deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-50159
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()

Clang static checker(scan-build) throws below warning：
  |  drivers/firmware/arm_scmi/driver.c:line 2915, column 2
  |        Attempt to free released memory.

When devm_add_action_or_reset() fails, scmi_debugfs_common_cleanup()
will run twice which causes double free of 'dbg->name'.

Remove the redundant scmi_debugfs_common_cleanup() to fix this problem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/39b13dce1a91cdfc3bec9238f9e89094551bd428; https://git.kernel.org/stable/c/6d91d07913aee90556362d648d6a28a1eda419dc; https://git.kernel.org/stable/c/fb324fdaf546bf14bc4c17e0037bca6cb952b121
CVE: CVE-2024-50160
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/cs8409: Fix possible NULL dereference

If snd_hda_gen_add_kctl fails to allocate memory and returns NULL, then
NULL pointer dereference will occur in the next line.

Since dolphin_fixups function is a hda_fixup function which is not supposed
to return any errors, add simple check before dereference, ignore the fail.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/21dc97d5086fdabbe278786bb0a03cbf2e26c793; https://git.kernel.org/stable/c/4e19aca8db696b6ba4dd8c73657405e15c695f14; https://git.kernel.org/stable/c/8971fd61210d75fd2af225621cd2fcc87eb1847c
CVE: CVE-2024-50161
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Check the remaining info_cnt before repeating btf fields

When trying to repeat the btf fields for array of nested struct, it
doesn't check the remaining info_cnt. The following splat will be
reported when the value of ret * nelems is greater than BTF_FIELDS_MAX:

  ------------[ cut here ]------------
  UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49
  index 11 is out of range for type 'btf_field_info [11]'
  CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1
  Tainted: [O]=OOT_MODULE
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...
  Call Trace:
   <TASK>
   dump_stack_lvl+0x57/0x70
   dump_stack+0x10/0x20
   ubsan_epilogue+0x9/0x40
   __ubsan_handle_out_of_bounds+0x6f/0x80
   ? kallsyms_lookup_name+0x48/0xb0
   btf_parse_fields+0x992/0xce0
   map_create+0x591/0x770
   __sys_bpf+0x229/0x2410
   __x64_sys_bpf+0x1f/0x30
   x64_sys_call+0x199/0x9f0
   do_syscall_64+0x3b/0xc0
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7fea56f2cc5d
  ......
   </TASK>
  ---[ end trace ]---

Fix it by checking the remaining info_cnt in btf_repeat_fields() before
repeating the btf fields.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://git.kernel.org/stable/c/6f957d972feee9b385ea3ae6530310a84e55ba71; https://git.kernel.org/stable/c/797d73ee232dd1833dec4824bc53a22032e97c1c
CVE: CVE-2024-50163
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Make sure internal and UAPI bpf_redirect flags don't overlap

The bpf_redirect_info is shared between the SKB and XDP redirect paths,
and the two paths use the same numeric flag values in the ri->flags
field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that
if skb bpf_redirect_neigh() is used with a non-NULL params argument and,
subsequently, an XDP redirect is performed using the same
bpf_redirect_info struct, the XDP path will get confused and end up
crashing, which syzbot managed to trigger.

With the stack-allocated bpf_redirect_info, the structure is no longer
shared between the SKB and XDP paths, so the crash doesn't happen
anymore. However, different code paths using identically-numbered flag
values in the same struct field still seems like a bit of a mess, so
this patch cleans that up by moving the flag definitions together and
redefining the three flags in BPF_F_REDIRECT_INTERNAL to not overlap
with the flags used for XDP. It also adds a BUILD_BUG_ON() check to make
sure the overlap is not re-introduced by mistake.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/09d88791c7cd888d5195c84733caf9183dcfbd16; https://git.kernel.org/stable/c/0fca5ed4be8e8bfbfb9bd97845af596bab7192d3; https://git.kernel.org/stable/c/314dbee9fe4f5cee36435465de52c988d7caa466
CVE: CVE-2024-50164
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix overloading of MEM_UNINIT's meaning

Lonial reported an issue in the BPF verifier where check_mem_size_reg()
has the following code:

    if (!tnum_is_const(reg->var_off))
        /* For unprivileged variable accesses, disable raw
         * mode so that the program is required to
         * initialize all the memory that the helper could
         * just partially fill up.
         */
         meta = NULL;

This means that writes are not checked when the register containing the
size of the passed buffer has not a fixed size. Through this bug, a BPF
program can write to a map which is marked as read-only, for example,
.rodata global maps.

The problem is that MEM_UNINIT's initial meaning that "the passed buffer
to the BPF helper does not need to be initialized" which was added back
in commit 435faee1aae9 ("bpf, verifier: add ARG_PTR_TO_RAW_STACK type")
got overloaded over time with "the passed buffer is being written to".

The problem however is that checks such as the above which were added later
via 06c1c049721a ("bpf: allow helpers access to variable memory") set meta
to NULL in order force the user to always initialize the passed buffer to
the helper. Due to the current double meaning of MEM_UNINIT, this bypasses
verifier write checks to the memory (not boundary checks though) and only
assumes the latter memory is read instead.

Fix this by reverting MEM_UNINIT back to its original meaning, and having
MEM_WRITE as an annotation to BPF helpers in order to then trigger the
BPF verifier checks for writing to memory.

Some notes: check_arg_pair_ok() ensures that for ARG_CONST_SIZE{,_OR_ZERO}
we can access fn->arg_type[arg - 1] since it must contain a preceding
ARG_PTR_TO_MEM. For check_mem_reg() the meta argument can be removed
altogether since we do check both BPF_READ and BPF_WRITE. Same for the
equivalent check_kfunc_mem_size_reg().
CVSS Score: 7.1 (HIGH)
References: https://git.kernel.org/stable/c/43f4df339a4d375bedcad29a61ae6f0ee7a048f8; https://git.kernel.org/stable/c/48068ccaea957469f1adf78dfd2c1c9a7e18f0fe; https://git.kernel.org/stable/c/54bc[PII_REDACTED]0af1bed7ca7a19f182df8d3df8
CVE: CVE-2024-50165
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve param->string when parsing mount options

In bpf_parse_param(), keep the value of param->string intact so it can
be freed later. Otherwise, the kmalloc area pointed to by param->string
will be leaked as shown below:

unreferenced object 0xffff888118c46d20 (size 8):
  comm "new_name", pid 12109, jiffies[PII_REDACTED]
  hex dump (first 8 bytes):
    61 6e 79 00 38 c9 5c 7e                          any.8.\~
  backtrace (crc e1b7f876):
    [<00000000c6848ac7>] kmemleak_alloc+0x4b/0x80
    [<00000000de9f7d00>] __kmalloc_node_track_caller_noprof+0x36e/0x4a0
    [<000000003e29b886>] memdup_user+0x32/0xa0
    [<[PII_REDACTED]>] strndup_user+0x46/0x60
    [<[PII_REDACTED]b3dd29>] __x64_sys_fsconfig+0x368/0x3d0
    [<[PII_REDACTED]>] x64_sys_call+0xff/0x9f0
    [<00000000c0cabc95>] do_syscall_64+0x3b/0xc0
    [<000000002f331597>] entry_SYSCALL_64_after_hwframe+0x4b/0x53
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/1f97c03f43fadc407de5b5cb01c07755053e1c22; https://git.kernel.org/stable/c/5d7a0a[PII_REDACTED][PII_REDACTED]9cb768a2f5c2c4
CVE: CVE-2024-50166
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

fsl/fman: Fix refcount handling of fman-related devices

In mac_probe() there are multiple calls to of_find_device_by_node(),
fman_bind() and fman_port_bind() which takes references to of_dev->dev.
Not all references taken by these calls are released later on error path
in mac_probe() and in mac_remove() which lead to reference leaks.

Add references release.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1; https://git.kernel.org/stable/c/3c2a3619d565fe16bf59b0a047bab103a2ee4490; https://git.kernel.org/stable/c/5ed4334fc9512f934fe2ae9c4cf7f8142e451b8b
CVE: CVE-2024-50167
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

be2net: fix potential memory leak in be_xmit()

The be_xmit() returns NETDEV_TX_OK without freeing skb
in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/4c5f170ef4f85731a4d43ad9a6ac51106c0946be; https://git.kernel.org/stable/c/641c1beed52bf3c6deb0193fe4d38ec9ff75d2ae; https://git.kernel.org/stable/c/6b7ce8ee01c33c380aaa5077ff25215492e7eb0e
CVE: CVE-2024-50168
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()

The sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb
in case of skb->len being too long, add dev_kfree_skb() to fix it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/137010d26dc5cd47cd62fef77cbe952d31951b7a; https://git.kernel.org/stable/c/1a17a4ac2d57102497fac53b53c666dba6a0c20d; https://git.kernel.org/stable/c/2cb3f56e827abb22c4168ad0c1bbbf401bb2f3b8
CVE: CVE-2024-50169
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

vsock: Update rx_bytes on read_skb()

Make sure virtio_transport_inc_rx_pkt() and virtio_transport_dec_rx_pkt()
calls are balanced (i.e. virtio_vsock_sock::rx_bytes doesn't lie) after
vsock_transport::read_skb().

While here, also inform the peer that we've freed up space and it has more
credit.

Failing to update rx_bytes after packet is dequeued leads to a warning on
SOCK_STREAM recv():

[  233.396654] rx_queue is empty, but rx_bytes is non-zero
[  233.396702] WARNING: CPU: 11 PID: 40601 at net/vmw_vsock/virtio_transport_common.c:589
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3543152f2d330141d9394d28855cb90b860091d2; https://git.kernel.org/stable/c/66cd51de31c682a311c2fa25c580b7ea45859dd9; https://git.kernel.org/stable/c/e5ca2b98090b4bb1c393088c724af6c37812a829
CVE: CVE-2024-50170
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

net: bcmasp: fix potential memory leak in bcmasp_xmit()

The bcmasp_xmit() returns NETDEV_TX_OK without freeing skb
in case of mapping fails, add dev_kfree_skb() to fix it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/7218de0778aefbbbcfe474a55f88bbf6f244627d; https://git.kernel.org/stable/c/f689f20d3e09f2d4d0a2c575a9859115a33e68bd; https://git.kernel.org/stable/c/fed07d3eb8a8d9fcc0e455175a89bc6445d6faed
CVE: CVE-2024-50171
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

net: systemport: fix potential memory leak in bcm_sysport_xmit()

The bcm_sysport_xmit() returns NETDEV_TX_OK without freeing skb
in case of dma_map_single() fails, add dev_kfree_skb() to fix it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/31701ef0c[PII_REDACTED]ff63596c927f841dfd133; https://git.kernel.org/stable/c/4b70478b984af3c9d0279c121df5ff94e2533dbd; https://git.kernel.org/stable/c/533d2f30aef272dade17870a509521c3afc38a03
CVE: CVE-2024-50172
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Fix a possible memory leak

In bnxt_re_setup_chip_ctx() when bnxt_qplib_map_db_bar() fails
driver is not freeing the memory allocated for "rdev->chip_ctx".
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/3fc5410f225d1651580a4aeb7c72f55e28673b53; https://git.kernel.org/stable/c/595fa9b17201028d35f92d450fc0ecda873fe469; https://git.kernel.org/stable/c/73e04a6114e08b5eb10e589e12b680955accb376
CVE: CVE-2024-51504
Published: 2024-11-07
Description: When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-290
References: https://lists.apache.org/thread/b3qrmpkto5r6989qr61fw9y2x646kqlh; http://www.openwall.com/lists/oss-security/2024/11/06/5
CVE: CVE-2024-10526
Published: 2024-11-07
Description: Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely.  This issue is fixed in version 0.73.3.
CWE: CWE-552, CWE-732
References: https://docs.velociraptor.app/announcements/2024-cves/
CVE: CVE-2024-24914
Published: 2024-11-07
Description: Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.
CVSS Score: 8.0 (HIGH)
CWE: CWE-914
References: https://support.checkpoint.com/results/sk/sk182743
CVE: CVE-2024-8442
Published: 2024-11-07
Description: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Blog widget in all versions up to, and including, 3.15.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/trunk/traits/global-widget-controls.php#L2328; https://plugins.trac.wordpress.org/changeset/3182825/; https://wordpress.org/plugins/bdthemes-prime-slider-lite/#developers
CVE: CVE-2024-43425
Published: 2024-11-07
Description: A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304253; https://moodle.org/mod/forum/discuss.php?d=461193
CVE: CVE-2024-43426
Published: 2024-11-07
Description: A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1287
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304254; https://moodle.org/mod/forum/discuss.php?d=461194
CVE: CVE-2024-43428
Published: 2024-11-07
Description: To address a cache poisoning risk in Moodle, additional validation for local storage was required.
CVSS Score: 7.7 (HIGH)
CWE: CWE-345
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304256; https://moodle.org/mod/forum/discuss.php?d=461196
CVE: CVE-2024-43431
Published: 2024-11-07
Description: A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304259; https://moodle.org/mod/forum/discuss.php?d=461199
CVE: CVE-2024-43434
Published: 2024-11-07
Description: The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304262; https://moodle.org/mod/forum/discuss.php?d=461203
CVE: CVE-2024-43436
Published: 2024-11-07
Description: A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304264; https://moodle.org/mod/forum/discuss.php?d=461206
CVE: CVE-2024-43438
Published: 2024-11-07
Description: A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304267; https://moodle.org/mod/forum/discuss.php?d=461208
CVE: CVE-2024-43440
Published: 2024-11-07
Description: A flaw was found in moodle. A local file may include risks when restoring block backups.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304269; https://moodle.org/mod/forum/discuss.php?d=461210
CVE: CVE-2024-9926
Published: 2024-11-07
Description: The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/669382af-f836-4896-bdcb-5c6a57c99bd9/
CVE: CVE-2024-10668
Published: 2024-11-07
Description: There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the fact that when a Payload Transfer frame of type FILE is sent to Quick Share, the file that is contained in this frame is written to disk in the Downloads folder. Quickshare normally deletes unkown files, however an attacker can send two Payload transfer frames of type FILE and the same payload ID. The deletion logic will only delete the first file and not the second. We recommend upgrading past commit 5d8b9156e0c339d82d3dab0849187e8819ad92c0 or Quick Share Windows v1.0.2002.2
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/google/nearby/pull/2892
CVE: CVE-2024-10963
Published: 2024-11-07
Description: A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.
CVSS Score: 7.4 (HIGH)
CWE: CWE-287
References: https://access.redhat.com/errata/RHSA-2024:10232; https://access.redhat.com/errata/RHSA-2024:10244; https://access.redhat.com/errata/RHSA-2024:10379
CVE: CVE-2024-8378
Published: 2024-11-07
Description: The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/17be4bf2-486d-43ab-b87a-2117c8d77ca8/
CVE: CVE-2024-10964
Published: 2024-11-07
Description: A vulnerability classified as critical has been found in emqx neuron up to 2.10.0. Affected is the function handle_add_plugin in the library cmd.library of the file plugins/restful/plugin_handle.c. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/emqx/neuron/issues/2280; https://github.com/emqx/neuron/pull/2286; https://github.com/emqx/neuron/pull/2286/commits/3e3a583d72548af1740b3e61a5eab3b628cc439e
CVE: CVE-2024-10965
Published: 2024-11-07
Description: A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2/schema of the component JSON File Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The patch is named c9ce39747e0372aaa2157b2b56174914a12c06d8. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/emqx/neuron/issues/2281; https://github.com/emqx/neuron/pull/2282; https://github.com/fengzeroz/neuron/commit/c9ce39747e0372aaa2157b2b56174914a12c06d8
CVE: CVE-2024-40715
Published: 2024-11-07
Description: A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle (MITM) attack to exploit this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-294
References: https://www.veeam.com/kb4682
CVE: CVE-2024-48950
Published: 2024-11-07
Description: An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF protections and authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://docs.logpoint.com/docs/whats-new-in-logpoint/en/latest/; https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]4525-Authentication-and-CSRF-bypass-leading-to-unauthorized-access; https://servicedesk.logpoint.com/hc/en-us/sections/[PII_REDACTED]845-Product-Security
CVE: CVE-2024-48951
Published: 2024-11-07
Description: An issue was discovered in Logpoint before 7.5.0. Server-Side Request Forgery (SSRF) on SOAR can be used to leak Logpoint's API Token leading to authentication bypass.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://docs.logpoint.com/docs/whats-new-in-logpoint/en/latest/; https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]1261-Server-Side-Request-Forgery-SSRF-on-SOAR-results-in-authentication-bypass; https://servicedesk.logpoint.com/hc/en-us/sections/[PII_REDACTED]845-Product-Security
CVE: CVE-2024-48952
Published: 2024-11-07
Description: An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-306
References: https://docs.logpoint.com/docs/whats-new-in-logpoint/en/latest/; https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]3693-Static-JWT-Key-enables-unauthorized-API-access; https://servicedesk.logpoint.com/hc/en-us/sections/[PII_REDACTED]845-Product-Security