deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3333
Published: 2024-04-17
Description: The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attributes of widgets in all versions up to, and including, 5.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3067596/essential-addons-for-elementor-lite; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5bdaf9-fbde-40d4-a72a-fd24489818b3?source=cve; https://plugins.trac.wordpress.org/changeset/3067596/essential-addons-for-elementor-lite
CVE: CVE-2024-3908
Published: 2024-04-17
Description: A vulnerability classified as critical has been found in Tenda AC500 2.0.1.9(1307). Affected is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261144. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/formWriteFacMac.md; https://vuldb.com/?ctiid.261144; https://vuldb.com/?id.261144
CVE: CVE-2024-3909
Published: 2024-04-17
Description: A vulnerability classified as critical was found in Tenda AC500 2.0.1.9(1307). Affected by this vulnerability is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261145 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/formexeCommand.md; https://vuldb.com/?ctiid.261145; https://vuldb.com/?id.261145
CVE: CVE-2024-3910
Published: 2024-04-17
Description: A vulnerability, which was classified as critical, has been found in Tenda AC500 2.0.1.9(1307). Affected by this issue is the function fromDhcpListClient of the file /goform/DhcpListClient. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261146 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/fromDhcpListClient_page.md; https://vuldb.com/?ctiid.261146; https://vuldb.com/?id.261146
CVE: CVE-2023-39367
Published: 2024-04-17
Description: An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1867; https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
CVE: CVE-2023-40146
Published: 2024-04-17
Description: A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocked default busybox functionality to trigger this vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77, CWE-798
References: https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1868; https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
CVE: CVE-2023-43491
Published: 2024-04-17
Description: An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1863; https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
CVE: CVE-2023-45209
Published: 2024-04-17
Description: An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1865; https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
CVE: CVE-2023-45744
Published: 2024-04-17
Description: A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to configuration modification. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866; https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
CVE: CVE-2023-6805
Published: 2024-04-17
Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes it possible for authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to modify information from internal services. NOTE: This vulnerability, exploitable by contributor-level users, was was fixed in version 4.4.7. The same vulnerability was fixed for author-level users in version 4.4.8.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://plugins.trac.wordpress.org/changeset/3070624/feedzy-rss-feeds; https://www.wordfence.com/threat-intel/vulnerabilities/id/46978e1d-7adb-49f6-8e41-093f177c9a4d?source=cve; https://plugins.trac.wordpress.org/changeset/3070624/feedzy-rss-feeds
CVE: CVE-2024-30952
Published: 2024-04-17
Description: A stored cross-site scripting (XSS) vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team&m=Setting&a=action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/CrownZTX/vulnerabilities/blob/main/pescms/stored_xss.md; https://github.com/CrownZTX/vulnerabilities/blob/main/pescms/stored_xss.md
CVE: CVE-2024-32281
Published: 2024-04-17
Description: Tenda AC7V1.0 v15.03.06.44 firmware contains a command injection vulnerablility in formexeCommand function via the cmdinput parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/formexecommand.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/formexecommand.md
CVE: CVE-2024-32301
Published: 2024-04-17
Description: Tenda AC7V1.0 v15.03.06.44 firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/fromWizardHandle.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/fromWizardHandle.md
CVE: CVE-2024-32307
Published: 2024-04-17
Description: Tenda FH1205 V2.0.0.7(775) firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function.
CVSS Score: 7.4 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/fromWizardHandle.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/fromWizardHandle.md
CVE: CVE-2024-32310
Published: 2024-04-17
Description: Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the PPW parameter of the fromWizardHandle function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/fromWizardHandle.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/fromWizardHandle.md
CVE: CVE-2024-32312
Published: 2024-04-17
Description: Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the adslPwd parameter of the formWanParameterSetting function.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/formWanParameterSetting.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/formWanParameterSetting.md
CVE: CVE-2024-32313
Published: 2024-04-17
Description: Tenda FH1205 V2.0.0.7(775) firmware has a stack overflow vulnerability located via the adslPwd parameter of the formWanParameterSetting function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formWanParameterSetting.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formWanParameterSetting.md
CVE: CVE-2024-1132
Published: 2024-04-17
Description: A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://access.redhat.com/errata/RHSA-2024:1860; https://access.redhat.com/errata/RHSA-2024:1861; https://access.redhat.com/errata/RHSA-2024:1862
CVE: CVE-2024-1249
Published: 2024-04-17
Description: A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.
CVSS Score: 7.4 (HIGH)
CWE: CWE-346
References: https://access.redhat.com/errata/RHSA-2024:1860; https://access.redhat.com/errata/RHSA-2024:1861; https://access.redhat.com/errata/RHSA-2024:1862
CVE: CVE-2024-2419
Published: 2024-04-17
Description: A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.
CVSS Score: 7.1 (HIGH)
CWE: CWE-601
References: https://access.redhat.com/errata/RHSA-2024:1867; https://access.redhat.com/security/cve/CVE-2024-2419; https://bugzilla.redhat.com/show_bug.cgi?id=2269371
CVE: CVE-2024-31578
Published: 2024-04-17
Description: FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://gist.github.com/[PII_REDACTED]/45400cce5859d78dcd3a62010df8d179; https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE: CVE-2024-32282
Published: 2024-04-17
Description: Tenda FH1202 v1.2.0.14(408) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formexecommand_cmdi.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formexecommand_cmdi.md
CVE: CVE-2024-32283
Published: 2024-04-17
Description: Tenda FH1203 V2.0.1.6 firmware has a command injection vulnerablility in formexeCommand function via the cmdinput parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formexecommand_cmdi.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formexecommand_cmdi.md
CVE: CVE-2024-32285
Published: 2024-04-17
Description: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the password parameter in the formaddUserName function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/formaddUserName.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/formaddUserName.md
CVE: CVE-2024-32286
Published: 2024-04-17
Description: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromVirtualSer function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromVirtualSer.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromVirtualSer.md
CVE: CVE-2024-32287
Published: 2024-04-17
Description: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the qos parameter in the fromqossetting function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromqossetting.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromqossetting.md
CVE: CVE-2024-32288
Published: 2024-04-17
Description: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromwebExcptypemanFilter function.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromwebExcptypemanFilter.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromwebExcptypemanFilter.md
CVE: CVE-2024-32290
Published: 2024-04-17
Description: Tenda W30E v1.0 v1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromAddressNat function.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromAddressNat_page.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromAddressNat_page.md
CVE: CVE-2024-32291
Published: 2024-04-17
Description: Tenda W30E v1.0 firmware v1.0.1.25(633) has a stack overflow vulnerability via the page parameter in the fromNatlimit function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromNatlimit.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromNatlimit.md
CVE: CVE-2024-32292
Published: 2024-04-17
Description: Tenda W30E v1.0 V1.0.1.25(633) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/formexecommand_cmdi.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/formexecommand_cmdi.md
CVE: CVE-2024-32293
Published: 2024-04-17
Description: Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromDhcpListClient function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromDhcpListClient_page.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromDhcpListClient_page.md
CVE: CVE-2024-32299
Published: 2024-04-17
Description: Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/fromWizardHandle.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/fromWizardHandle.md
CVE: CVE-2024-32302
Published: 2024-04-17
Description: Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787, CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/fromWizardHandle.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/fromWizardHandle.md
CVE: CVE-2024-32306
Published: 2024-04-17
Description: Tenda AC10U v1.0 Firmware v15.03.06.49 has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.48/fromWizardHandle.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.48/fromWizardHandle.md
CVE: CVE-2024-32311
Published: 2024-04-17
Description: Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formWanParameterSetting.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formWanParameterSetting.md
CVE: CVE-2024-32315
Published: 2024-04-17
Description: Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-787, CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWanParameterSetting.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWanParameterSetting.md
CVE: CVE-2024-29035
Published: 2024-04-17
Description: Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-918
References: https://github.com/umbraco/Umbraco-CMS/commit/6b8067815c02ae43161966a8075a3585e1bc4de0; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-74p6-39f2-23v3; https://github.com/umbraco/Umbraco-CMS/commit/6b8067815c02ae43161966a8075a3585e1bc4de0
CVE: CVE-2024-30253
Published: 2024-04-17
Description: @solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with `@solana/web3.js`, your application/service may crash, resulting in a loss of availability. This vulnerability is fixed in 1.0.1, 1.10.2, 1.11.1, 1.12.1, 1.1.2, 1.13.1, 1.14.1, 1.15.1, 1.16.2, 1.17.1, 1.18.1, 1.19.1, 1.20.3, 1.21.1, 1.22.1, 1.23.1, 1.24.3, 1.25.1, 1.26.1, 1.27.1, 1.28.1, 1.2.8, 1.29.4, 1.30.3, 1.31.1, 1.3.1, 1.32.3, 1.33.1, 1.34.1, 1.35.2, 1.36.1, 1.37.3, 1.38.1, 1.39.2, 1.40.2, 1.41.11, 1.4.1, 1.42.1, 1.43.7, 1.44.4, 1.45.1, 1.46.1, 1.47.5, 1.48.1, 1.49.1, 1.50.2, 1.51.1, 1.5.1, 1.52.1, 1.53.1, 1.54.2, 1.55.1, 1.56.3, 1.57.1, 1.58.1, 1.59.2, 1.60.1, 1.61.2, 1.6.1, 1.62.2, 1.63.2, 1.64.1, 1.65.1, 1.66.6, 1.67.3, 1.68.2, 1.69.1, 1.70.4, 1.71.1, 1.72.1, 1.7.2, 1.73.5, 1.74.1, 1.75.1, 1.76.1, 1.77.4, 1.78.8, 1.79.1, 1.80.1, 1.81.1, 1.8.1, 1.82.1, 1.83.1, 1.84.1, 1.85.1, 1.86.1, 1.87.7, 1.88.1, 1.89.2, 1.90.2, 1.9.2, and 1.91.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/solana-labs/solana-web3.js/commit/77d935221a4805107b20b60ae7c1148725e4e2d0; https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-8m45-2rjm-j347; https://github.com/solana-labs/solana-web3.js/commit/77d935221a4805107b20b60ae7c1148725e4e2d0
CVE: CVE-2024-3825
Published: 2024-04-17
Description: Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/Blazemeter/blazemeter-jenkins-plugin/commit/11ec94f68136a0612ae1b37b[PII_REDACTED]cb2528; https://portal.perforce.com/s/detail/a91PA000001STsvYAG; https://github.com/Blazemeter/blazemeter-jenkins-plugin/commit/11ec94f68136a0612ae1b37b[PII_REDACTED]cb2528
CVE: CVE-2023-46060
Published: 2024-04-17
Description: A Buffer Overflow vulnerability in Tenda AC500 v.2.0.1.9 allows a remote attacker to cause a denial of service via the port parameter at the goform/setVlanInfo component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/peris-navince/founded-0-days/blob/main/Tenda/ac500/fromSetVlanInfo/1.md; https://github.com/peris-navince/founded-0-days/blob/main/Tenda/ac500/fromSetVlanInfo/1.md
CVE: CVE-2023-52645
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

pmdomain: mediatek: fix race conditions with genpd

If the power domains are registered first with genpd and *after that*
the driver attempts to power them on in the probe sequence, then it is
possible that a race condition occurs if genpd tries to power them on
in the same time.
The same is valid for powering them off before unregistering them
from genpd.
Attempt to fix race conditions by first removing the domains from genpd
and *after that* powering down domains.
Also first power up the domains and *after that* register them
to genpd.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/339ddc983bc1622341d95f244c361cda3da3a4ff; https://git.kernel.org/stable/c/3cd1d92ee1dbf3e8f988767eb75f[PII_REDACTED]2b; https://git.kernel.org/stable/c/475426ad1ae0bfdfd8f160ed[PII_REDACTED]392438