stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2024-3821 (severity: HIGH, weakness: NVD-CWE-Other)
The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the wdt_ajax_actions.php file in all versions up to, and including, 6.3.2. This makes it possible for unauthenticated attackers to manipulate data tables. Please note this only affects the premium version of the plugin.
CVE-2024-38210 (severity: HIGH, weakness: CWE-125)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2024-38211 (severity: HIGH, weakness: CWE-601)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2024-38212 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-38213 (severity: MEDIUM, weakness: CWE-693)
Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2024-38214 (severity: MEDIUM, weakness: CWE-125)
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
CVE-2024-38215 (severity: HIGH, weakness: CWE-190)
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2024-38216 (severity: CRITICAL, weakness: CWE-20)
Azure Stack Hub Elevation of Privilege Vulnerability
CVE-2024-38217 (severity: MEDIUM, weakness: CWE-693)
Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2024-38218 (severity: HIGH, weakness: CWE-843)
Microsoft Edge (HTML-based) Memory Corruption Vulnerability
CVE-2024-38219 (severity: CRITICAL, weakness: CWE-843)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2024-3822 (severity: MEDIUM, weakness: CWE-79)
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2024-38220 (severity: CRITICAL, weakness: CWE-284)
Azure Stack Hub Elevation of Privilege Vulnerability
CVE-2024-38221 (severity: MEDIUM, weakness: CWE-79)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38222 (severity: MEDIUM, weakness: CWE-276)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-38223 (severity: MEDIUM, weakness: CWE-284)
Windows Initial Machine Configuration Elevation of Privilege Vulnerability
CVE-2024-38225 (severity: CRITICAL, weakness: CWE-287)
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
CVE-2024-38226 (severity: HIGH, weakness: CWE-693)
Microsoft Publisher Security Feature Bypass Vulnerability
CVE-2024-38227 (severity: HIGH, weakness: CWE-77)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-38228 (severity: HIGH, weakness: CWE-77)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-38229 (severity: HIGH, weakness: CWE-416)
.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-3823 (severity: LOW, weakness: CWE-352)
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVE-2024-38230 (severity: HIGH, weakness: CWE-20)
Windows Standards-Based Storage Management Service Denial of Service Vulnerability
CVE-2024-38231 (severity: HIGH, weakness: CWE-285)
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
CVE-2024-38232 (severity: HIGH, weakness: CWE-476)
Windows Networking Denial of Service Vulnerability
CVE-2024-38233 (severity: HIGH, weakness: CWE-476)
Windows Networking Denial of Service Vulnerability
CVE-2024-38234 (severity: MEDIUM, weakness: CWE-20)
Windows Networking Denial of Service Vulnerability
CVE-2024-38235 (severity: MEDIUM, weakness: CWE-416)
Windows Hyper-V Denial of Service Vulnerability
CVE-2024-38236 (severity: HIGH, weakness: CWE-400)
DHCP Server Service Denial of Service Vulnerability
CVE-2024-38237 (severity: HIGH, weakness: CWE-122)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2024-38238 (severity: HIGH, weakness: CWE-122)
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
CVE-2024-38239 (severity: HIGH, weakness: CWE-1390)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2024-3824 (severity: MEDIUM, weakness: CWE-352)
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
CVE-2024-38240 (severity: CRITICAL, weakness: CWE-125)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2024-38241 (severity: HIGH, weakness: CWE-20)
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
CVE-2024-38242 (severity: HIGH, weakness: CWE-122)
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
CVE-2024-38243 (severity: HIGH, weakness: CWE-20)
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
CVE-2024-38244 (severity: HIGH, weakness: CWE-20)
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
CVE-2024-38245 (severity: HIGH, weakness: CWE-20)
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
CVE-2024-38246 (severity: HIGH, weakness: CWE-121)
Win32k Elevation of Privilege Vulnerability
CVE-2024-38247 (severity: HIGH, weakness: CWE-415)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2024-38248 (severity: HIGH, weakness: CWE-416)
Windows Storage Elevation of Privilege Vulnerability
CVE-2024-38249 (severity: HIGH, weakness: CWE-416)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2024-3825 (severity: MEDIUM, weakness: CWE-352)
Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration
CVE-2024-38250 (severity: HIGH, weakness: CWE-126)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2024-38252 (severity: HIGH, weakness: CWE-416)
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2024-38253 (severity: HIGH, weakness: CWE-416)
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2024-38254 (severity: MEDIUM, weakness: CWE-908)
Windows Authentication Information Disclosure Vulnerability
CVE-2024-38255 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-38256 (severity: MEDIUM, weakness: CWE-908)
Windows Kernel-Mode Driver Information Disclosure Vulnerability
CVE-2024-38257 (severity: HIGH, weakness: CWE-908)
Microsoft AllJoyn API Information Disclosure Vulnerability
CVE-2024-38258 (severity: HIGH, weakness: CWE-23)
Windows Remote Desktop Licensing Service Information Disclosure Vulnerability
CVE-2024-38259 (severity: HIGH, weakness: CWE-416)
Microsoft Management Console Remote Code Execution Vulnerability
CVE-2024-3826 (severity: HIGH, weakness: CWE-287)
In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On (SSO) functionality.
CVE-2024-38260 (severity: HIGH, weakness: CWE-908)
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
CVE-2024-38261 (severity: HIGH, weakness: CWE-20)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-38262 (severity: HIGH, weakness: CWE-591)
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
CVE-2024-38263 (severity: HIGH, weakness: CWE-591)
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
CVE-2024-38264 (severity: MEDIUM, weakness: CWE-591)
Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability
CVE-2024-38265 (severity: HIGH, weakness: CWE-20)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-38266 (severity: MEDIUM, weakness: CWE-119)
An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device.
CVE-2024-38267 (severity: MEDIUM, weakness: CWE-119)
An improper restriction of operations within the bounds of a memory buffer in the IPv6 address parser of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device.
CVE-2024-38268 (severity: MEDIUM, weakness: CWE-119)
An improper restriction of operations within the bounds of a memory buffer in the MAC address parser of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device.
CVE-2024-38269 (severity: MEDIUM, weakness: CWE-119)
An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device.
CVE-2024-3827 (severity: MEDIUM, weakness: CWE-79)
The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-38270 (severity: MEDIUM, weakness: CWE-331)
An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive.
CVE-2024-38271 (severity: MEDIUM, weakness: CWE-404)
There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As part of the sequence of packets in a Quick Share connection over Bluetooth, the attacker forces the victim to connect to the attacker’s WiFi network and then sends an OfflineFrame that crashes Quick Share. This makes the Wifi connection to the attacker’s network last, instead of returning to the old network when the Quick Share session completes, allowing the attacker to be a MiTM. We recommend upgrading to version 1.0.1724.0 of Quick Share or above
CVE-2024-38272 (severity: HIGH, weakness: CWE-294)
There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above
CVE-2024-38273 (severity: MEDIUM, weakness: CWE-284)
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
CVE-2024-38274 (severity: MEDIUM, weakness: CWE-79)
Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.
CVE-2024-38275 (severity: HIGH, weakness: CWE-226)
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
CVE-2024-38276 (severity: HIGH, weakness: CWE-352)
Incorrect CSRF token checks resulted in multiple CSRF risks.
CVE-2024-38277 (severity: MEDIUM, weakness: CWE-324)
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
CVE-2024-38278 (severity: HIGH, weakness: CWE-266)
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416v2 V5.X (All versions < V5.9.0), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900GNC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300P V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG907R (All versions < V5.9.0), RUGGEDCOM RSG908C (All versions < V5.9.0), RUGGEDCOM RSG909R (All versions < V5.9.0), RUGGEDCOM RSG910C (All versions < V5.9.0), RUGGEDCOM RSG920P V5.X (All versions < V5.9.0), RUGGEDCOM RSG920PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSL910 (All versions < V5.9.0), RUGGEDCOM RSL910NC (All versions < V5.9.0), RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0), RUGGEDCOM RST916C (All versions < V5.9.0), RUGGEDCOM RST916P (All versions < V5.9.0). The affected products with IP forwarding enabled wrongly make available certain remote services in non-managed VLANs, even if these services are not intentionally activated. An attacker could leverage this vulnerability to create a remote shell to the affected system.
CVE-2024-38279 (severity: MEDIUM, weakness: CWE-288)
The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.
CVE-2024-3828 (severity: HIGH, weakness: NVD-CWE-Other)
The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the plugin allowing lower-privileged users to create registration forms and set the default role to administrator This makes it possible for authenticated attackers, with author-level access and above, to create administrator-level accounts.
CVE-2024-38280 (severity: HIGH, weakness: CWE-313)
An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.
CVE-2024-38281 (severity: HIGH, weakness: CWE-798)
An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.
CVE-2024-38282 (severity: HIGH, weakness: CWE-522)
Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the operations or shutdown the camera requiring a physical reboot of the system.
CVE-2024-38283 (severity: MEDIUM, weakness: CWE-311)
Sensitive customer information is stored in the device without encryption.
CVE-2024-38284 (severity: HIGH, weakness: CWE-294)
Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls.
CVE-2024-38285 (severity: HIGH, weakness: CWE-522)
Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.
CVE-2024-38286 (severity: HIGH, weakness: CWE-770)
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
CVE-2024-38287 (severity: CRITICAL, weakness: CWE-640)
The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator's password to a random insecure 8-digit value.
CVE-2024-38288 (severity: HIGH, weakness: CWE-77)
A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administrator privileges to execute arbitrary commands on the underlying server as root.
CVE-2024-38289 (severity: CRITICAL, weakness: CWE-89)
A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.
CVE-2024-3829 (severity: CRITICAL, weakness: CWE-20)
qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the filesystem and arbitrary file write by including a symlink and a payload file in the snapshot's directory structure. This vulnerability allows for the reading and writing of arbitrary files on the server, which could potentially lead to a full takeover of the system. The issue is fixed in version v1.9.0.
CVE-2024-38290 (severity: MEDIUM, weakness: CWE-200)
In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met.
CVE-2024-38291 (severity: HIGH, weakness: CWE-284)
In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.
CVE-2024-38292 (severity: CRITICAL, weakness: CWE-22)
In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation.
CVE-2024-38293 (severity: CRITICAL, weakness: CWE-352)
ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php.
CVE-2024-38294 (severity: HIGH, weakness: NVD-CWE-Other)
ALCASAR before 3.6.1 allows email_registration_back.php remote code execution.
CVE-2024-38295 (severity: HIGH, weakness: NVD-CWE-Other)
ALCASAR before 3.6.1 allows still_connected.php remote code execution.
CVE-2024-38296 (severity: MEDIUM, weakness: NVD-CWE-Other)
Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain an Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
CVE-2024-38301 (severity: HIGH, weakness: CWE-1107)
Dell Alienware Command Center, version 5.7.3.0 and prior, contains an improper access control vulnerability. A low privileged attacker could potentially exploit this vulnerability, leading to denial of service on the local system and information disclosure.
CVE-2024-38302 (severity: MEDIUM, weakness: CWE-311)
Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.
CVE-2024-38303 (severity: MEDIUM, weakness: CWE-20)
Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
CVE-2024-38304 (severity: MEDIUM, weakness: CWE-788)
Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
CVE-2024-38305 (severity: HIGH, weakness: CWE-426)
Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executables on the operating system with elevated privileges.
CVE-2024-38307 (severity: HIGH, weakness: CWE-20)
Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authenticated user to potentially enable denial of service via network access.
CVE-2024-38308 (severity: HIGH, weakness: CWE-79)
Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user. The device doesn't correctly neutralize malicious code when parsing HTTP requests to generate page output.
CVE-2024-38309 (severity: HIGH, weakness: CWE-121)
There are multiple stack-based buffer overflow vulnerabilities in V-SFT (v6.2.2.0 and earlier), TELLUS (v4.0.19.0 and earlier), and TELLUS Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.
CVE-2024-3831 (severity: MEDIUM, weakness: CWE-79)
The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-38310 (severity: MEDIUM, weakness: CWE-284)
Improper access control in some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2024-38311 (severity: MEDIUM, weakness: CWE-20)
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.
CVE-2024-38312 (severity: MEDIUM, weakness: CWE-922)
When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This vulnerability affects Firefox for iOS < 127.
CVE-2024-38313 (severity: MEDIUM, weakness: CWE-451)
In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects Firefox for iOS < 127.
CVE-2024-38314 (severity: MEDIUM, weakness: CWE-321)
IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment.
CVE-2024-38315 (severity: MEDIUM, weakness: CWE-613)
IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.
CVE-2024-38316 (severity: MEDIUM, weakness: CWE-770)
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.