deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-28113
Published: 2024-03-12
Description: Peering Manager is a BGP session management tool. In Peering Manager <=1.8.2, it is possible to redirect users to an arbitrary page using a crafted url. As a result users can be redirected to an unexpected location. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-601, CWE-601
References: https://github.com/peering-manager/peering-manager/commit/49dc5593184d7740d81e57dbbe3f971d2969dfac; https://github.com/peering-manager/peering-manager/security/advisories/GHSA-f4mf-5g28-q7f5; https://github.com/peering-manager/peering-manager/commit/49dc5593184d7740d81e57dbbe3f971d2969dfac
CVE: CVE-2024-28114
Published: 2024-03-12
Description: Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: https://github.com/peering-manager/peering-manager/commit/8a865fb596c11ad7caf45aef317d8fcbce7f85ff; https://github.com/peering-manager/peering-manager/security/advisories/GHSA-q37x-qfrx-jcv6; https://owasp.org/www-community/attacks/Command_Injection
CVE: CVE-2024-28121
Published: 2024-03-12
Description: stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\"target\":\"[class_name]#[method_name]\",\"args\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.
CVSS Score: 8.8 (HIGH)
CWE: CWE-470
References: http://seclists.org/fulldisclosure/2024/Mar/16; https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83; https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f
CVE: CVE-2024-28186
Published: 2024-03-12
Description: FreeScout is an open source help desk and shared inbox built with PHP.

A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing complete stack traces of exceptions in its database. The sensitive information is then inadvertently disclosed to users via the `/conversation/ajax-html/send_log?folder_id=&thread_id={id}` endpoint. The stack trace reveals value of parameters, including the username and password, passed to the `Swift_Transport_Esmtp_Auth_LoginAuthenticator->authenticate()` function. Exploiting this vulnerability allows an attacker to gain unauthorized access to SMTP server credentials. With this sensitive information in hand, the attacker can potentially send unauthorized emails from the compromised SMTP server, posing a severe threat to the confidentiality and integrity of email communications. This could lead to targeted attacks on both the application users and the organization itself, compromising the security of email exchange servers. This issue has been addressed in version 1.8.124. Users are advised to upgrade. Users unable to upgrade should adopt the following measures: 1. Avoid Storing Complete Stack Traces, 2. Implement redaction mechanisms to filter and exclude sensitive information, and 3. Review and enhance the application's logging practices.
CVSS Score: 7.1 (HIGH)
CWE: CWE-532, CWE-532
References: https://github.com/freescout-helpdesk/freescout/commit/33639a89554998dcac645613130a27ac7872605e; https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-7wcq-2qmv-mvcm; https://github.com/freescout-helpdesk/freescout/commit/33639a89554998dcac645613130a27ac7872605e
CVE: CVE-2024-2031
Published: 2024-03-12
Description: The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meeting' shortcode in all versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3048838/video-conferencing-with-zoom-api/trunk/includes/Shortcodes/Recordings.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/06e48355-6932-4401-8787-e[PII_REDACTED]f?source=cve; https://plugins.trac.wordpress.org/changeset/3048838/video-conferencing-with-zoom-api/trunk/includes/Shortcodes/Recordings.php
CVE: CVE-2024-2130
Published: 2024-03-12
Description: The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049008%40cww-companion&new=3049008%40cww-companion&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d82d43b9-4c70-4525-88ba-eec7c81a62c1?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049008%40cww-companion&new=3049008%40cww-companion&sfp_email=&sfph_mail=
CVE: CVE-2023-42307
Published: 2024-03-12
Description: Cross Site Scripting (XSS) vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via "Subject Name" and "Subject Code" section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ASR511-OO7/CVE-2023-42307/blob/main/CVE-6; https://github.com/ASR511-OO7/CVE-2023-42307/blob/main/CVE-6
CVE: CVE-2023-42308
Published: 2024-03-12
Description: Cross Site Scripting (XSS) vulnerability in Manage Fastrack Subjects in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via the "Subject Name" and "Subject Code" Section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ASR511-OO7/CVE-2023-42308/blob/main/CVE-7; https://github.com/ASR511-OO7/CVE-2023-42308/blob/main/CVE-7
CVE: CVE-2023-43292
Published: 2024-03-12
Description: Cross Site Scripting vulnerability in My Food Recipe Using PHP with Source Code v.1.0 allows a local attacker to execute arbitrary code via a crafted payload to the Recipe Name, Procedure, and ingredients parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ASR511-OO7/CVE-2023-43292/blob/main/CVE-8; https://github.com/ASR511-OO7/CVE-2023-43292/blob/main/CVE-8
CVE: CVE-2024-23300
Published: 2024-03-12
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in GarageBand 10.4.11. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://support.apple.com/en-us/120885; http://seclists.org/fulldisclosure/2024/Mar/27; https://support.apple.com/en-us/HT214090
CVE: CVE-2024-24092
Published: 2024-03-12
Description: SQL Injection vulnerability in Code-projects.org Scholars Tracking System 1.0 allows attackers to run arbitrary code via login.php.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: https://github.com/ASR511-OO7/CVE-2024-24092/blob/main/CVE-9; https://github.com/ASR511-OO7/CVE-2024-24092/blob/main/CVE-9
CVE: CVE-2024-24093
Published: 2024-03-12
Description: SQL Injection vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via Personal Information Update information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/ASR511-OO7/CVE-2024-24093/blob/main/CVE-10; https://github.com/ASR511-OO7/CVE-2024-24093/blob/main/CVE-10
CVE: CVE-2024-24097
Published: 2024-03-12
Description: Cross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News Feed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ASR511-OO7/CVE-2024-24097/blob/main/CVE-12; https://github.com/ASR511-OO7/CVE-2024-24097/blob/main/CVE-12
CVE: CVE-2024-27305
Published: 2024-03-12
Description: aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbb; https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65; https://www.postfix.org/smtp-smuggling.html
CVE: CVE-2024-28236
Published: 2024-03-12
Description: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block. This unexpected behavior primarily impacts secrets restricted by the "no commands" option. This can lead to unintended use of the secret value, and increased risk of exposing the secret during image execution bypassing log masking. **To exploit this** the pipeline author must be supplying the secrets to a plugin that is designed in such a way that will print those parameters in logs. Plugin parameters are not designed for sensitive values and are often intentionally printed throughout execution for informational/debugging purposes. Parameters should therefore be treated as insensitive. While Vela provides secrets masking, secrets exposure is not entirely solved by the masking process. A docker image (plugin) can easily expose secrets if they are not handled properly, or altered in some way. There is a responsibility on the end-user to understand how values injected into a plugin are used. This is a risk that exists for many CICD systems (like GitHub Actions) that handle sensitive runtime variables. Rather, the greater risk is that users who restrict a secret to the "no commands" option and use image restriction can still have their secret value exposed via substitution tinkering, which turns the image and command restrictions into a false sense of security. This issue has been addressed in version 0.23.2. Users are advised to upgrade. Users unable to upgrade should not provide sensitive values to plugins that can potentially expose them, especially in `parameters` that are not intended to be used for sensitive values, ensure plugins (especially those that utilize shared secrets) follow best practices to avoid logging parameters that are expected to be sensitive, minimize secrets with `pull_request` events enabled, as this allows users to change pipeline configurations and pull in secrets to steps not typically part of the CI process, make use of the build approval setting, restricting builds from untrusted users, and limit use of shared secrets, as they are less restrictive to access by nature.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200, CWE-532, CWE-532
References: https://github.com/go-vela/worker/commit/e1572743b008e4fbce31ebb1dcd23bf6a1a30297; https://github.com/go-vela/worker/security/advisories/GHSA-pwx5-6wxg-px5h; https://github.com/go-vela/worker/commit/e1572743b008e4fbce31ebb1dcd23bf6a1a30297
CVE: CVE-2024-28238
Published: 2024-03-12
Description: Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user. This issue has been addressed in version 10.10.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.3 (LOW)
CWE: CWE-200, CWE-598
References: https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677; https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
CVE: CVE-2024-28239
Published: 2024-03-12
Description: Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password. Users who login via OAuth2 into Directus may be at risk. This issue has been addressed in version 10.10.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://docs.directus.io/reference/authentication.html#login-using-sso-providers; https://github.com/directus/directus/commit/5477d7d61babd7ffc2f835d399bf79611b15b203; https://github.com/directus/directus/security/advisories/GHSA-fr3w-2p22-6w7p
CVE: CVE-2024-2406
Published: 2024-03-12
Description: A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Upload.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256503.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://note.zhaoj.in/share/7kZiVRqSuiMx; https://vuldb.com/?ctiid.256503; https://vuldb.com/?id.256503
CVE: CVE-2023-43279
Published: 2024-03-12
Description: Null Pointer Dereference in mask_cidr6 component at cidr.c in Tcpreplay 4.4.4 allows attackers to crash the application via crafted tcprewrite command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/appneta/tcpreplay/issues/824; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EHUILQV2YJI5TXXXJA5FQ2HJQGFT7NTN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMW5CIODKRHUUH7NTAYIRWGSJ56DTGXM/
CVE: CVE-2024-0386
Published: 2024-03-12
Description: The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' HTTP header in all versions up to, and including, 1.6.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3047406%40weforms&new=3047406%40weforms&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f436ab65-a59c-4b2a-abc8-a7fc038678dd?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3047406%40weforms&new=3047406%40weforms&sfp_email=&sfph_mail=
CVE: CVE-2024-24101
Published: 2024-03-12
Description: Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Eligibility Information Update.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/ASR511-OO7/CVE-2024-24101/blob/main/CVE-14; https://github.com/ASR511-OO7/CVE-2024-24101/blob/main/CVE-14
CVE: CVE-2024-2107
Published: 2024-03-12
Description: The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generated source. This makes it possible for unauthenticated attackers to extract sensitive data including contents of password-protected or scheduled posts.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-862
References: https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=220138%40blossom-spa&new=220138%40blossom-spa&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5e54dbf9-a5d1-413d-96ac-93dd499c21a4?source=cve; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=220138%40blossom-spa&new=220138%40blossom-spa&sfp_email=&sfph_mail=
CVE: CVE-2024-2395
Published: 2024-03-12
Description: The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.14. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to generate and delete labels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862, CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034198%40bulgarisation-for-woocommerce&new=3034198%40bulgarisation-for-woocommerce&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff1d12e-1129-40d3-8c29-3a46ffc77872?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034198%40bulgarisation-for-woocommerce&new=3034198%40bulgarisation-for-woocommerce&sfp_email=&sfph_mail=
CVE: CVE-2023-7072
Published: 2024-03-12
Description: The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 via the 'get_posts' REST API Endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including full draft posts and password protected posts, as well as the password for password-protected posts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-202
References: https://plugins.trac.wordpress.org/browser/post-grid/tags/2.2.68/src/functions-rest.php#L1670; https://plugins.trac.wordpress.org/browser/post-grid/tags/2.2.69/includes/blocks/functions-rest.php#L1670; https://www.wordfence.com/threat-intel/vulnerabilities/id/feee3268-b384-400c-a76d-e5d7972c05b7?source=cve
CVE: CVE-2024-1397
Published: 2024-03-12
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on the 'titleTag' user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/accordion-card/index.php#L17; https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/cta/index.php#L22; https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/info-box/index.php#L55
CVE: CVE-2024-1421
Published: 2024-03-12
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribute of the Post Carousel widget in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/includes/widgets/htmega_post_carousel.php#L2243; https://www.wordfence.com/threat-intel/vulnerabilities/id/a71cbe66-4187-4260-bb87-8579bc6e75f5?source=cve; https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/includes/widgets/htmega_post_carousel.php#L2243
CVE: CVE-2023-4839
Published: 2024-03-13
Description: The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3045434/wp-google-maps/trunk/legacy-core.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/208c5ed1-879f-45ea-833e-d2e54c4f063f?source=cve; https://plugins.trac.wordpress.org/changeset/3045434/wp-google-maps/trunk/legacy-core.php
CVE: CVE-2024-1582
Published: 2024-03-13
Description: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgmza' shortcode in all versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3045434/wp-google-maps/trunk/includes/class.shortcodes.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/67f405d0-7139-4b5c-ab3c-cd1de5592866?source=cve; https://plugins.trac.wordpress.org/changeset/3045434/wp-google-maps/trunk/includes/class.shortcodes.php