deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-42946
Published: 2024-08-15
Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromVirtualSer.md
CVE: CVE-2024-42947
Published: 2024-08-15
Description: An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrary commands via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/telnet.md
CVE: CVE-2024-42948
Published: 2024-08-15
Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromPptpUserSetting.md
CVE: CVE-2024-42949
Published: 2024-08-15
Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the qos parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromqossetting_qos.md
CVE: CVE-2024-42950
Published: 2024-08-15
Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the Go parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-400
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromSafeClientFilter_Go.md
CVE: CVE-2024-42951
Published: 2024-08-15
Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the mit_pptpusrpw parameter in the fromWizardHandle function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-400
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromWizardHandle_mit_pptpusrpw.md
CVE: CVE-2024-42952
Published: 2024-08-15
Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromqossetting_page.md
CVE: CVE-2024-42953
Published: 2024-08-15
Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPW parameter in the fromWizardHandle function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromWizardHandle_PPW.md
CVE: CVE-2024-42954
Published: 2024-08-15
Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromwebExcptypemanFilter.md
CVE: CVE-2024-42955
Published: 2024-08-15
Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromSafeClientFilter_page.md
CVE: CVE-2024-42966
Published: 2024-08-15
Description: Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/N350R/ExportSettings.md
CVE: CVE-2024-42967
Published: 2024-08-15
Description: Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/LR350/ExportSettings.md
CVE: CVE-2024-42968
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the Go parameter in the fromSafeUrlFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromSafeMacFilter_Go.md
CVE: CVE-2024-42969
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeUrlFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-400
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromSafeMacFilter%20_page.md
CVE: CVE-2024-42973
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSetlpBind function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromSetIpBind.md
CVE: CVE-2024-42974
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromwebExcptypemanFilter.md
CVE: CVE-2024-42976
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromSafeClientFilter_page.md
CVE: CVE-2024-42977
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the qos parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromqossetting_qos.md
CVE: CVE-2024-42978
Published: 2024-08-15
Description: An issue in the handler function in /goform/telnet of Tenda FH1206 v02.03.01.35 allows attackers to execute arbitrary commands via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/telnet.md
CVE: CVE-2024-42979
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ProtForm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/frmL7ProtForm.md
CVE: CVE-2024-42980
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-400
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/frmL7ImForm.md
CVE: CVE-2024-42981
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-400
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromPptpUserSetting.md
CVE: CVE-2024-42982
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromVirtualSer.md
CVE: CVE-2024-42983
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the pptpPPW parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromAdvSetWan_pptpPPW.md
CVE: CVE-2024-42984
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromP2pListFilter.md
CVE: CVE-2024-42985
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromNatlimit.md
CVE: CVE-2024-42986
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromAdvSetWan_PPPOEPassword.md
CVE: CVE-2024-42987
Published: 2024-08-15
Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack-based buffer overflow vulnerability in the fromPptpUserAdd function. The vulnerability can be triggered via the modino, username, newpwd, or pptpdnetseg parameters, all of which are passed via HTTP POST and used in unsafe sprintf calls without proper length validation. A remote attacker can exploit this flaw through a crafted POST request, which may cause a Denial of Service (DoS). In certain scenarios, this issue could potentially be leveraged to achieve remote code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromPptpUserAdd.md; https://github.com/laohouzju/PoC/blob/main/Tenda%20FH1206%20fromPptpUserAdd_newpwd.md; https://github.com/laohouzju/PoC/blob/main/Tenda%20FH1206%20fromPptpUserAdd_pptpdnetseg.md
CVE: CVE-2024-22217
Published: 2024-08-15
Description: A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal services including sensitive information on the server that Terminalfour runs on.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://docs.terminalfour.com/articles/release-notes-highlights/; https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22217/
CVE: CVE-2024-22218
Published: 2024-08-15
Description: XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://docs.terminalfour.com/articles/release-notes-highlights/; https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22218--cve-2024-22219/
CVE: CVE-2024-22219
Published: 2024-08-15
Description: XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://docs.terminalfour.com/articles/release-notes-highlights/; https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22218--cve-2024-22219/
CVE: CVE-2024-32231
Published: 2024-08-15
Description: Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/stashapp; https://github.com/stashapp/stash; https://github.com/stashapp/stash/pull/4865
CVE: CVE-2024-23168
Published: 2024-08-15
Description: Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1385
References: https://github.com/Xiexe/XSOverlay-Issue-Tracker; https://store.steampowered.com/news/app/1173510?emclan=[PII_REDACTED]5938574&emgid=[PII_REDACTED]417394332; https://vuln.ryotak.net/advisories/70
CVE: CVE-2024-25633
Published: 2024-08-15
Description: eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts in their team. If the system has anonymous access enabled (disabled by default) an unauthenticated user can create regular users in any team. This vulnerability has been fixed since version 5.0.0, released on February 17th 2024. Some workarounds are available. Disabling both options that allow *administrators* to create users will provide a mitigation. Additionally, disabling anonymous user access will stop anonymous access (including using existing access keys).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266
References: https://github.com/elabftw/elabftw/security/advisories/GHSA-v677-8x8p-636v
CVE: CVE-2024-27728
Published: 2024-08-15
Description: Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of the babel debug feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/friendica/friendica/pull/13927; https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures/
CVE: CVE-2024-27729
Published: 2024-08-15
Description: Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/friendica/friendica/pull/13927; https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures/
CVE: CVE-2024-27730
Published: 2024-08-15
Description: Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://github.com/friendica/friendica/pull/13927; https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures/
CVE: CVE-2024-27731
Published: 2024-08-15
Description: Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200
References: https://github.com/friendica/friendica/pull/13927; https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures/
CVE: CVE-2024-42475
Published: 2024-08-15
Description: In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be successfully guessed by an attacker allowing them to perform a CSRF vs a user, associating the user's session with the attacker's protected resources. While `state` isn't exactly a cryptographic value, it should be generated in a cryptographically secure way. `generateState` should be using a CSPRNG. Version 0.11 modifies the `generateState` function to generate `state` values of at least 128 bits of entropy while using a CSPRNG.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330, CWE-352
References: https://github.com/CORDEA/oauth/blob/b8c163b0d9cfad6d29ce8c1fb394e5f47182ee1c/src/oauth2.nim#L179; https://github.com/CORDEA/oauth/security/advisories/GHSA-332c-q46h-fg8f
CVE: CVE-2024-42476
Published: 2024-08-15
Description: In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the `state` parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the `state` parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the `state` parameter using a regular `if` statement or `doAssert` instead of relying on a plain `assert`. `doAssert` will achieve the desired behavior even if `-d:danger` or `--assertions:off` is set.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/CORDEA/oauth/blob/b8c163b0d9cfad6d29ce8c1fb394e5f47182ee1c/src/oauth2.nim#L235; https://github.com/CORDEA/oauth/blob/b8c163b0d9cfad6d29ce8c1fb394e5f47182ee1c/src/oauth2.nim#L255; https://github.com/CORDEA/oauth/security/advisories/GHSA-pc9j-53g7-5x54
CVE: CVE-2024-42757
Published: 2024-08-15
Description: Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Nop3z/CVE/blob/main/Asus/FW_RT_N15U_[PII_REDACTED]4/FW_RT_N15U_[PII_REDACTED]4%20RCE.md
CVE: CVE-2024-43357
Published: 2024-08-15
Description: ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference.

The internal async generator machinery calls regular promise resolver functions on IteratorResult (`{ done, value }`) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from `Object.prototype`, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants.

The ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory's public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the `AsyncGenerator` section.

## References

- https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee[PII_REDACTED]7
- https://bugzilla.mozilla.org/show_bug.cgi?id=1901411
- https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq
- https://bugs.webkit.org/show_bug.cgi?id=275407
- https://issues.chromium.org/issues/346692561
- https://www.cve.org/CVERecord?id=CVE-2024-7652
CVSS Score: 8.6 (HIGH)
CWE: CWE-248, CWE-476, CWE-843
References: https://bugs.webkit.org/show_bug.cgi?id=275407; https://bugzilla.mozilla.org/show_bug.cgi?id=1901411; https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq
CVE: CVE-2024-7838
Published: 2024-08-15
Description: A vulnerability was found in itsourcecode Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /addcategory.php. The manipulation of the argument cname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/a/issues/1; https://vuldb.com/?ctiid.274742; https://vuldb.com/?id.274742
CVE: CVE-2024-7866
Published: 2024-08-15
Description: In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674, CWE-674
References: https://www.xpdfreader.com/security-bug/object-loops.html
CVE: CVE-2024-7867
Published: 2024-08-15
Description: In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-190, CWE-369, CWE-190, CWE-369
References: https://www.xpdfreader.com/security-bug/CVE-2024-7867.html
CVE: CVE-2024-42487
Published: 2024-08-15
Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16.1, Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are matched. This could result in unexpected behaviour with security This issue is fixed in Cilium v1.15.8 and v1.16.1. There is no workaround for this issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-113, CWE-436
References: https://github.com/cilium/cilium/commit/a3510fe4a92305822aa1a5e08cb6d6c873c8699a; https://github.com/cilium/cilium/pull/34109; https://github.com/cilium/cilium/security/advisories/GHSA-qcm3-7879-xcww