deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-20322
Published: 2024-03-13
Description: A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.
 This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected device that were supposed to be protected by a configured ACL.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e
CVE: CVE-2024-20327
Published: 2024-03-13
Description: A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the ppp_ma process, resulting in a denial of service (DoS) condition.
 This vulnerability is due to the improper handling of malformed PPPoE packets that are received on a router that is running Broadband Network Gateway (BNG) functionality with PPPoE termination on a Lightspeed-based or Lightspeed-Plus-based line card. An attacker could exploit this vulnerability by sending a crafted PPPoE packet to an affected line card interface that does not terminate PPPoE. A successful exploit could allow the attacker to crash the ppp_ma process, resulting in a DoS condition for PPPoE traffic across the router.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW
CVE: CVE-2024-27952
Published: 2024-03-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issue affects Advanced Sermons: from n/a through 3.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-sermons/wordpress-advanced-sermons-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-sermons/wordpress-advanced-sermons-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-27953
Published: 2024-03-13
Description: Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a through 2.6.8.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/cryptocurrency-price-ticker-widget/wordpress-cryptocurrency-widgets-plugin-2-6-8-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cryptocurrency-price-ticker-widget/wordpress-cryptocurrency-widgets-plugin-2-6-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-28195
Published: 2024-03-13
Description: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.9.0 do not protect the API and login flow against Cross-Site Request Forgery (CSRF). Attackers can use this to execute CSRF attacks on victims, allowing them to retrieve, modify or delete data on the affected YourSpotify instance. Using repeated CSRF attacks, it is also possible to create a new user on the victim instance and promote the new user to instance administrator if a legitimate administrator visits a website prepared by an attacker. Note: Real-world exploitability of this vulnerability depends on the browser version and browser settings in use by the victim. This issue has been addressed in version 1.9.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Yooooomi/your_spotify/commit/c3ae87673910c9903bb53088c8b71ed2c9aa54e4; https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-hfgf-99p3-6fjj; https://github.com/Yooooomi/your_spotify/commit/c3ae87673910c9903bb53088c8b71ed2c9aa54e4
CVE: CVE-2024-28196
Published: 2024-03-13
Description: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version < 1.9.0 does not prevent other pages from displaying it in an iframe and is thus vulnerable to clickjacking. Clickjacking can be used to trick an existing user of YourSpotify to trigger actions, such as allowing signup of other users or deleting the current user account. Clickjacking works by opening the target application in an invisible iframe on an attacker-controlled site and luring a victim to visit the attacker page and interacting with it. By positioning elements over the invisible iframe, a victim can be tricked into triggering malicious or destructive actions in the invisible iframe, while they think they interact with a totally different site altogether. When a victim visits an attacker-controlled site while they are logged into YourSpotify, they can be tricked into performing actions on their YourSpotify instance without their knowledge. These actions include allowing signup of other users or deleting the current user account, resulting in a high impact to the integrity of YourSpotify. This issue has been addressed in version 1.9.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-m5x2-6hjm-cggq; https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-m5x2-6hjm-cggq
CVE: CVE-2024-2403
Published: 2024-03-13
Description: 
Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and
earlier on Windows allows an attacker that compromised a user endpoint, under specific circumstances, to access sensitive information via residual files in the temporary directory.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-459, CWE-459
References: https://devolutions.net/security/advisories/DEVO-2024-0004; https://devolutions.net/security/advisories/DEVO-2024-0004
CVE: CVE-2024-2418
Published: 2024-03-13
Description: A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view_order.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256705 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/ycxdzj/CVE_Hunter/blob/main/SQLi-6.md; https://vuldb.com/?ctiid.256705; https://vuldb.com/?id.256705
CVE: CVE-2024-2431
Published: 2024-03-13
Description: An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://security.paloaltonetworks.com/CVE-2024-2431; https://security.paloaltonetworks.com/CVE-2024-2431
CVE: CVE-2024-2432
Published: 2024-03-13
Description: A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-269
References: https://security.paloaltonetworks.com/CVE-2024-2432; https://security.paloaltonetworks.com/CVE-2024-2432
CVE: CVE-2024-2433
Published: 2024-03-13
Description: An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. 



This issue affects only the web interface of the management plane; the dataplane is unaffected.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://security.paloaltonetworks.com/CVE-2024-2433; https://security.paloaltonetworks.com/CVE-2024-2433
CVE: CVE-2024-0799
Published: 2024-03-13
Description: An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.tenable.com/security/research/tra-2024-07; https://www.tenable.com/security/research/tra-2024-07
CVE: CVE-2024-0800
Published: 2024-03-13
Description: A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.tenable.com/security/research/tra-2024-07; https://www.tenable.com/security/research/tra-2024-07
CVE: CVE-2024-0801
Published: 2024-03-13
Description: A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.
CVSS Score: 7.5 (HIGH)
CWE: CWE-75
References: https://www.tenable.com/security/research/tra-2024-07; https://www.tenable.com/security/research/tra-2024-07
CVE: CVE-2024-28194
Published: 2024-03-13
Description: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for arbitrary users. This vulnerability allows attackers to bypass authentication and authenticate as arbitrary YourSpotify users, including admin users. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-gvcr-g265-j827; https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-gvcr-g265-j827
CVE: CVE-2024-24692
Published: 2024-03-13
Description: Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24009/; https://www.zoom.com/en/trust/security-bulletin/zsb-24009/
CVE: CVE-2024-24693
Published: 2024-03-13
Description: Improper access control in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-379
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24009/; https://www.zoom.com/en/trust/security-bulletin/zsb-24009/
CVE: CVE-2023-36238
Published: 2024-03-13
Description: Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/Ek-Saini/security/blob/main/IDOR-Bagisto; https://github.com/Ek-Saini/security/blob/main/IDOR-Bagisto
CVE: CVE-2023-41504
Published: 2024-03-13
Description: SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/ASR511-OO7/CVE-2023-41504/blob/main/CVE-25; https://github.com/ASR511-OO7/CVE-2023-41504/blob/main/CVE-25
CVE: CVE-2023-41505
Published: 2024-03-13
Description: An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/ASR511-OO7/CVE-2023-41505/blob/main/CVE-24; https://github.com/ASR511-OO7/CVE-2023-41505/blob/main/CVE-24
CVE: CVE-2023-50726
Published: 2024-03-13
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have `create` privileges but not `override` privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing `applications, create` RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-269, CWE-863
References: https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac; https://github.com/argoproj/argo-cd/commit/3b8f673f06c2d228e01cbc830e5cb57cef008978; https://github.com/argoproj/argo-cd/security/advisories/GHSA-g623-jcgg-mhmm
CVE: CVE-2024-22167
Published: 2024-03-13
Description: A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the system user. This vulnerability is only exploitable locally if an attacker has access to a copy of the user's vault or has already gained access into a user's system. This attack is limited to the system in context and cannot be propagated.
CVSS Score: 7.9 (HIGH)
CWE: CWE-427
References: https://www.westerndigital.com/support/product-security/wdc-24002-sandisk-privateaccess-desktop-app-v-6-4-11; https://www.westerndigital.com/support/product-security/wdc-24002-sandisk-privateaccess-desktop-app-v-6-4-11
CVE: CVE-2024-24105
Published: 2024-03-13
Description: SQL Injection vulnerability in Code-projects Computer Science Time Table System 1.0 allows attackers to run arbitrary code via adminFormvalidation.php.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/ASR511-OO7/CVE-2024-24105/blob/main/CVE-40; https://github.com/ASR511-OO7/CVE-2024-24105/blob/main/CVE-40
CVE: CVE-2024-25250
Published: 2024-03-13
Description: SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/ASR511-OO7/CVE-2024-25250./blob/main/CVE-38; https://github.com/ASR511-OO7/CVE-2024-25250./blob/main/CVE-38
CVE: CVE-2024-27097
Published: 2024-03-13
Description: A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c; https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j; https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c
CVE: CVE-2024-27102
Published: 2024-03-13
Description: Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base directory (sandbox root) is possible. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. Details on the exploitation of this vulnerability are embargoed until March 27th, 2024 at 18:00 UTC. In order to mitigate this vulnerability, a full rewrite of the entire server filesystem was necessary. Because of this, the size of the patch is massive, however effort was made to reduce the amount of breaking changes. Users are advised to update to version 1.11.9. There are no known workarounds for this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22, CWE-362, CWE-363, CWE-22, CWE-362
References: https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287; https://github.com/pterodactyl/wings/security/advisories/GHSA-494h-9924-xww9; https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287
CVE: CVE-2024-28175
Published: 2024-03-13
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.argoproj.io` annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in Argo CD versions v2.10.3 v2.9.8, and v2.8.12. There are no completely-safe workarounds besides upgrading. The safest alternative, if upgrading is not possible, would be to create a Kubernetes admission controller to reject any resources with an annotation starting with link.argocd.argoproj.io or reject the resource if the value use an improper URL protocol. This validation will need to be applied in all clusters managed by ArgoCD.


CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/argoproj/argo-cd/commit/479b5544b57dc9ef767d49f7003f39602c480b71; https://github.com/argoproj/argo-cd/security/advisories/GHSA-jwv5-8mqv-g387; https://github.com/argoproj/argo-cd/commit/479b5544b57dc9ef767d49f7003f39602c480b71
CVE: CVE-2024-28192
Published: 2024-03-13
Description: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 is vulnerable to NoSQL injection in the public access token processing logic. Attackers can fully bypass the public token authentication mechanism, regardless if a public token has been generated before or not, without any user interaction or prerequisite knowledge. This vulnerability allows an attacker to fully bypass the public token authentication mechanism, regardless if a public token has been generated before or not, without any user interaction or prerequisite knowledge. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74, CWE-943, CWE-74
References: https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-c8wf-wcjc-2pvm; https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-c8wf-wcjc-2pvm
CVE: CVE-2024-28193
Published: 2024-03-13
Description: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 allows users to create a public token in the settings, which can be used to provide guest-level access to the information of that specific user in YourSpotify. The /me API endpoint discloses Spotify API access and refresh tokens to guest users. Attackers with access to a public token for guest access to YourSpotify can therefore obtain access to Spotify API tokens of YourSpotify users. As a consequence, attackers may extract profile information, information about listening habits, playlists and other information from the corresponding Spotify profile. In addition, the attacker can pause and resume playback in the Spotify app at will. This issue has been resolved in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-3782-758f-mj85; https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-3782-758f-mj85
CVE: CVE-2024-28662
Published: 2024-03-13
Description: A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/functions.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Piwigo/Piwigo/commit/5069610aaeb1da6d96d389651a5ba9b38690c580; https://github.com/Piwigo/Piwigo/compare/14.2.0...14.3.0; https://github.com/Piwigo/Piwigo/security/advisories/GHSA-8g2g-6f2c-6h7j
CVE: CVE-2020-11862
Published: 2024-03-13
Description: Allocation of Resources Without Limits or Throttling vulnerability in OpenText NetIQ Privileged Account Manager on Linux, Windows, 64 bit allows Flooding.This issue affects NetIQ Privileged Account Manager: before 3.7.0.2.


CVSS Score: 8.6 (HIGH)
CWE: CWE-770, CWE-770
References: https://www.netiq.com/documentation/privileged-account-manager-37/npam_3702_releasenotes/data/npam_3702_releasenotes.html; https://www.netiq.com/documentation/privileged-account-manager-37/npam_3702_releasenotes/data/npam_3702_releasenotes.html
CVE: CVE-2023-38534
Published: 2024-03-13
Description: Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted information in unauthenticated RPC. 
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-287
References: https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796609; https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796609
CVE: CVE-2023-38535
Published: 2024-03-13
Description: Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryptographic keys.  
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0801267; https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0801267
CVE: CVE-2023-38536
Published: 2024-03-13
Description: HTML injection in OpenText™ Exceed Turbo X affecting version 12.5.1. The vulnerability could result in Cross site scripting.  
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796182; https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796182
CVE: CVE-2024-27703
Published: 2024-03-13
Description: Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/b-hermes/vulnerability-research/blob/main/CVE-2024-27703/README.md; https://github.com/b-hermes/vulnerability-research/blob/main/CVE-2024-27703/README.md