deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39657
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.18.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/sender-net-automated-emails/wordpress-sender-newsletter-sms-and-email-marketing-automation-for-woocommerce-plugin-2-6-18-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43116
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/simple-local-avatars/wordpress-simple-local-avatars-plugin-2-7-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43117
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/hummingbird-performance/vulnerability/wordpress-hummingbird-plugin-3-9-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43214
Published: 2024-08-26
Description: Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mycred/vulnerability/wordpress-mycred-plugin-2-7-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-43230
Published: 2024-08-26
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.28.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/shared-files/vulnerability/wordpress-shared-files-premium-download-manager-secure-file-sharing-with-frontend-file-upload-plugin-1-7-28-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-43251
Published: 2024-08-26
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/bitformpro/wordpress-bit-form-pro-plugin-2-6-4-authenticated-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-43255
Published: 2024-08-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable.This issue affects MyBookTable Bookstore: from n/a through <= 3.3.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/mybooktable/vulnerability/wordpress-mybooktable-bookstore-by-stormhill-media-plugin-3-3-9-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43257
Published: 2024-08-26
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/leopard-wordpress-offload-media/wordpress-leopard-wordpress-offload-media-plugin-2-0-36-subscriber-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-43258
Published: 2024-08-26
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17.01.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/store-locator-le/wordpress-store-locator-plus-for-wordpress-plugin-2311-17-01-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-43259
Published: 2024-08-26
Description: Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue affects Order Export for WooCommerce: from n/a through <= 3.23.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/order-export-and-more-for-woocommerce/vulnerability/wordpress-order-export-for-woocommerce-plugin-3-23-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-43264
Published: 2024-08-26
Description: Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through <= 1.9.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/mediavine-create/vulnerability/wordpress-create-by-mediavine-plugin-1-9-7-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-43265
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-analytify/wordpress-analytify-plugin-5-3-1-csrf-leading-to-optout-vulnerability?_s_id=cve
CVE: CVE-2024-43269
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: from n/a through 1.50.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-backitup/wordpress-backup-and-restore-wordpress-plugin-1-50-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43287
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.82.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mailin/wordpress-brevo-plugin-3-1-82-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43295
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-data-access/wordpress-wp-data-access-plugin-5-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43299
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Softaculous SpeedyCache speedycache.This issue affects SpeedyCache: from n/a through <= 1.1.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/speedycache/vulnerability/wordpress-speedycache-plugin-1-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43301
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Fonts Plugin Fonts allows Stored XSS.This issue affects Fonts: from n/a through 3.7.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/olympus-google-fonts/wordpress-fonts-plugin-3-7-7-cross-site-request-forgery-csrf-to-stored-xssvulnerability?_s_id=cve
CVE: CVE-2024-43316
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/checkout-plugins-stripe-woo/wordpress-stripe-payments-for-woocommerce-plugin-1-9-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43325
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/dark-mode-for-wp-dashboard/wordpress-dark-mode-for-wp-dashboard-plugin-1-2-3-cross-site-request-forgery-vulnerability?_s_id=cve
CVE: CVE-2024-43336
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.This issue affects WP User Manager: from n/a through <= 2.9.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-user-manager/vulnerability/wordpress-wp-user-manager-user-profile-builder-membership-plugin-2-9-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43337
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/brave-popup-builder/wordpress-brave-plugin-0-7-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43339
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-webinarsystem/wordpress-wordpress-webinar-plugin-webinarpress-plugin-1-33-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43340
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/advanced-form-integration/wordpress-afi-the-easiest-integration-plugin-plugin-1-89-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-43356
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/oik/wordpress-oik-plugin-4-12-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-43915
Published: 2024-08-26
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through .3.102.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/zephyr-project-manager/wordpress-zephyr-project-manager-plugin-3-3-102-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43916
Published: 2024-08-26
Description: Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/zephyr-project-manager/wordpress-zephyr-project-manager-plugin-3-3-102-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-7989
Published: 2024-08-26
Description: Rejected reason: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that the issue does not pose a security risk as it falls within the expected functionality and security controls of the application. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-43798
Published: 2024-08-26
Description: Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-306, CWE-1068
References: https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj
CVE: CVE-2024-45036
Published: 2024-08-26
Description: Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in `~/.tophatrc` through use of a malicious Tophat URL controlled by the attacker. The vulnerability allows Tophat to send this token to the attacker's server without any checks to ensure that the server is trusted. This token can then be used to access internal build artifacts, for mobile applications, not intended to be public. The issue has been patched as of version 1.10.0.  The ability to request artifacts using a Tophat API has been deprecated as this flow was inherently insecure.  Systems that have implemented this kind of endpoint should cease use and invalidate the token immediately. There are no workarounds and all users should update as soon as possible.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/Shopify/tophat/pull/10; https://github.com/Shopify/tophat/security/advisories/GHSA-p7xh-6hjr-mmg6
CVE: CVE-2024-45321
Published: 2024-08-27
Description: The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
CVSS Score: 8.1 (HIGH)
CWE: CWE-494, CWE-494
References: https://github.com/miyagawa/cpanminus/issues/611; https://github.com/miyagawa/cpanminus/pull/674; https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html
CVE: CVE-2024-6688
Published: 2024-08-27
Description: The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update stylesheets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://oxygenbuilder.com/oxygen-4-9-now-available/; https://www.wordfence.com/threat-intel/vulnerabilities/id/78c88402-52ca-44ff-8767-1f843fcb66fd?source=cve
CVE: CVE-2024-7125
Published: 2024-08-27
Description: Authentication Bypass vulnerability in Hitachi Ops Center Common Services.This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.2-01.
CVSS Score: 7.8 (HIGH)
CWE: CWE-288, CWE-306
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-143/index.html
CVE: CVE-2024-6804
Published: 2024-08-27
Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.7/lib/jeg-framework/customizer/class-customizer.php#L595; https://plugins.trac.wordpress.org/changeset/3139386/; https://wordpress.org/plugins/jeg-elementor-kit/#developers
CVE: CVE-2024-7304
Published: 2024-08-27
Description: The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.0.12/app/Hooks/filters.php#L28; https://plugins.trac.wordpress.org/changeset/3140370/; https://plugins.trac.wordpress.org/changeset/3140370/#file408
CVE: CVE-2024-41173
Published: 2024-08-27
Description: The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker.
CVSS Score: 7.8 (HIGH)
CWE: CWE-288
References: https://cert.vde.com/en/advisories/VDE-2024-045
CVE: CVE-2024-41174
Published: 2024-08-27
Description: The IPC-Diagnostics package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://cert.vde.com/en/advisories/VDE-2024-048
CVE: CVE-2024-41175
Published: 2024-08-27
Description: The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://cert.vde.com/en/advisories/VDE-2024-049/; https://infosys.beckhoff.com/content/1033/twincat_bsd/[PII_REDACTED].html?id=[PII_REDACTED]353411614
CVE: CVE-2024-41176
Published: 2024-08-27
Description: The MPD package included in TwinCAT/BSD allows an authenticated, low-privileged local
attacker to induce a Denial-of-Service (DoS) condition on the daemon and execute code in
the context of user “root” via a crafted HTTP request.
CVSS Score: 7.3 (HIGH)
CWE: CWE-120
References: https://cert.vde.com/en/advisories/VDE-2024-050
CVE: CVE-2024-7608
Published: 2024-08-27
Description: An authenticated user can  access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-35
References: https://thrive.trellix.com/s/article/000013844
CVE: CVE-2024-8046
Published: 2024-08-27
Description: The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/logo-showcase-ultimate/tags/1.4.1/lcg_adl_main.php#L236; https://plugins.trac.wordpress.org/changeset/3141393/; https://plugins.trac.wordpress.org/changeset/3141393/#file3
CVE: CVE-2024-6789
Published: 2024-08-27
Description: A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated user to read files
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://empower.m-files.com/security-advisories/CVE-2024-6789; https://product.m-files.com/security-advisories/cve-2024-6789/
CVE: CVE-2024-7791
Published: 2024-08-27
Description: The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arrow’ parameter within the Post Grid widget in all versions up to, and including, 1.4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/widgets/post-grid/post-grid.php#L1891; https://plugins.trac.wordpress.org/changeset/3141892/; https://plugins.trac.wordpress.org/changeset/3141892/#file2
CVE: CVE-2024-8197
Published: 2024-08-27
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-7859. Reason: This candidate is a reservation duplicate of CVE-2024-7859. Notes: All CVE users should reference CVE-2024-7859 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-8207
Published: 2024-08-27
Description: In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with host-level access to cause the MongoDB Server binary to load unintended actor-controlled shared libraries when the server binary is started, potentially resulting in the unintended actor gaining full control over the MongoDB server process. This issue affects MongoDB Server v5.0 versions prior to 5.0.14 and MongoDB Server v6.0 versions prior to 6.0.3.

Required Configuration: Only environments with Linux as the underlying operating system is affected by this issue
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-114, CWE-610
References: https://jira.mongodb.org/browse/SERVER-69507; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-3980
Published: 2024-08-27
Description: The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names
that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or
other files that are critical to the application.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-3982
Published: 2024-08-27
Description: An attacker with local access to machine where MicroSCADA X
SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level
is not enabled and only users with administrator rights can enable it.
CVSS Score: 8.2 (HIGH)
CWE: CWE-294, CWE-294
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-4872
Published: 2024-08-27
Description: A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code towards persistent data. Note that to successfully exploit this vulnerability
an attacker must have a valid credential.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-943
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-7940
Published: 2024-08-27
Description: The product exposes a service that is intended for local only to
all network interfaces without any authentication.
CVSS Score: 8.3 (HIGH)
CWE: CWE-306, CWE-306
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-7941
Published: 2024-08-27
Description: An HTTP parameter may contain a URL value and could cause
the web application to redirect the request to the specified URL.
By modifying the URL value to a malicious site, an attacker may
successfully launch a phishing scam and steal user credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=Launch