deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-20931
Published: 2024-11-15
Description: A vulnerability in the version control of Cisco&nbsp;TelePresence CE Software for Cisco&nbsp;Touch 10 Devices could allow an unauthenticated, adjacent attacker to install an older version of the software on an affected device.
This vulnerability is due to insufficient version control. An attacker could exploit this vulnerability by installing an older version of Cisco&nbsp;TelePresence CE Software on an affected device. A successful exploit could allow the attacker to take advantage of vulnerabilities in older versions of the software.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-527
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-DAV-HSvEHHEt
CVE: CVE-2022-20939
Published: 2024-11-15
Description: A vulnerability in the web-based management interface of Cisco&nbsp;Smart Software Manager On-Prem could allow an authenticated, remote attacker to elevate privileges on an affected system.
This vulnerability is due to inadequate protection of sensitive user information. An attacker could exploit this vulnerability by accessing certain logs on an affected system. A successful exploit could allow the attacker to use the obtained information to elevate privileges to System Admin.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv
CVE: CVE-2022-20948
Published: 2024-11-15
Description: A vulnerability in the web management interface of Cisco&nbsp;BroadWorks Hosted Thin Receptionist could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-DAV-HSvEHHEt; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU
CVE: CVE-2023-20004
Published: 2024-11-15
Description: Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device.

These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account.
Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf
CVE: CVE-2023-20036
Published: 2024-11-15
Description: A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device.

This vulnerability is due to improper input validation when uploading a Device Pack. An attacker could exploit this vulnerability by altering the request that is&nbsp;sent when uploading a Device Pack. A successful exploit could allow the attacker to execute arbitrary commands as NT AUTHORITY\SYSTEM on the underlying operating system of an affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-CAeLFk6V
CVE: CVE-2023-20039
Published: 2024-11-15
Description: A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data.

This vulnerability is due to insufficient default file permissions that are applied to the application data directory. An attacker could exploit this vulnerability by accessing files in the application data directory. A successful exploit could allow the attacker to view sensitive information.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.&nbsp;
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-552
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-CAeLFk6V
CVE: CVE-2023-20060
Published: 2024-11-15
Description: A vulnerability in the web-based management interface of Cisco Prime Collaboration Deployment could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface.

This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Cisco plans to release software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pcd-xss-jDXpjm7
CVE: CVE-2023-20090
Published: 2024-11-15
Description: A vulnerability in Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to elevate privileges to root on an affected device.

This vulnerability is due to improper access control on certain CLI commands. An attacker could exploit this vulnerability by running a series of crafted commands. A successful exploit could allow the attacker to elevate privileges to root.
Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-27
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf
CVE: CVE-2023-20091
Published: 2024-11-15
Description: A vulnerability in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device.

This vulnerability is due to improper access controls on files that are on the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit this vulnerability, an attacker would need to have a remote support user account.
Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-61
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf
CVE: CVE-2023-20092
Published: 2024-11-15
Description: Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device.

These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account.
Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-61
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf
CVE: CVE-2023-20093
Published: 2024-11-15
Description: Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device.

These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account.
Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-61
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf
CVE: CVE-2023-20094
Published: 2024-11-15
Description: A vulnerability in Cisco TelePresence CE and RoomOS could allow an unauthenticated, adjacent attacker to view sensitive information on an affected device.

This vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read that discloses sensitive information.
Note: This vulnerability only affects Cisco Webex Desk Hub.
There are no workarounds that address this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf
CVE: CVE-2024-11244
Published: 2024-11-15
Description: A vulnerability classified as critical was found in code-projects Farmacia 1.0. This vulnerability affects unknown code of the file /editar-cliente.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zsx020121/cve/blob/main/sql.md; https://vuldb.com/?ctiid.284680
CVE: CVE-2024-11245
Published: 2024-11-15
Description: A vulnerability, which was classified as critical, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /editar-produto.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/WEFNNTT/cve/blob/main/sql.md; https://vuldb.com/?ctiid.284681
CVE: CVE-2024-11246
Published: 2024-11-15
Description: A vulnerability, which was classified as problematic, was found in code-projects Farmacia 1.0. Affected is an unknown function of the file /adicionar-cliente.php. The manipulation of the argument nome/cpf/dataNascimento leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions the parameter "nome" to be affected. But further inspection indicates that other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/curry136/cve/blob/main/xss8.md; https://vuldb.com/?ctiid.284682
CVE: CVE-2024-41784
Published: 2024-11-15
Description: IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot dot" sequences (/.../) to view arbitrary files on the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-32, CWE-22
References: https://www.ibm.com/support/pages/node/7173631
CVE: CVE-2024-49754
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token. This vulnerability can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/25988a937cbaebd2ba4c[PII_REDACTED]c404dfb359; https://github.com/librenms/librenms/security/advisories/GHSA-gfwr-xqmj-j27v
CVE: CVE-2024-49758
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device's Notes, its will be trigger. This vulnerability is fixed in 24.10.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/24b142d753898e273ec20b542a27dd6eb530c7d8; https://github.com/librenms/librenms/security/advisories/GHSA-c86q-rj37-8f85
CVE: CVE-2024-49759
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "bill_name" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill Access" dropdown in the user's "Manage Access" page, potentially compromising user sessions and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0; https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58
CVE: CVE-2024-49764
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information" page allows authenticated users to inject arbitrary JavaScript through the "hostname" parameter when creating a new device. This vulnerability results in the execution of malicious code when the "Capture Debug Information" page is visited, redirecting the user and sending non-httponly cookies to an attacker-controlled domain. This vulnerability is fixed in 24.10.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/af15eabbb1752985d36f337cecf137a947e170f6; https://github.com/librenms/librenms/security/advisories/GHSA-rmr4-x6c9-jc68
CVE: CVE-2024-50350
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when creating a new Port Group. This vulnerability results in the execution of malicious code when the "Port Settings" page is visited after the affected Port Group is added to a device, potentially compromising user sessions and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/82a744bfe29017b8b58b5752ab9e1b335bedf0a0; https://github.com/librenms/librenms/security/advisories/GHSA-xh4g-c9p6-5jxg
CVE: CVE-2024-50351
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "section" parameter of the "logs" tab of a device allows attackers to inject arbitrary JavaScript. This vulnerability results in the execution of malicious code when a user accesses the page with a malicious "section" parameter, potentially compromising their session and enabling unauthorized actions. The issue arises from a lack of sanitization in the "report_this()" function. This vulnerability is fixed in 24.10.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/6a14a9bd767c6e452e4df77a24126c3eeb93dcbf; https://github.com/librenms/librenms/security/advisories/GHSA-v7w9-63xh-6r3w
CVE: CVE-2024-50352
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when adding a service to a device. This vulnerability could result in the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/b4af778ca42c5839801f16ece53505bb7fa1e7bc; https://github.com/librenms/librenms/security/advisories/GHSA-qr8f-5qqg-j3wg
CVE: CVE-2024-50355
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can edit the Display Name of a device, the application did not properly sanitize the user input in the device Display Name, if java script code is inside the name of the device Display Name, its can be trigger from different sources. This vulnerability is fixed in 24.10.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/librenms/librenms/commit/bb4731419b592867bf974dde525e536606a52976; https://github.com/librenms/librenms/security/advisories/GHSA-4m5r-w2rq-q54q
CVE: CVE-2024-50647
Published: 2024-11-15
Description: The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through https://ip:port/api/myapp/index/user/info?id=1 And modify the ID value to obtain sensitive user information beyond authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/Yllxx03/CVE/blob/main/python_food_Information_Disclosure.md; https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50647
CVE: CVE-2024-50648
Published: 2024-11-15
Description: yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/Yllxx03/CVE/blob/main/yshop_fileu_pload.md; https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50648
CVE: CVE-2024-50649
Published: 2024-11-15
Description: The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/Yllxx03/CVE/blob/main/python_book/FileUpload.md; https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50649
CVE: CVE-2024-50650
Published: 2024-11-15
Description: python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/Yllxx03/CVE/blob/main/python_book/BrokenAccessControl.md; https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50650
CVE: CVE-2024-50651
Published: 2024-11-15
Description: java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/Yllxx03/CVE/blob/main/java_shop/BrokenAccessControl.md; https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50651
CVE: CVE-2024-50652
Published: 2024-11-15
Description: A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/Yllxx03/CVE/blob/main/java_shop/FileUpload.md; https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50652
CVE: CVE-2024-50724
Published: 2024-11-15
Description: KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/youyuzhongli/KASO-SQL/blob/main/README.md
CVE: CVE-2024-51164
Published: 2024-11-15
Description: Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://abcc111.github.io/posts/CVE-2024-51164/; https://gitee.com/ketr/jepaas-release; https://github.com/abcc111/vulns/blob/main/JEPaaS/Multiple%20parameters%20have%20SQL%20injection%20issues%20in%20JEPAAS.md
CVE: CVE-2024-51494
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "descr" parameter when editing a device's port settings. This vulnerability can lead to the execution of malicious code when the "Port Settings" page is visited, potentially compromising the user's session and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/82a744bfe29017b8b58b5752ab9e1b335bedf0a0; https://github.com/librenms/librenms/security/advisories/GHSA-7663-37rg-c377
CVE: CVE-2024-51495
Published: 2024-11-15
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "overwrite_ip" parameter when editing a device. This vulnerability results in the execution of malicious code when the device overview page is visited, potentially compromising the accounts of other users. This vulnerability is fixed in 24.10.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/4568188ce9097a2e3a3b563311077f2bb82455c0; https://github.com/librenms/librenms/security/advisories/GHSA-p66q-ppwr-q5j8