yahoo-inc/cve-impacts huggingface dataset:
CVE-2024-2097: Authenticated List control client can execute the LINQ query in SCM Server to present event as list for operator. An authenticated malicious client can send special LINQ query to execute arbitrary code remotely (RCE) on the SCM Server that an attacker otherwise does not have authorization to do.
Key phrases: execute arbitrary code, rce
CVE-2024-20970: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20971: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20972: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20973: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20974: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20975: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20976: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20977: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20978: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20979: Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Key phrases: compromise Oracle BI Publisher, scope change
CVE-2024-20980: Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 6.4.0.0.0 and  7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Key phrases: compromise Oracle BI Publisher, scope change
CVE-2024-20981: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20982: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20983: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20984: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server : Security : Firewall).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20985: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Key phrases: compromise MySQL Server, availability impacts, hang, hang frequently repeatable crash
CVE-2024-20986: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as  unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Key phrases: compromise Oracle WebLogic Server, scope change
CVE-2024-20987: Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Key phrases: compromise Oracle BI Publisher, scope change
CVE-2024-2106: The MasterStudy LMS WordPress Plugin  for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email addresses which can be used to help perform future attacks.
Key phrases: extract sensitive data including all registered user's, information exposure, future
CVE-2024-2107: The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.4 via generated source. This makes it possible for unauthenticated attackers to extract sensitive data including contents of password-protected or scheduled posts.
Key phrases: sensitive information exposure
CVE-2024-2108: The Ninja Forms Contact Form  The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a form in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2110: The Events Manager  Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers to modify booking statuses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2024-2111: The Events Manager  Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value in all versions up to, and including, 6.4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2113: The Ninja Forms Contact Form  The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nf_download_all_subs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2024-2116: The Christmas Greetings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the code parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2024-2120: The Elementor Website Builder  More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2121: The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2123: The Ultimate Member  User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2124: The Translate WordPress and go Multilingual  Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2126: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Registration Form widget in all versions up to, and including, 2.10.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2127: The Page Builder: Pagelayer  Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2128: The EmbedPress  Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed widget in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2129: The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widget in all versions up to, and including, 1.3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2130: The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-21304: Trusted Compute Base Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21305: Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2024-21306: Microsoft Bluetooth Driver Spoofing Vulnerability
Key phrases: bluetooth driver spoofing
CVE-2024-21307: Remote Desktop Client Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21309: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Key phrases: windows kernel-mode driver elevation of privilege
CVE-2024-2131: The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's infobox and button widget in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-21310: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows cloud files mini filter driver elevation of privilege
CVE-2024-21311: Windows Cryptographic Services Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2024-21312: .NET Framework Denial of Service Vulnerability
Key phrases: .net framework denial of service
CVE-2024-21313: Windows TCP/IP Information Disclosure Vulnerability
Key phrases: windows tcp ip information disclosure
CVE-2024-21314: Microsoft Message Queuing Information Disclosure Vulnerability
Key phrases: message queuing information disclosure
CVE-2024-21315: Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21316: Windows Server Key Distribution Service Security Feature Bypass
Key phrases: Security Feature Bypass, security feature bypass
CVE-2024-21318: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21319: Microsoft Identity Denial of service vulnerability
Key phrases: denial of service
CVE-2024-21320: Windows Themes Spoofing Vulnerability
Key phrases: windows themes spoofing
CVE-2024-21325: Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21326: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21327: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
Key phrases: customer engagement cross-site scripting
CVE-2024-21328: Dynamics 365 Sales Spoofing Vulnerability
Key phrases: sales spoofing
CVE-2024-21329: Azure Connected Machine Agent Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-2133: A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0. This affects an unknown part of the file /dashboard/Cinvoice/manage_invoice of the component Manage Sale Page. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255495.
Key phrases: cross site scripting, cross-site scripting
CVE-2024-21330: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21334: Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21336: Microsoft Edge (Chromium-based) Spoofing Vulnerability
Key phrases: spoofing
CVE-2024-21337: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21338: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2024-21339: Windows USB Generic Parent Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-2134: A vulnerability has been found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This vulnerability affects unknown code of the file /investigation/delete/ of the component Investigation Report Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255496. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross-site request forgery, cross site request forgery, disclosure
CVE-2024-21340: Windows Kernel Information Disclosure Vulnerability
Key phrases: windows kernel information disclosure
CVE-2024-21341: Windows Kernel Remote Code Execution Vulnerability
Key phrases: windows kernel remote code execution
CVE-2024-21342: Windows DNS Client Denial of Service Vulnerability
Key phrases: denial of service
CVE-2024-21343: Windows Network Address Translation (NAT) Denial of Service Vulnerability
Key phrases: windows network address translation (nat), denial of service
CVE-2024-21344: Windows Network Address Translation (NAT) Denial of Service Vulnerability
Key phrases: windows network address translation (nat), denial of service
CVE-2024-21345: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2024-21346: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21347: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21348: Internet Connection Sharing (ICS) Denial of Service Vulnerability
Key phrases: internet connection sharing (ics) denial of service
CVE-2024-21349: Microsoft ActiveX Data Objects Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-2135: A vulnerability was found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This issue affects some unknown processing of the file /hospital_activities/birth/form of the component Hospital Activities Page. The manipulation of the argument Description with the input <img src=a onerror=alert(1)> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255497 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: cross site scripting, disclosure
CVE-2024-21350: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21351: Windows SmartScreen Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows smartscreen security feature bypass
CVE-2024-21352: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21353: Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21354: Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21355: Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21356: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Key phrases: denial of service
CVE-2024-21357: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21358: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21359: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-2136: The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-21360: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21361: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21362: Windows Kernel Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows kernel security feature bypass
CVE-2024-21363: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21364: Microsoft Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21365: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21366: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21367: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21368: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21369: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21370: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21371: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2024-21372: Windows OLE Remote Code Execution Vulnerability
Key phrases: windows ole remote code execution
CVE-2024-21374: Microsoft Teams for Android Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2024-21375: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21376: Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21377: Windows DNS Information Disclosure Vulnerability
Key phrases: windows dns information disclosure
CVE-2024-21378: Microsoft Outlook Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21379: Microsoft Word Remote Code Execution Vulnerability
Key phrases: microsoft word remote code execution
CVE-2024-21380: Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2024-21381: Microsoft Azure Active Directory B2C Spoofing Vulnerability
Key phrases: spoofing
CVE-2024-21382: Microsoft Edge for Android Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2024-21383: Microsoft Edge (Chromium-based) Spoofing Vulnerability
Key phrases: spoofing
CVE-2024-21384: Microsoft Office OneNote Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21385: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21386: .NET Denial of Service Vulnerability
Key phrases: denial of service
CVE-2024-21387: Microsoft Edge for Android Spoofing Vulnerability
Key phrases: spoofing
CVE-2024-21388: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21389: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2024-2139: The Master Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in all versions up to, and including, 2.0.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-21390: Microsoft Authenticator Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21391: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21392: .NET and Visual Studio Denial of Service Vulnerability
Key phrases: denial of service
CVE-2024-21393: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2024-21394: Dynamics 365 Field Service Spoofing Vulnerability
Key phrases: field service spoofing
CVE-2024-21395: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2024-21396: Dynamics 365 Sales Spoofing Vulnerability
Key phrases: sales spoofing
CVE-2024-21397: Microsoft Azure File Sync Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21399: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-2140: The Ultimate Addons for Beaver Builder  Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Icons widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-21400: Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
Key phrases: confidential container elevation of privilege
CVE-2024-21401: Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21402: Microsoft Outlook Elevation of Privilege Vulnerability
Key phrases: microsoft outlook elevation of privilege
CVE-2024-21403: Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
Key phrases: confidential container elevation of privilege
CVE-2024-21404: .NET Denial of Service Vulnerability
Key phrases: denial of service
CVE-2024-21405: Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21406: Windows Printing Service Spoofing Vulnerability
Key phrases: spoofing
CVE-2024-21407: Windows Hyper-V Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21408: Windows Hyper-V Denial of Service Vulnerability
Key phrases: denial of service
CVE-2024-2141: The Ultimate Addons for Beaver Builder  Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-21410: Microsoft Exchange Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21411: Skype for Consumer Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21412: Internet Shortcut Files Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2024-21413: Microsoft Outlook Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21418: Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21419: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2024-2142: The Ultimate Addons for Beaver Builder  Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Info Table widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-21420: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21421: Azure SDK Spoofing Vulnerability
Key phrases: spoofing
CVE-2024-21423: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2024-21426: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21427: Windows Kerberos Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows kerberos security feature bypass
CVE-2024-21429: Windows USB Hub Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-2143: The Ultimate Addons for Beaver Builder  Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-21430: Windows USB Attached SCSI (UAS) Protocol Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21431: Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2024-21432: Windows Update Stack Elevation of Privilege Vulnerability
Key phrases: windows update stack elevation of privilege
CVE-2024-21433: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21434: Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability
CVE-2024-21435: Windows OLE Remote Code Execution Vulnerability
Key phrases: windows ole remote code execution
CVE-2024-21436: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2024-21437: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2024-21438: Microsoft AllJoyn API Denial of Service Vulnerability
Key phrases: denial of service
CVE-2024-21439: Windows Telephony Server Elevation of Privilege Vulnerability
Key phrases: windows telephony server elevation of privilege
CVE-2024-2144: The Ultimate Addons for Beaver Builder  Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-21440: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21441: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21442: Windows USB Print Driver Elevation of Privilege Vulnerability
Key phrases: windows usb print driver elevation of privilege
CVE-2024-21443: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2024-21444: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21445: Windows USB Print Driver Elevation of Privilege Vulnerability
Key phrases: windows usb print driver elevation of privilege
CVE-2024-21446: NTFS Elevation of Privilege Vulnerability
Key phrases: ntfs elevation of privilege
CVE-2024-21448: Microsoft Teams for Android Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2024-2145: A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been classified as problematic. Affected is an unknown function of the file /endpoint/update-tracker.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255498 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2024-21450: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21451: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2024-21452: Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions.
Key phrases: transient dos
CVE-2024-21453: Transient DOS while decoding message of size that exceeds the available system memory.
Key phrases: transient dos
CVE-2024-21454: Transient DOS while decoding the ToBeSignedMessage in Automotive Telematics.
Key phrases: transient dos
CVE-2024-2146: A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /?p=products. The manipulation of the argument search leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255499.
Key phrases: cross site scripting
CVE-2024-21463: Memory corruption while processing Codec2 during v13k decoder pitch synthesis.
Key phrases: memory corruption
CVE-2024-21468: Memory corruption when there is failed unmap operation in GPU.
Key phrases: memory corruption
CVE-2024-2147: A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255500.
Key phrases: sql injection
CVE-2024-21470: Memory corruption while allocating memory for graphics.
Key phrases: memory corruption
CVE-2024-21472: Memory corruption in Kernel while handling GPU operations.
Key phrases: memory corruption
CVE-2024-21473: Memory corruption while redirecting log file to any file location with any file name.
Key phrases: memory corruption
CVE-2024-2148: A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255501 was assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2024-21483: A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.3.0 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) (All versions >= V3.2.3 < V3.3.0 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) (All versions >= V3.2.3 < V3.3.0 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) (All versions >= V3.2.3 < V3.3.0 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)). The read out protection of the internal flash of affected devices was not properly set at the end of the manufacturing process.An attacker with physical access to the device could read out the data.
CVE-2024-21484: Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key. Workaround The vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library.
Key phrases: observable discrepancy, marvin security flaw
CVE-2024-21485: Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server.**Note:**This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user.
Key phrases: act as that user, cross-site scripting (xss)