stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2024-4897 (severity: HIGH, weakness: CWE-76)
parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindings_zoo' feature, specifically when processing gguf format model files.
CVE-2024-48970 (severity: CRITICAL, weakness: CWE-1191)
The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause unauthorized information disclosure.
CVE-2024-48971 (severity: CRITICAL, weakness: CWE-798)
The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges.
CVE-2024-48973 (severity: CRITICAL, weakness: CWE-1263)
The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
CVE-2024-48974 (severity: CRITICAL, weakness: CWE-494)
The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure.
CVE-2024-4898 (severity: CRITICAL, weakness: CWE-862)
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.
CVE-2024-48981 (severity: HIGH, weakness: CWE-120)
An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet header by looking up the identifying first byte and matching it against a table of possible lengths. The initial parsing function, hciTrSerialRxIncoming does not drop packets with invalid identifiers but also does not set a safe default for the length of unknown packets' headers, leading to a buffer overflow. This can be leveraged into an arbitrary write by an attacker. It is possible to overwrite the pointer to a not-yet-allocated buffer that is supposed to receive the contents of the packet body. One can then overwrite the state variable used by the function to determine which state of packet parsing is currently occurring. Because the buffer is allocated when the last byte of the header has been copied, the combination of having a bad header length variable that will never match the counter variable and being able to overwrite the state variable with the resulting buffer overflow can be used to advance the function to the next step while skipping the buffer allocation and resulting pointer write. The next 16 bytes from the packet body are then written wherever the corrupted data pointer is pointing.
CVE-2024-48982 (severity: HIGH, weakness: CWE-120)
An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. This value is assumed to be greater than or equal to 3, but the software doesn't ensure that this is the case. Supplying a length less than 3 leads to a buffer overflow in a buffer that is allocated later. It is simultaneously possible to cause another integer overflow by supplying large length values because the provided length value is increased by a few bytes to account for additional information that is supposed to be stored there. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.
CVE-2024-48983 (severity: HIGH, weakness: CWE-190)
An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet header. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier plus the header length. WsfMsgAlloc then increments this again by sizeof(wsfMsg_t). This may cause an integer overflow that results in the buffer being significantly too small to contain the entire packet. This may cause a buffer overflow of up to 65 KB . This bug is trivial to exploit for a denial of service but can generally not be exploited further because the exploitable buffer is dynamically allocated.
CVE-2024-48984 (severity: CRITICAL, weakness: CWE-120)
An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading a byte from an input stream. It then fetches the length of the first report, uses it to calculate the beginning of the second report, etc. In doing this, it tracks the largest report so it can later allocate a buffer that fits every individual report (but only one at a time). It does not, however, validate that these addresses are all contained within the buffer passed to hciEvtProcessLeExtAdvReport. It is then possible, though unlikely, that the buffer designated to hold the reports is allocated in such a way that one of these out-of-bounds length fields is contained within the new buffer. When the (n-1)th report is copied, it overwrites the length field of the nth report. This now corrupted length field is then used for a memcpy into the new buffer, which may lead to a buffer overflow.
CVE-2024-48985 (severity: HIGH, weakness: CWE-120)
An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet data. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier and the header length. If the allocate fails because the specified packet is too large, no exception handling occurs and hciTrSerialRxIncoming continues to write bytes into the 4-byte large temporary header buffer, leading to a buffer overflow. This can be leveraged into an arbitrary write by an attacker. It is possible to overwrite the pointer to the buffer that is supposed to receive the contents of the packet body but which couldn't be allocated. One can then overwrite the state variable used by the function to determine which step of the parsing process is currently being executed. This advances the function to the next state, where it proceeds to copy data to that arbitrary location. The packet body is then written wherever the corrupted data pointer is pointing.
CVE-2024-48986 (severity: HIGH, weakness: CWE-120)
An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated.
CVE-2024-48987 (severity: MEDIUM, weakness: CWE-1393)
Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.
CVE-2024-48989 (severity: HIGH, weakness: CWE-400)
A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, rendering the device unresponsive by sending arbitrary UDP messages.
CVE-2024-4899 (severity: MEDIUM, weakness: CWE-79)
The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
CVE-2024-48990 (severity: HIGH, weakness: CWE-427)
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
CVE-2024-48991 (severity: HIGH, weakness: CWE-362)
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).
CVE-2024-48992 (severity: HIGH, weakness: CWE-427)
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
CVE-2024-48993 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-48994 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-48995 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-48996 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-48997 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-48998 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-48999 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-4900 (severity: MEDIUM, weakness: CWE-601)
The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post
CVE-2024-49000 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49001 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49002 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49003 (severity: HIGH, weakness: CWE-416)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49004 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49005 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49006 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49007 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49008 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49009 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-4901 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes.
CVE-2024-49010 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49011 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49012 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49013 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49014 (severity: HIGH, weakness: CWE-415)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49015 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49016 (severity: HIGH, weakness: CWE-416)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49017 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49018 (severity: HIGH, weakness: CWE-197)
SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49019 (severity: HIGH, weakness: CWE-1390)
Active Directory Certificate Services Elevation of Privilege Vulnerability
CVE-2024-4902 (severity: HIGH, weakness: CWE-89)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2024-49021 (severity: HIGH, weakness: CWE-416)
Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2024-49023 (severity: MEDIUM, weakness: CWE-416)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2024-49025 (severity: MEDIUM, weakness: CWE-359)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-49026 (severity: HIGH, weakness: CWE-77)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-49027 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-49028 (severity: HIGH, weakness: CWE-125)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-49029 (severity: HIGH, weakness: CWE-908)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-4903 (severity: MEDIUM, weakness: CWE-89)
A vulnerability was found in Tongda OA 2017. It has been declared as critical. This vulnerability affects unknown code of the file /general/meeting/manage/delete.php. The manipulation of the argument M_ID_STR leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264436. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-49030 (severity: HIGH, weakness: CWE-122)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-49031 (severity: HIGH, weakness: CWE-126)
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2024-49032 (severity: HIGH, weakness: CWE-416)
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2024-49033 (severity: HIGH, weakness: CWE-20)
Microsoft Word Security Feature Bypass Vulnerability
CVE-2024-49035 (severity: CRITICAL, weakness: CWE-269)
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
CVE-2024-49038 (severity: CRITICAL, weakness: CWE-79)
Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.
CVE-2024-49039 (severity: HIGH, weakness: CWE-287)
Windows Task Scheduler Elevation of Privilege Vulnerability
CVE-2024-4904 (severity: MEDIUM, weakness: CWE-434)
A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264437 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-49040 (severity: HIGH, weakness: CWE-451)
Microsoft Exchange Server Spoofing Vulnerability
CVE-2024-49041 (severity: MEDIUM, weakness: CWE-449)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-49042 (severity: HIGH, weakness: CWE-77)
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
CVE-2024-49043 (severity: HIGH, weakness: CWE-426)
Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability
CVE-2024-49044 (severity: MEDIUM, weakness: CWE-284)
Visual Studio Elevation of Privilege Vulnerability
CVE-2024-49046 (severity: HIGH, weakness: CWE-367)
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2024-49048 (severity: HIGH, weakness: CWE-94)
TorchGeo Remote Code Execution Vulnerability
CVE-2024-49049 (severity: HIGH, weakness: CWE-284)
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
CVE-2024-4905 (severity: MEDIUM, weakness: CWE-89)
A vulnerability classified as critical has been found in Kashipara College Management System 1.0. Affected is an unknown function of the file view_students_each_detail.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264438 is the identifier assigned to this vulnerability.
CVE-2024-49050 (severity: HIGH, weakness: CWE-501)
Visual Studio Code Python Extension Remote Code Execution Vulnerability
CVE-2024-49051 (severity: HIGH, weakness: CWE-59)
Microsoft PC Manager Elevation of Privilege Vulnerability
CVE-2024-49052 (severity: CRITICAL, weakness: CWE-306)
Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network.
CVE-2024-49053 (severity: HIGH, weakness: CWE-79)
Microsoft Dynamics 365 Sales Spoofing Vulnerability
CVE-2024-49054 (severity: MEDIUM, weakness: CWE-357)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-49056 (severity: HIGH, weakness: CWE-302)
Authentication bypass by assumed-immutable data on airlift.microsoft.com allows an authorized attacker to elevate privileges over a network.
CVE-2024-49057 (severity: HIGH, weakness: CWE-20)
Microsoft Defender for Endpoint on Android Spoofing Vulnerability
CVE-2024-49059 (severity: HIGH, weakness: CWE-59)
Microsoft Office Elevation of Privilege Vulnerability
CVE-2024-4906 (severity: MEDIUM, weakness: CWE-89)
A vulnerability, which was classified as critical, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /view/show_student1.php. The manipulation of the argument grade leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264441 was assigned to this vulnerability.
CVE-2024-49060 (severity: HIGH, weakness: CWE-798)
Azure Stack HCI Elevation of Privilege Vulnerability
CVE-2024-49062 (severity: MEDIUM, weakness: CWE-23)
Microsoft SharePoint Information Disclosure Vulnerability
CVE-2024-49063 (severity: HIGH, weakness: CWE-502)
Microsoft/Muzic Remote Code Execution Vulnerability
CVE-2024-49064 (severity: MEDIUM, weakness: CWE-611)
Microsoft SharePoint Information Disclosure Vulnerability
CVE-2024-49065 (severity: MEDIUM, weakness: CWE-125)
Microsoft Office Remote Code Execution Vulnerability
CVE-2024-49068 (severity: HIGH, weakness: CWE-284)
Microsoft SharePoint Elevation of Privilege Vulnerability
CVE-2024-49069 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-4907 (severity: MEDIUM, weakness: CWE-89)
A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/show_student2.php. The manipulation of the argument grade leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264442 is the identifier assigned to this vulnerability.
CVE-2024-49070 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2024-49071 (severity: MEDIUM, weakness: CWE-612)
Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network.
CVE-2024-49072 (severity: HIGH, weakness: CWE-122)
Windows Task Scheduler Elevation of Privilege Vulnerability
CVE-2024-49073 (severity: MEDIUM, weakness: CWE-20)
Windows Mobile Broadband Driver Elevation of Privilege Vulnerability
CVE-2024-49074 (severity: HIGH, weakness: CWE-416)
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-49075 (severity: HIGH, weakness: CWE-400)
Windows Remote Desktop Services Denial of Service Vulnerability
CVE-2024-49076 (severity: HIGH, weakness: CWE-287)
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
CVE-2024-49077 (severity: MEDIUM, weakness: CWE-125)
Windows Mobile Broadband Driver Elevation of Privilege Vulnerability
CVE-2024-49078 (severity: MEDIUM, weakness: CWE-125)
Windows Mobile Broadband Driver Elevation of Privilege Vulnerability
CVE-2024-49079 (severity: HIGH, weakness: CWE-416)
Input Method Editor (IME) Remote Code Execution Vulnerability
CVE-2024-4908 (severity: MEDIUM, weakness: CWE-89)
A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /view/student_attendance_history1.php. The manipulation of the argument index leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264443.
CVE-2024-49080 (severity: HIGH, weakness: CWE-122)
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
CVE-2024-49081 (severity: MEDIUM, weakness: CWE-122)
Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability
CVE-2024-49082 (severity: MEDIUM, weakness: CWE-22)
Windows File Explorer Information Disclosure Vulnerability
CVE-2024-49083 (severity: MEDIUM, weakness: CWE-125)
Windows Mobile Broadband Driver Elevation of Privilege Vulnerability
CVE-2024-49084 (severity: HIGH, weakness: CWE-362)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-49085 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-49086 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-49087 (severity: MEDIUM, weakness: CWE-20)
Windows Mobile Broadband Driver Information Disclosure Vulnerability
CVE-2024-49088 (severity: HIGH, weakness: CWE-126)
Windows Common Log File System Driver Elevation of Privilege Vulnerability