks%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-5504
Published: 2024-07-02
Description: The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within the plugin's Writing Effect Headline widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/rife-elementor-extensions/trunk/includes/elementor/widgets/writing-effect-headline.php#L264; https://plugins.trac.wordpress.org/changeset/3109903/#file1; https://wordpress.org/plugins/rife-elementor-extensions/#developers
CVE: CVE-2024-5544
Published: 2024-07-02
Description: The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3110092/; https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0c34d3-5c7d-43a5-9430-2ebdc155123f?source=cve; https://plugins.trac.wordpress.org/changeset/3110092/
CVE: CVE-2024-5545
Published: 2024-07-02
Description: The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stm_edit_delete_user_car function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpublish arbitrary posts and pages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3106579%40motors-car-dealership-classified-listings%2Ftrunk&old=3101090%40motors-car-dealership-classified-listings%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/62731e0e-8843-4f79-b887-c595fbefae26?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3106579%40motors-car-dealership-classified-listings%2Ftrunk&old=3101090%40motors-car-dealership-classified-listings%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-31071
Published: 2024-07-02
Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion.
CVSS Score: 3.3 (LOW)
CWE: CWE-843, CWE-843
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md
CVE: CVE-2024-36243
Published: 2024-07-02
Description: in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds read and write.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125, CWE-787, CWE-125, CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md
CVE: CVE-2024-36260
Published: 2024-07-02
Description: in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md