CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2024-21682
https://notcve.org/view.php?id=CVE-2024-21682
This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network. This Injection vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to modify the actions taken by a system call which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Assets Discovery customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes (https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html). You can download the latest version of Assets Discovery from the Atlassian Marketplace (https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation). This vulnerability was reported via our Penetration Testing program. • https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606 https://jira.atlassian.com/browse/JSDSERVER-15067 https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1470 – Elevation of Privilege attack on NetIQ Client login extension
https://notcve.org/view.php?id=CVE-2024-1470
Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code Injection.This issue only affects NetIQ Client Login Extension: 4.6. La vulnerabilidad de omisión de autorización a través de clave controlada por el usuario en la extensión de inicio de sesión del cliente NetIQ (OpenText) en Windows permite la escalada de privilegios y la inyección de código. Este problema solo afecta a la extensión de inicio de sesión del cliente NetIQ: 4.6. • https://portal.microfocus.com/s/article/KM000026667?language=en_US • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-22097
https://notcve.org/view.php?id=CVE-2024-22097
A specially crafted .vdhr file can lead to arbitrary code execution. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW https://talosintelligence.com/vulnerability_reports/TALOS-2024-1917 • CWE-415: Double Free •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23305
https://notcve.org/view.php?id=CVE-2024-23305
A specially crafted .vmrk file can lead to arbitrary code execution. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW https://talosintelligence.com/vulnerability_reports/TALOS-2024-1918 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23809
https://notcve.org/view.php?id=CVE-2024-23809
A specially crafted .vdhr file can lead to arbitrary code execution. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW https://talosintelligence.com/vulnerability_reports/TALOS-2024-1919 • CWE-415: Double Free •