deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-36624
Published: 2024-11-29
Description: Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/[PII_REDACTED]/64720d2aa5afd943eb7e5a1ed4808ad6; https://github.com/zulip/zulip/blob/8.3/web/src/copy_and_paste.js#L90; https://github.com/zulip/zulip/commit/e1029b59ede0c4f314c367ffa1ba2904ffaf6768
CVE: CVE-2024-49360
Published: 2024-11-29
Description: Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users' files in `C:\Sandbox\xxx`. By default in Windows 7+, the `C:\Users\UserA` folder is not readable by **UserB**.
All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\Users are safe. If `UserB` runs a cmd in a sandbox, he will be able to access `C:\Sandox\UserA`. In addition, if **UserB** create a folder `C:\Sandbox\UserA` with malicious ACLs, when **UserA** will user the sandbox, Sandboxie doesn't reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie.
CVSS Score: 9.2 (CRITICAL)
CWE: CWE-22
References: https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-4chj-3c28-gvmp
CVE: CVE-2024-36611
Published: 2024-11-29
Description: In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://gist.github.com/[PII_REDACTED]/3581425e0911b716cf8ce4fa30e41e6c; https://github.com/github/advisory-database/pull/5046; https://github.com/symfony/symfony/blob/v7.0.7/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php#L132
CVE: CVE-2024-36615
Published: 2024-11-29
Description: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://gist.github.com/[PII_REDACTED]/c44e5eaafa8f408eea0c[PII_REDACTED]fb; https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738; https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61
CVE: CVE-2024-36616
Published: 2024-11-29
Description: An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://gist.github.com/[PII_REDACTED]/ded3e1509d8296ec4a91817867d108e0; https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265; https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661
CVE: CVE-2024-52003
Published: 2024-11-29
Description: Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/traefik/traefik/pull/11253; https://github.com/traefik/traefik/releases/tag/v2.11.14; https://github.com/traefik/traefik/releases/tag/v3.2.1
CVE: CVE-2024-52800
Published: 2024-11-29
Description: veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.
CWE: CWE-611
References: https://github.com/veraPDF/veraPDF-library/issues/1488; https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x
CVE: CVE-2024-52801
Published: 2024-11-29
Description: sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-327
References: https://github.com/drakkan/sftpgo/commit/f30a9a2095bf90c0661b04fe038e3b7efc788bc6; https://github.com/drakkan/sftpgo/security/advisories/GHSA-6943-qr24-82vx; https://github.com/rs/xid
CVE: CVE-2024-52809
Published: 2024-11-29
Description: vue-i18n  is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-79
References: https://github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411; https://github.com/intlify/vue-i18n/commit/9f20909ef8c9232a1072d7818e12ed6d6451024d; https://github.com/intlify/vue-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v
CVE: CVE-2024-52810
Published: 2024-11-29
Description: @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) as the minimum consequence. Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-1321
References: https://github.com/intlify/vue-i18n/commit/9f20909ef8c9232a1072d7818e12ed6d6451024d; https://github.com/intlify/vue-i18n/security/advisories/GHSA-hjwq-mjwj-4x6c
CVE: CVE-2024-53848
Published: 2024-11-29
Description: check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, they can insert their own schema into the cache and it will be picked up and used instead of the appropriate schema. Such a cache confusion attack could be used to allow data to pass validation which should have been rejected. This issue has been patched in version 0.30.0. All users are advised to upgrade. A few workarounds exist: 1. Users can use `--no-cache` to disable caching. 2. Users can use `--cache-filename` to select filenames for use in the cache, or to ensure that other usages do not overwrite the cached schema. (Note: this flag is being deprecated as part of the remediation effort.) 3. Users can explicitly download the schema before use as a local file, as in `curl -LOs https://example.org/schema.json; check-jsonschema --schemafile ./schema.json`
CVSS Score: 7.1 (HIGH)
CWE: CWE-349
References: https://github.com/python-jsonschema/check-jsonschema/commit/c52714b85e6725b1b24516fbdedacb333b939152; https://github.com/python-jsonschema/check-jsonschema/security/advisories/GHSA-q6mv-284r-mp36
CVE: CVE-2024-53861
Published: 2024-11-29
Description: pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issuer, list)` to `isinstance(issuer, Sequence)`. Since str is a Sequnce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature checks are still present so real world impact is likely limited to denial of service scenarios. This issue has been patched in version 2.10.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.2 (LOW)
CWE: CWE-697
References: https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b[PII_REDACTED]3fc382faf901eaab008e380R366; https://github.com/jpadilla/pyjwt/commit/33022c25525c1020869c71ce2a4109e44ae4ced1; https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm
CVE: CVE-2024-53864
Published: 2024-11-29
Description: Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is required to exploit it. After the fix, any existing injected XSS will not run. This issue has been patched in version 4.6.14. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-79
References: https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates; https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614; https://github.com/ibexa/admin-ui/commit/8ec824a8cf06c566ed88e4c21cc66f7ed42649fc
CVE: CVE-2024-53865
Published: 2024-11-29
Description: zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs. 2. The 'ssc-master-pw' and 'zaware-master-pw' properties when updating an LPAR in classic mode, in the zhmcclient API and HMC logs. 3. The 'ssc-master-pw' and 'zaware-master-pw' properties when creating or updating an image activation profile in classic mode, in the zhmcclient API and HMC logs. 4. The 'password' property when creating or updating an HMC user, in the zhmcclient API log. 5. The 'bind-password' property when creating or updating an LDAP server definition, in the zhmcclient API and HMC logs. This issue affects only users of the zhmcclient package that have enabled the Python loggers named "zhmcclient.api" (for the API log) or "zhmcclient.hmc" (for the HMC log) and that use the functions listed above. This issue has been fixed in zhmcclient version 1.18.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-312
References: https://github.com/zhmcclient/python-zhmcclient/commit/ad32781e782d0f604c6da4680fce48e4cc1f4433; https://github.com/zhmcclient/python-zhmcclient/security/advisories/GHSA-p57h-3cmc-xpjq
CVE: CVE-2024-53979
Published: 2024-11-29
Description: ibm.ibm_zhmc is an Ansible collection for the IBM Z HMC. The Ansible collection "ibm.ibm_zhmc" writes password-like properties in clear text into its log file and into the output returned by some of its Ansible module in the following cases: 1. The 'boot_ftp_password' and 'ssc_master_pw' properties are passed as input to the zhmc_partition Ansible module. 2. The 'ssc_master_pw' and 'zaware_master_pw' properties are passed as input to the zhmc_lpar Ansible module. 3. The 'password' property is passed as input to the zhmc_user Ansible module (just in log file, not in module output). 4. The 'bind_password' property is passed as input to the zhmc_ldap_server_definition Ansible module. These properties appear in the module output only when they were specified in the module input and when creating or updating the corresponding resources. They do not appear in the output when retrieving facts for the corresponding resources. These properties appear in the log file only when the "log_file" module input parameter is used. By default, no log file is created. This issue has been fixed in ibm.ibm_zhmc version 1.9.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-312
References: https://github.com/zhmcclient/zhmc-ansible-modules/commit/f5579f07da5f02d2496c41a313d4ae7a0a459b1d; https://github.com/zhmcclient/zhmc-ansible-modules/security/advisories/GHSA-mw6c-f428-jx4f
CVE: CVE-2024-53980
Published: 2024-11-29
Description: RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A malicious actor can send a IEEE 802.15.4 packet with spoofed length byte and optionally spoofed FCS, which eventually results into an endless loop on a CC2538 as receiver. Before PR #20998, the receiver would check for the location of the CRC bit using the packet length byte by considering all 8 bits, instead of discarding bit 7, which is what the radio does. This then results into reading outside of the RX FIFO.  Although it prints an error when attempting to read outside of the RX FIFO, it will continue doing this. This may lead to a discrepancy in the CRC check according to the firmware and the radio. If the CPU judges the CRC as correct and the radio is set to `AUTO_ACK`, when the packet requests and acknowledgment the CPU will go into the state `CC2538_STATE_TX_ACK`. However, if the radio judged the CRC as incorrect, it will not send an acknowledgment, and thus the `TXACKDONE` event will not fire. It will then never return to the state `CC2538_STATE_READY` since the baseband processing is still disabled. Then the CPU will be in an endless loop. Since setting to idle is not forced, it won't do it if the radio's state is not `CC2538_STATE_READY`. A fix has not yet been made.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a[PII_REDACTED]4/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L183; https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a[PII_REDACTED]4/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L417; https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a[PII_REDACTED]4/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L419
CVE: CVE-2024-53983
Published: 2024-11-29
Description: The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not change git config.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9; https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
CVE: CVE-2024-35366
Published: 2024-11-29
Description: FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-190
References: https://gist.github.com/[PII_REDACTED]/1e72f170d58c2547ebd4db4cdf6cfabf; https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389; https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6
CVE: CVE-2024-35367
Published: 2024-11-29
Description: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://gist.github.com/[PII_REDACTED]/9754a[PII_REDACTED]8f6a403447c458ca4; https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53; https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667
CVE: CVE-2024-35368
Published: 2024-11-29
Description: FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://gist.github.com/[PII_REDACTED]/7e6e47220ae2b2d2fb4611f0d8a31ec5; https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466; https://github.com/ffmpeg/ffmpeg/commit/[PII_REDACTED]502090c4fd6560544dce399a8cd53c
CVE: CVE-2024-35371
Published: 2024-11-29
Description: Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://gist.github.com/[PII_REDACTED]/4eb17867f2e375f4824274c5e7b4d384; https://github.com/ant-media/Ant-Media-Server/blob/ams-v2.8.2/src/main/java/io/antmedia/rest/RestServiceBase.java#L356; https://github.com/ant-media/ant-media-server/commit/4d4763bd4fd06e515c19544e5170ca0f34c9ce45
CVE: CVE-2024-36610
Published: 2024-11-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-36612
Published: 2024-11-29
Description: Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://gist.github.com/[PII_REDACTED]/f7ff51d24ebbb29e21dfb70a0c97302b; https://github.com/zulip/zulip/blob/8.3/web/src/click_handlers.js; https://github.com/zulip/zulip/commit/0a90a13becbf0338a8fc1ad37946e51c2c25b0a5
CVE: CVE-2024-53504
Published: 2024-11-29
Description: A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/siyuan-note/siyuan/issues/13058; https://github.com/siyuan-note/siyuan/issues/13077
CVE: CVE-2024-53505
Published: 2024-11-29
Description: A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/siyuan-note/siyuan/issues/13059; https://github.com/siyuan-note/siyuan/issues/13077
CVE: CVE-2024-53506
Published: 2024-11-29
Description: A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/siyuan-note/siyuan/issues/13060; https://github.com/siyuan-note/siyuan/issues/13077
CVE: CVE-2024-53507
Published: 2024-11-29
Description: A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/siyuan-note/siyuan/issues/13057; https://github.com/siyuan-note/siyuan/issues/13077
CVE: CVE-2024-11995
Published: 2024-11-29
Description: A vulnerability has been found in code-projects Farmacia 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /pagamento.php. The manipulation of the argument total leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/5p4rk/cve/blob/main/xss.md; https://vuldb.com/?ctiid.286411
CVE: CVE-2024-54159
Published: 2024-11-29
Description: stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-732
References: https://cwe.mitre.org/data/definitions/61.html; https://security.opensuse.org/2024/11/29/stalld-fixed-tmp-file.html; https://www.openwall.com/lists/oss-security/2024/11/29/3
CVE: CVE-2024-53623
Published: 2024-11-29
Description: Incorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/Crane-c/CVE_Request/blob/main/TP-Link/C7v5/TPLink_ARCHERC7v5_unauthorized_access_vulnerability_first.md
CVE: CVE-2024-43702
Published: 2024-11-30
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-280
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-43703
Published: 2024-11-30
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physical memory from the GPU HW.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-11252
Published: 2024-11-30
Description: The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.69 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sassy-social-share/tags/3.3.69/public/class-sassy-social-share-public.php#L1478; https://plugins.trac.wordpress.org/browser/sassy-social-share/tags/3.3.69/public/class-sassy-social-share-public.php#L1481; https://www.wordfence.com/threat-intel/vulnerabilities/id/3d065c2a-da7d-469a-b57d-f2fd5b760ff4?source=cve