CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6472 – Ability to trust not validated macro signatures removed in high security mode
https://notcve.org/view.php?id=CVE-2024-6472
Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the macro is executed. Previously if verification failed the user could fail to understand the failure and choose to enable the macros anyway. This issue affects LibreOffice: from 24.2 before 24.2.5. A vulnerability was found in versions of LibreOffice from 24.2 to before 24.2.5. When a document containing a signed macro fails verification, LibreOffice will display a warning which the user can choose to ignore the failure and enable the macro anyways. • https://www.libreoffice.org/about-us/security/advisories/CVE-2024-6472 https://access.redhat.com/security/cve/CVE-2024-6472 https://bugzilla.redhat.com/show_bug.cgi?id=2302866 • CWE-295: Improper Certificate Validation •
CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36448 – Apache IoTDB Workbench: SSRF Vulnerability (EOL)
https://notcve.org/view.php?id=CVE-2024-36448
Server-Side Request Forgery (SSRF) vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0.13.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. • https://lists.apache.org/thread/d19p0vsm7nogp43q9m3tzm5jl6mzjj1x • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 93%CPEs: 1EXPL: 6CVE-2024-38856 – Apache OFBiz Incorrect Authorization Vulnerability
https://notcve.org/view.php?id=CVE-2024-38856
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints). This vulnerability allows remote attackers to bypass authentication on affected installations of Apache OFBiz. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the resolveURI method. The issue results from improper URI validation. An attacker can leverage this vulnerability to bypass authentication on the system. • https://github.com/codeb0ss/CVE-2024-38856-PoC https://github.com/Praison001/CVE-2024-38856-ApacheOfBiz https://github.com/0x20c/CVE-2024-38856-EXP https://github.com/ThatNotEasy/CVE-2024-38856 https://github.com/BBD-YZZ/CVE-2024-38856-RCE https://github.com/emanueldosreis/CVE-2024-38856 https://issues.apache.org/jira/browse/OFBIZ-13128 https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w https://ofbiz.apache.org/download.html https://ofbiz.apache.org/security.html • CWE-863: Incorrect Authorization •
CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2024-42447 – Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow
https://notcve.org/view.php?id=CVE-2024-42447
Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Also upgrading Apache Airflow to latest version available is recommended. Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images. Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints. • https://github.com/apache/airflow/pull/40784 https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52 • CWE-613: Insufficient Session Expiration •
CVSS: 7.6EPSS: 1%CPEs: 1EXPL: 0CVE-2024-36268 – Apache InLong TubeMQ Client: Remote Code Execution vulnerability
https://notcve.org/view.php?id=CVE-2024-36268
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/10251 • https://lists.apache.org/thread/1w1yp1bg5sjvn46dszkf00tz1vfs0frc • CWE-94: Improper Control of Generation of Code ('Code Injection') •