deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-35632
Published: 2024-06-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through 1.1.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/cf7-constant-contact/wordpress-integration-for-constant-contact-and-contact-form-7-wpforms-elementor-ninja-forms-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cf7-constant-contact/wordpress-integration-for-constant-contact-and-contact-form-7-wpforms-elementor-ninja-forms-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-0336
Published: 2024-06-03
Description: Missing Authentication for Critical Function vulnerability in EMTA Grup PDKS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDKS: from V3.04 before 20240603. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CWE: CWE-306
References: https://www.usom.gov.tr/bildirim/tr-24-0600; https://www.usom.gov.tr/bildirim/tr-24-0600
CVE: CVE-2024-36568
Published: 2024-06-03
Description: Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/debug601/bug_report/blob/main/vendors/mayuri_k/gas-agency-management-system/SQL-1.md; https://github.com/debug601/bug_report/blob/main/vendors/mayuri_k/gas-agency-management-system/SQL-1.md
CVE: CVE-2024-36569
Published: 2024-06-03
Description: Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://github.com/debug601/bug_report/blob/main/vendors/mayuri_k/gas-agency-management-system/RCE-1.md; https://github.com/debug601/bug_report/blob/main/vendors/mayuri_k/gas-agency-management-system/RCE-1.md
CVE: CVE-2024-36728
Published: 2024-06-03
Description: TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action vlan_setting with a sufficiently long dns1 or dns 2 key.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121
References: https://github.com/HouseFuzz/reports/blob/main/trendnet/TEW827/vlan_setting/vlan_setting.md; https://github.com/HouseFuzz/reports/blob/main/trendnet/TEW827/vlan_setting/vlan_setting.md
CVE: CVE-2024-36729
Published: 2024-06-03
Description: TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action wizard_ipv6 with a sufficiently long reboot_type key.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/HouseFuzz/reports/blob/main/trendnet/TEW827/wizard_ipv6/wizard_ipv6.md; https://github.com/HouseFuzz/reports/blob/main/trendnet/TEW827/wizard_ipv6/wizard_ipv6.md
CVE: CVE-2024-5197
Published: 2024-06-03
Description: There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-190
References: https://g-issues.chromium.org/issues/332382766; https://lists.debian.org/debian-lts-announce/2024/06/msg00005.html; https://g-issues.chromium.org/issues/332382766
CVE: CVE-2024-36123
Published: 2024-06-03
Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/c11fbf67a99366d5a40ef880469b222679e3b475/includes/Components/CitizenComponentPageHeading.php#L190-L195; https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/c11fbf67a99366d5a40ef880469b222679e3b475/includes/Components/CitizenComponentPageHeading.php#L197-L201; https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/4a43280242f33e54643087da4a7f40970d2640c9
CVE: CVE-2024-36124
Published: 2024-06-03
Description: iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9; https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9
CVE: CVE-2024-36127
Published: 2024-06-03
Description: apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-532
References: https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01; https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp; https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63fc2a11eff01
CVE: CVE-2024-36128
Published: 2024-06-03
Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b; https://github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5; https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b
CVE: CVE-2024-32983
Published: 2024-06-03
Description: Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-863
References: https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88; https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj; https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88
CVE: CVE-2024-36674
Published: 2024-06-03
Description: LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LyLme/lylme_spage/issues/91; https://github.com/LyLme/lylme_spage/issues/91
CVE: CVE-2024-4540
Published: 2024-06-03
Description: A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://access.redhat.com/errata/RHSA-2024:3566; https://access.redhat.com/errata/RHSA-2024:3567; https://access.redhat.com/errata/RHSA-2024:3568
CVE: CVE-2024-37019
Published: 2024-06-03
Description: Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://mender.io/blog/cve-2024-37019-account-takeover-using-saml; https://northern.tech; https://mender.io/blog/cve-2024-37019-account-takeover-using-saml
CVE: CVE-2024-4332
Published: 2024-06-03
Description: An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.
CWE: CWE-303, CWE-306
References: https://www.fortra.com/security/advisory/fi-2024-006; https://www.fortra.com/security/advisory/fi-2024-006
CVE: CVE-2021-3899
Published: 2024-06-03
Description: There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1948376; https://ubuntu.com/security/notices/USN-5427-1; https://www.cve.org/CVERecord?id=CVE-2021-3899
CVE: CVE-2022-0555
Published: 2024-06-03
Description: Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
CVSS Score: 8.4 (HIGH)
CWE: CWE-256
References: https://bugs.launchpad.net/subiquity/+bug/1960162; https://github.com/canonical/subiquity/pull/1181; https://github.com/canonical/subiquity/pull/1182
CVE: CVE-2022-1242
Published: 2024-06-03
Description: Apport can be tricked into connecting to arbitrary sockets as the root user
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://ubuntu.com/security/notices/USN-5427-1; https://www.cve.org/CVERecord?id=CVE-2022-1242; https://ubuntu.com/security/notices/USN-5427-1
CVE: CVE-2024-31684
Published: 2024-06-03
Description: Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass fingerprint authentication due to the use of a deprecated API.
CVSS Score: 3.5 (LOW)
CWE: CWE-306
References: https://play.google.com/store/apps/details?id=com.choiceoflove.dating&hl=en_US; https://zzzxiin.github.io/post/choice-of-love/; https://play.google.com/store/apps/details?id=com.choiceoflove.dating&hl=en_US
CVE: CVE-2024-5214
Published: 2024-06-03
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-5387
Published: 2024-06-03
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-5388
Published: 2024-06-03
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-51219
Published: 2024-06-03
Description: A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access token could be used to take over another user's account and read her/his chat messages.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://news.ycombinator.com/item?id=40776880; https://stulle123.github.io/posts/kakaotalk-account-takeover/; https://news.ycombinator.com/item?id=40776880
CVE: CVE-2023-52162
Published: 2024-06-03
Description: Mercusys MW325R EU V3 (Firmware MW325R(EU)_V3_1.11.0 Build 221019) is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code. Exploiting the vulnerability requires authentication.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121
References: https://k4m1ll0.com/cve-2023-52162.html; https://k4m1ll0.com/cve-2023-52162.html; https://www.vicarius.io/vsociety/posts/mercusys-mw325r-reverse-engineering-part-3-authenticated-remote-code-execution-cve-2023-52162
CVE: CVE-2024-31682
Published: 2024-06-03
Description: Incorrect access control in the fingerprint authentication mechanism of Phone Cleaner: Boost & Clean v2.2.0 allows attackers to bypass fingerprint authentication due to the use of a deprecated API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://zzzxiin.github.io/post/phone-cleaner/; https://zzzxiin.github.io/post/phone-cleaner/
CVE: CVE-2024-34051
Published: 2024-06-03
Description: A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://blog.smarttecs.com/posts/2024-004-cve-2024-34051/; https://blog.smarttecs.com/posts/2024-004-cve-2024-34051/
CVE: CVE-2024-34987
Published: 2024-06-03
Description: A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input field during the login process.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.md; https://www.exploit-db.com/exploits/51989; https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.md
CVE: CVE-2024-36783
Published: 2024-06-03
Description: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20LR350/NTPSyncWithHost/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20LR350/NTPSyncWithHost/README.md
CVE: CVE-2024-36782
Published: 2024-06-03
Description: TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20cp300/README.md; https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20cp300/README.md
CVE: CVE-2023-23730
Published: 2024-06-03
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: from n/a through 2.3.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-captcha-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-captcha-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-23735
Published: 2024-06-03
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affects Spectra: from n/a through 2.3.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-unauthenticated-email-html-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-unauthenticated-email-html-injection-vulnerability?_s_id=cve
CVE: CVE-2023-23738
Published: 2024-06-03
Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Brainstorm Force Spectra allows Content Spoofing, Phishing.This issue affects Spectra: from n/a through 2.3.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-unauthenticated-email-spoofing-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-3-0-unauthenticated-email-spoofing-vulnerability?_s_id=cve
CVE: CVE-2023-24373
Published: 2024-06-03
Description: External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.
CVSS Score: 3.7 (LOW)
CWE: CWE-472
References: https://patchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-26521
Published: 2024-06-03
Description: Missing Authorization vulnerability in CodePeople Search in Place allows Functionality Misuse.This issue affects Search in Place: from n/a through 1.0.104.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/search-in-place/wordpress-search-in-place-plugin-1-0-104-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/search-in-place/wordpress-search-in-place-plugin-1-0-104-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve
CVE: CVE-2023-26523
Published: 2024-06-03
Description: Missing Authorization vulnerability in CodePeople Calculated Fields Form allows Functionality Misuse.This issue affects Calculated Fields Form: from n/a through 1.1.120.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/calculated-fields-form/wordpress-calculated-fields-form-plugin-1-1-120-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/calculated-fields-form/wordpress-calculated-fields-form-plugin-1-1-120-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve
CVE: CVE-2023-27437
Published: 2024-06-03
Description: Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf allows Functionality Misuse.This issue affects Event Espresso 4 Decaf: from n/a through 4.10.44.Decaf.
CVSS Score: 3.7 (LOW)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/event-espresso-decaf/wordpress-event-espresso-4-decaf-plugin-4-10-44-decaf-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/event-espresso-decaf/wordpress-event-espresso-4-decaf-plugin-4-10-44-decaf-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-27460
Published: 2024-06-03
Description: Missing Authorization vulnerability in CodePeople, paypaldev CP Contact Form with Paypal allows Functionality Misuse.This issue affects CP Contact Form with Paypal: from n/a through 1.3.34.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/cp-contact-form-with-paypal/wordpress-cp-contact-form-with-paypal-plugin-1-3-34-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cp-contact-form-with-paypal/wordpress-cp-contact-form-with-paypal-plugin-1-3-34-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve
CVE: CVE-2023-28492
Published: 2024-06-03
Description: Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Functionality Misuse.This issue affects CP Multi View Event Calendar: from n/a through 1.4.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/cp-multi-view-calendar/wordpress-calendar-event-multi-view-plugin-1-4-10-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cp-multi-view-calendar/wordpress-calendar-event-multi-view-plugin-1-4-10-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve
CVE: CVE-2024-29972
Published: 2024-06-04
Description: ** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024; https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
CVE: CVE-2024-29973
Published: 2024-06-04
Description: ** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024; https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
CVE: CVE-2024-29974
Published: 2024-06-04
Description: ** UNSUPPORTED WHEN ASSIGNED **
The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024; https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
CVE: CVE-2024-29975
Published: 2024-06-04
Description: ** UNSUPPORTED WHEN ASSIGNED **
The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024; https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/