stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2024-20528 (severity: HIGH, weakness: CWE-22)
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to upload files to arbitrary locations on the underlying operating system of an affected device. To exploit this vulnerability, an attacker would need valid Super&nbsp;Admin credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to upload custom files to arbitrary locations on the underlying operating system, execute arbitrary code, and elevate privileges to root.
CVE-2024-20529 (severity: MEDIUM, weakness: CWE-22)
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read or delete arbitrary files on the underlying operating system.
CVE-2024-2053 (severity: HIGH, weakness: CWE-23)
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the "www-data" user.
CVE-2024-20530 (severity: MEDIUM, weakness: CWE-79)
A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVE-2024-20531 (severity: MEDIUM, weakness: CWE-611)
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery (SSRF) attack through an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing XML input. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system or conduct an SSRF attack through the affected device.
CVE-2024-20532 (severity: MEDIUM, weakness: CWE-22)
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read or delete arbitrary files on the underlying operating system.
CVE-2024-20533 (severity: MEDIUM, weakness: CWE-79)
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform Firmware could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks against users. This vulnerability exists because the web UI of an affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Note: To exploit this vulnerability, Web Access must be enabled on the phone and the attacker must have Admin credentials on the device. Web Access is disabled by default.
CVE-2024-20534 (severity: MEDIUM, weakness: CWE-79)
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform Firmware could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks against users. This vulnerability exists because the web UI of an affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Note: To exploit this vulnerability, Web Access must be enabled on the phone and the attacker must have Admin credentials on the device. Web Access is disabled by default.
CVE-2024-20536 (severity: HIGH, weakness: CWE-89)
A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with read-only privileges to execute arbitrary SQL commands on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to a specific REST API endpoint or web-based management interface. A successful exploit could allow the attacker to read, modify, or delete arbitrary data on an internal database, which could affect the availability of the device.&nbsp;
CVE-2024-20537 (severity: MEDIUM, weakness: CWE-863)
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to a lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to conduct administrative functions beyond their intended access level. To exploit this vulnerability, an attacker would need Read-Only Administrator credentials.
CVE-2024-20538 (severity: MEDIUM, weakness: CWE-79)
A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface on an affected system to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVE-2024-20539 (severity: MEDIUM, weakness: CWE-79)
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need valid administrative credentials on an affected device.
CVE-2024-2054 (severity: CRITICAL, weakness: CWE-502)
The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.
CVE-2024-20540 (severity: MEDIUM, weakness: CWE-79)
A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into a specific page of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. To exploit this vulnerability, the attacker must have at least a Supervisor role on an affected device.
CVE-2024-2055 (severity: CRITICAL, weakness: CWE-288)
The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user.
CVE-2024-2056 (severity: CRITICAL, weakness: CWE-288)
Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service is running, running as the root user, is bound to the loopback interface, and is listening on TCP port 7050. Security issues associated with exposing this network service are documented at gvalkov's 'tailon' GitHub repo. Using the tailon service, the contents of any file on the Artica Proxy can be viewed.
CVE-2024-2057 (severity: CRITICAL, weakness: CWE-918)
A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.
CVE-2024-2058 (severity: HIGH, weakness: CWE-434)
A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/product.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255373 was assigned to this vulnerability.
CVE-2024-2059 (severity: HIGH, weakness: CWE-434)
A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-255374 is the identifier assigned to this vulnerability.
CVE-2024-2060 (severity: HIGH, weakness: CWE-89)
A vulnerability classified as critical has been found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/app/login_crud.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255375.
CVE-2024-2061 (severity: HIGH, weakness: CWE-89)
A vulnerability classified as critical was found in SourceCodester Petrol Pump Management Software 1.0. This vulnerability affects unknown code of the file /admin/edit_supplier.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255376.
CVE-2024-2062 (severity: HIGH, weakness: CWE-89)
A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. This issue affects some unknown processing of the file /admin/edit_categories.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255377 was assigned to this vulnerability.
CVE-2024-2063 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in SourceCodester Petrol Pump Management Software 1.0. Affected is an unknown function of the file /admin/app/profile_crud.php. The manipulation of the argument username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255378 is the identifier assigned to this vulnerability.
CVE-2024-2064 (severity: MEDIUM, weakness: CWE-74)
A vulnerability has been found in rahman SelectCours 1.0 and classified as problematic. Affected by this vulnerability is the function getCacheNames of the file CacheController.java of the component Template Handler. The manipulation of the argument fragment leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255379.
CVE-2024-2065 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in SourceCodester Barangay Population Monitoring System up to 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /endpoint/update-resident.php. The manipulation of the argument full_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255380.
CVE-2024-20652 (severity: HIGH, weakness: CWE-73)
Windows HTML Platforms Security Feature Bypass Vulnerability
CVE-2024-20653 (severity: HIGH, weakness: CWE-125)
Microsoft Common Log File System Elevation of Privilege Vulnerability
CVE-2024-20654 (severity: HIGH, weakness: CWE-190)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2024-20655 (severity: MEDIUM, weakness: CWE-416)
Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability
CVE-2024-20656 (severity: HIGH, weakness: CWE-59)
Visual Studio Elevation of Privilege Vulnerability
CVE-2024-20657 (severity: HIGH, weakness: CWE-284)
Windows Group Policy Elevation of Privilege Vulnerability
CVE-2024-20658 (severity: HIGH, weakness: CWE-125)
Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability
CVE-2024-20659 (severity: HIGH, weakness: CWE-20)
Windows Hyper-V Security Feature Bypass Vulnerability
CVE-2024-2066 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/add-computer.php. The manipulation of the argument model leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255381 was assigned to this vulnerability.
CVE-2024-20660 (severity: MEDIUM, weakness: CWE-125)
Microsoft Message Queuing Information Disclosure Vulnerability
CVE-2024-20661 (severity: HIGH, weakness: CWE-476)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2024-20662 (severity: MEDIUM, weakness: CWE-843)
Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
CVE-2024-20663 (severity: MEDIUM, weakness: CWE-822)
Windows Message Queuing Client (MSMQC) Information Disclosure
CVE-2024-20664 (severity: MEDIUM, weakness: CWE-822)
Microsoft Message Queuing Information Disclosure Vulnerability
CVE-2024-20665 (severity: MEDIUM, weakness: CWE-693)
BitLocker Security Feature Bypass Vulnerability
CVE-2024-20666 (severity: MEDIUM, weakness: CWE-20)
BitLocker Security Feature Bypass Vulnerability
CVE-2024-20667 (severity: HIGH, weakness: CWE-77)
Azure DevOps Server Remote Code Execution Vulnerability
CVE-2024-20669 (severity: MEDIUM, weakness: CWE-693)
Secure Boot Security Feature Bypass Vulnerability
CVE-2024-2067 (severity: CRITICAL, weakness: CWE-89)
A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-computer.php. The manipulation of the argument computer leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-255382 is the identifier assigned to this vulnerability.
CVE-2024-20670 (severity: HIGH, weakness: CWE-20)
Outlook for Windows Spoofing Vulnerability
CVE-2024-20671 (severity: MEDIUM, weakness: CWE-276)
Microsoft Defender Security Feature Bypass Vulnerability
CVE-2024-20672 (severity: HIGH, weakness: CWE-400)
.NET Denial of Service Vulnerability
CVE-2024-20673 (severity: HIGH, weakness: CWE-693)
Microsoft Office Remote Code Execution Vulnerability
CVE-2024-20674 (severity: HIGH, weakness: CWE-305)
Windows Kerberos Security Feature Bypass Vulnerability
CVE-2024-20675 (severity: MEDIUM, weakness: CWE-284)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2024-20676 (severity: HIGH, weakness: CWE-77)
Azure Storage Mover Remote Code Execution Vulnerability
CVE-2024-20677 (severity: HIGH, weakness: CWE-122)
A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365. As of February 13, 2024, the ability to insert FBX files has also been disabled in 3D Viewer. 3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time. This change is effective as of the January 9, 2024 security update.
CVE-2024-20678 (severity: HIGH, weakness: CWE-843)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2024-20679 (severity: MEDIUM, weakness: CWE-79)
Azure Stack Hub Spoofing Vulnerability
CVE-2024-2068 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /endpoint/update-computer.php. The manipulation of the argument model leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255383.
CVE-2024-20680 (severity: MEDIUM, weakness: CWE-822)
Windows Message Queuing Client (MSMQC) Information Disclosure
CVE-2024-20681 (severity: HIGH, weakness: CWE-416)
Windows Subsystem for Linux Elevation of Privilege Vulnerability
CVE-2024-20682 (severity: HIGH, weakness: CWE-822)
Windows Cryptographic Services Remote Code Execution Vulnerability
CVE-2024-20683 (severity: HIGH, weakness: CWE-416)
Win32k Elevation of Privilege Vulnerability
CVE-2024-20684 (severity: MEDIUM, weakness: CWE-20)
Windows Hyper-V Denial of Service Vulnerability
CVE-2024-20685 (severity: MEDIUM, weakness: CWE-130)
Azure Private 5G Core Denial of Service Vulnerability
CVE-2024-20686 (severity: HIGH, weakness: CWE-591)
Win32k Elevation of Privilege Vulnerability
CVE-2024-20687 (severity: HIGH, weakness: CWE-125)
Microsoft AllJoyn API Denial of Service Vulnerability
CVE-2024-20688 (severity: HIGH, weakness: CWE-121)
Secure Boot Security Feature Bypass Vulnerability
CVE-2024-20689 (severity: HIGH, weakness: CWE-121)
Secure Boot Security Feature Bypass Vulnerability
CVE-2024-2069 (severity: MEDIUM, weakness: CWE-89)
A vulnerability classified as critical has been found in SourceCodester FAQ Management System 1.0. Affected is an unknown function of the file /endpoint/delete-faq.php. The manipulation of the argument faq leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255384.
CVE-2024-20690 (severity: MEDIUM, weakness: CWE-310)
Windows Nearby Sharing Spoofing Vulnerability
CVE-2024-20691 (severity: MEDIUM, weakness: CWE-125)
Windows Themes Information Disclosure Vulnerability
CVE-2024-20692 (severity: MEDIUM, weakness: CWE-326)
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
CVE-2024-20693 (severity: HIGH, weakness: CWE-426)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-20694 (severity: MEDIUM, weakness: CWE-908)
Windows CoreMessaging Information Disclosure Vulnerability
CVE-2024-20695 (severity: MEDIUM, weakness: CWE-284)
Skype for Business Information Disclosure Vulnerability
CVE-2024-20696 (severity: HIGH, weakness: CWE-122)
Windows libarchive Remote Code Execution Vulnerability
CVE-2024-20697 (severity: HIGH, weakness: CWE-122)
Windows libarchive Remote Code Execution Vulnerability
CVE-2024-20698 (severity: HIGH, weakness: CWE-190)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-20699 (severity: MEDIUM, weakness: CWE-755)
Windows Hyper-V Denial of Service Vulnerability
CVE-2024-2070 (severity: MEDIUM, weakness: CWE-79)
A vulnerability classified as problematic was found in SourceCodester FAQ Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-faq.php. The manipulation of the argument question/answer leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255385 was assigned to this vulnerability.
CVE-2024-20700 (severity: HIGH, weakness: CWE-362)
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2024-20701 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-20709 (severity: MEDIUM, weakness: CWE-20)
Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-2071 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, has been found in SourceCodester FAQ Management System 1.0. Affected by this issue is some unknown functionality of the component Update FAQ. The manipulation of the argument Frequently Asked Question leads to cross site scripting. The attack may be launched remotely. VDB-255386 is the identifier assigned to this vulnerability.
CVE-2024-20710 (severity: MEDIUM, weakness: CWE-125)
Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.