SB2024111972 - Multiple vulnerabilities in Intel Neural Compressor Software
Published: November 19, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) SQL injection (CVE-ID: CVE-2024-39368)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user on the local network can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
2) Input validation error (CVE-ID: CVE-2024-28028)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker on the local network can pass specially crafted input to the application and gain elevated privileges on the target system.
3) SQL injection (CVE-ID: CVE-2024-39766)
The vulnerability allows a local user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A local user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
4) Input validation error (CVE-ID: CVE-2024-36284)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote user on the local network can pass specially crafted input to the application and gain elevated privileges on the target system.
5) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2024-37181)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a time-of-check, time-of-use (TOCTOU) race condition. A remote user on the local network can gain access to sensitive information on the system.
Remediation
Install update from vendor's website.