deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43609
Published: 2024-10-08
Description: Microsoft Office Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43609
CVE: CVE-2024-43611
Published: 2024-10-08
Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43611
CVE: CVE-2024-43612
Published: 2024-10-08
Description: Power BI Report Server Spoofing Vulnerability
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43612
CVE: CVE-2024-43614
Published: 2024-10-08
Description: Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-23
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43614
CVE: CVE-2024-43615
Published: 2024-10-08
Description: Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43615
CVE: CVE-2024-43616
Published: 2024-10-08
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43616
CVE: CVE-2024-46410
Published: 2024-10-08
Description: PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/sanluan/PublicCMS; https://github.com/trengh222/publiccms_xss
CVE: CVE-2024-46539
Published: 2024-10-08
Description: Insecure permissions in the Bluetooth Low Energy (BLE) component of Fire-Boltt Artillery Smart Watch NJ-R6E-10.3 allow attackers to cause a Denial of Service (DoS).
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://github.com/harishmanam/-Fireboltt-Artillery-Smartwatch/blob/main/FB_Artillerysmart_watch_Security_Assessment_report.pdf; https://nvd.nist.gov/vuln/detail/CVE-2024-32368
CVE: CVE-2024-47773
Published: 2024-10-08
Description: Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable anonymous cache by setting the `DISCOURSE_DISABLE_ANON_CACHE` environment variable to a non-empty value.
CVSS Score: 8.2 (HIGH)
CWE: CWE-610
References: https://github.com/discourse/discourse/security/advisories/GHSA-58vv-9j8h-hw2v
CVE: CVE-2024-47780
Published: 2024-10-08
Description: TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. Users are advised to update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. There are no known workarounds for this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-rf5m-h8q9-9w6q; https://typo3.org/security/advisory/typo3-core-sa-2024-012
CVE: CVE-2024-47822
Published: 2024-10-08
Description: Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the `LOG_STYLE` is set to `raw`. The `access_token` in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string. This vulnerability has been patched in release version 10.13.2 and subsequent releases as well. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-532
References: https://github.com/directus/directus/commit/2e893f9c576d5a02506272fe2c0bcc12e6c58768; https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp
CVE: CVE-2024-47823
Published: 2024-10-08
Description: Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., `image/png`) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack: 1. Filename is composed of the original file name using `$file->getClientOriginalName()`. 2. Files stored directly on your server in a public storage disk. 3. Webserver is configured to execute “.php” files. This issue has been addressed in release versions `2.12.7` and `3.5.2`. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-434
References: https://github.com/livewire/livewire/commit/70503b79f5db75a1eac9bf55826038a6ee5a16d5; https://github.com/livewire/livewire/commit/cd168c6212ea13d13b82b[PII_REDACTED]f82d9fad9; https://github.com/livewire/livewire/pull/8624
CVE: CVE-2024-27457
Published: 2024-10-08
Description: Improper check for unusual or exceptional conditions in Intel(R) TDX Module firmware before version 1.5.06 may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 2.5 (LOW)
CWE: CWE-754
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01099.html
CVE: CVE-2024-36814
Published: 2024-10-08
Description: An arbitrary file read vulnerability in Adguard Home before v0.107.52 allows authenticated attackers to access arbitrary files as root on the underlying Operating System via placing a crafted file into a readable directory.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/AdguardTeam/AdGuardHome/; https://github.com/AdguardTeam/AdGuardHome/blob/7c002e1a99b9b4e4a40e8c66851eda33e666d52d/internal/filtering/http.go#L23C1-L51C2; https://github.com/itz-d0dgy/
CVE: CVE-2024-9412
Published: 2024-10-08
Description: An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an unauthorized user could access data they previously but should no longer have access to.
CWE: CWE-842
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201704.html
CVE: CVE-2024-9602
Published: 2024-10-08
Description: Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html; https://issues.chromium.org/issues/368241697
CVE: CVE-2024-9603
Published: 2024-10-08
Description: Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html; https://issues.chromium.org/issues/367818758
CVE: CVE-2024-7963
Published: 2024-10-09
Description: The CMSMasters Content Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's multiple shortcodes in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: http://cmsmasters.net/; https://www.wordfence.com/threat-intel/vulnerabilities/id/42c1d2ea-dea6-4cde-8db3-37709da9eb71?source=cve
CVE: CVE-2024-25282
Published: 2024-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-25283
Published: 2024-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-25284
Published: 2024-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-25285
Published: 2024-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-25286
Published: 2024-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-35288
Published: 2024-10-09
Description: Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM.
CVSS Score: 7.8 (HIGH)
References: https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-nitro-pdf-pro/; https://seclists.org/fulldisclosure/2024/Sep/59; https://www.gonitro.com/support/downloads#securityUpdates
CVE: CVE-2024-45179
Published: 2024-10-09
Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command injection attacks. It was found out that different functionality is vulnerable to OS command injection attacks, for example for generating new X.509 certificates, or setting the time zone. These OS command injection vulnerabilities in the script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data (e.g., the city parameter). The OS command injection vulnerability in the script settimezone.pml or setdatetime.pml (e.g., via the year parameter) requires an administrative user for the C-MOR web interface. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1289
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-030.txt; http://seclists.org/fulldisclosure/2024/Sep/23
CVE: CVE-2024-32608
Published: 2024-10-09
Description: HDF5 library through 1.14.3 has memory corruption in H5A__close resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE: CVE-2024-42934
Published: 2024-10-09
Description: OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator, resulting in denial of service or (with very low probability) authentication bypass or code execution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=2308375; https://sourceforge.net/p/openipmi/code/ci/4c129d0540f3578ecc078d8612bbf84b6cd24c87; https://sourceforge.net/p/openipmi/code/ci/b52e8e2538b2b48ef6b63bff12b5cc9e2d52eff1/
CVE: CVE-2024-45160
Published: 2024-10-09
Description: Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/06d771cbc2d5c752354c50f83e4912e5879f9aa2; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/236cdfe42c1dc04a15a4a40c5e6a8c2e858d71d7; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/696f49a0855faeb271096dccb8381e2129687c3d
CVE: CVE-2024-47191
Published: 2024-10-09
Description: pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/3235a52f6b87cd1c5da6508f421ac261f5e33a70; https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/[PII_REDACTED]fde35ab0163b558fc29e80c3a280e5; https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/60d9902b5c20f27e70f8e9c816bfdc0467567e1a
CVE: CVE-2023-36325
Published: 2024-10-09
Description: i2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation attack across the IPv4 and IPv6 addresses that occurs when a tunneled, replayed message has a behavior discrepancy (it may be dropped, or may result in a Wrong Destination response). An attack would take days to complete.
CVSS Score: 3.7 (LOW)
CWE: CWE-203
References: https://geti2p.net/en/blog/post/2023/06/25/new_release_2.3.0; https://i2pgit.org/i2p-hackers/i2p.i2p/-/commit/82aa4e19fbb37ca1bd752ec1b836120beec0985f; https://xeiaso.net/blog/CVE-2023-36325
CVE: CVE-2023-37154
Published: 2024-10-09
Description: check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. This has been categorized both as fixed in e8810de, and as intended behavior.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-p3gv-vmpx-hhw4; https://github.com/nagios-plugins/nagios-plugins/commit/e8810de21be80148562b7e0168b0a62aeedffde6; https://joshua.hu/nagios-hacking-cve-2023-37154
CVE: CVE-2023-45359
Published: 2024-10-09
Description: An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/skins/Vector/+/c17b956e0750e051ac7c1098e3ff625f0db82b2c; https://phabricator.wikimedia.org/T340217
CVE: CVE-2023-45361
Published: 2024-10-09
Description: An issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-intro-page MalformedTitleException is uncaught if it is not a valid title, leading to incorrect web pages.
CVSS Score: 6.1 (MEDIUM)
References: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/skins/Vector/+/2a452b7e2562cba32b8a17bc91dc5abb531f0a1c; https://phabricator.wikimedia.org/T340220
CVE: CVE-2023-45872
Published: 2024-10-09
Description: An issue was discovered in Qt before 6.2.11 and 6.3.x through 6.6.x before 6.6.1. When a QML image refers to an image whose content is not known yet, there is an assumption that it is an SVG document, leading to a denial of service (application crash) if it is not actually an SVG document.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.redhat.com/show_bug.cgi?id=2246067; https://qt.io
CVE: CVE-2023-46586
Published: 2024-10-09
Description: cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119
References: https://github.com/ltworf/weborf/commit/49824204add55aab0568d90a6b1e7c822d32120d; https://github.com/ltworf/weborf/commit/6f83c3e9ceed8b0d93608fd5d42b53c081057991; https://github.com/ltworf/weborf/pull/88
CVE: CVE-2024-5968
Published: 2024-10-09
Description: The Photo Gallery by 10Web  WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/db73e8d8-feb1-4daa-937e-a73969a93bcc/
CVE: CVE-2024-39436
Published: 2024-10-09
Description: In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]04624897
CVE: CVE-2024-39437
Published: 2024-10-09
Description: In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]04624897
CVE: CVE-2024-39438
Published: 2024-10-09
Description: In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]04624897
CVE: CVE-2024-39439
Published: 2024-10-09
Description: In DRM service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]04624897
CVE: CVE-2024-39440
Published: 2024-10-09
Description: In DRM service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with System execution privileges needed.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]04624897
CVE: CVE-2024-39586
Published: 2024-10-09
Description: Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially exploit this vulnerability, leading to information disclosure.
CVSS Score: 2.9 (LOW)
CWE: CWE-611
References: https://www.dell.com/support/kbdoc/en-us/000234216/dsa-2024-420-security-update-for-dell-emc-appsync-for-multiple-vulnerabilities
CVE: CVE-2024-9449
Published: 2024-10-09
Description: The Auto iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/auto-iframe/trunk/auto-iframe.php#L127; https://plugins.trac.wordpress.org/browser/auto-iframe/trunk/auto-iframe.php#L173; https://plugins.trac.wordpress.org/changeset/3164574/
CVE: CVE-2024-9451
Published: 2024-10-09
Description: The Embed PDF Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' and 'width' parameters in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/embed-pdf-viewer/trunk/embed-pdf-viewer.php#L144; https://plugins.trac.wordpress.org/browser/embed-pdf-viewer/trunk/embed-pdf-viewer.php#L258; https://plugins.trac.wordpress.org/changeset/3164573/
CVE: CVE-2024-20787
Published: 2024-10-09
Description: Substance3D - Painter versions 10.0.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb24-52.html
CVE: CVE-2024-45146
Published: 2024-10-09
Description: Dimension versions 4.0.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/dimension/apsb24-74.html
CVE: CVE-2024-45150
Published: 2024-10-09
Description: Dimension versions 4.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/dimension/apsb24-74.html
CVE: CVE-2024-45145
Published: 2024-10-09
Description: Lightroom Desktop versions 7.4.1, 13.5, 12.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/lightroom/apsb24-78.html
CVE: CVE-2024-47410
Published: 2024-10-09
Description: Animate versions 23.0.7, 24.0.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb24-76.html
CVE: CVE-2024-47411
Published: 2024-10-09
Description: Animate versions 23.0.7, 24.0.4 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/animate/apsb24-76.html