deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-44082
Published: 2024-09-06
Description: In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: <21.4.3, >=22.0.0 <23.0.2, >=23.1.0 <24.1.2, >=25.0.0 <26.0.1; Ironic-python-agent: <9.4.2, >=9.5.0 <9.7.1, >=9.8.0 <9.11.1, >=9.12.0 <9.13.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://bugs.launchpad.net/ironic/+bug/2071740; https://security.openstack.org/ossa/OSSA-2024-003.html; https://www.openwall.com/lists/oss-security/2024/09/04/4
CVE: CVE-2024-40865
Published: 2024-09-06
Description: The issue was addressed by suspending Persona when the virtual keyboard is active. This issue is fixed in visionOS 1.3. Inputs to the virtual keyboard may be inferred from Persona.
CVSS Score: 5.3 (MEDIUM)
References: https://support.apple.com/en-us/120915
CVE: CVE-2024-7415
Published: 2024-09-06
Description: The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-209
References: https://plugins.trac.wordpress.org/browser/remember-me-controls/tags/2.0.1/tests/phpunit/bootstrap.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3146603%40remember-me-controls&new=3146603%40remember-me-controls&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/01707346-86c2-45c8-a2c9-81a147506fa4?source=cve
CVE: CVE-2024-8247
Published: 2024-09-06
Description: The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restricting what user meta can be updated as screen options. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator. Please note that this only affects users with access to edit/update screen options, which means an administrator would need to grant lower privilege users with access to the Sent & Draft Emails page of the plugin in order for this to be exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.9.9.1/wp-mailinglist.php#L3279; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3146287%40newsletters-lite&new=3146287%40newsletters-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2577102f-6355-4483-bd3d-1948497cb843?source=cve
CVE: CVE-2024-8480
Published: 2024-09-06
Description: The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sirv_save_prevented_sizes' function in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to exploit the 'sirv_upload_file_by_chunks_callback' function, which lacks proper file type validation, allowing attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.7/sirv.php#L6331; https://plugins.trac.wordpress.org/browser/sirv/trunk/sirv.php?rev=3103410#L4647; https://plugins.trac.wordpress.org/changeset/3115018/
CVE: CVE-2024-38486
Published: 2024-09-06
Description: Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://www.dell.com/support/kbdoc/en-us/000228355/dsa-2024-376-security-update-for-dell-networking-os10-vulnerability
CVE: CVE-2024-39585
Published: 2024-09-06
Description: Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Client-side request forgery and Information disclosure.
CVSS Score: 7.9 (HIGH)
CWE: CWE-259, CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000228355/dsa-2024-376-security-update-for-dell-networking-os10-vulnerability
CVE: CVE-2024-45751
Published: 2024-09-06
Description: tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-338
References: https://github.com/fujita/tgt/compare/v1.0.92...v1.0.93; https://github.com/fujita/tgt/pull/67; https://www.openwall.com/lists/oss-security/2024/09/07/2
CVE: CVE-2024-6792
Published: 2024-09-06
Description: The WP ULike  WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3c470edd-4b9b-461e-839f-f3a87f0060aa/
CVE: CVE-2024-7349
Published: 2024-09-06
Description: The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/3139798/lifterlms/tags/7.7.6/includes/abstracts/abstract.llms.database.query.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3a096506-b18e-419c-808b-6099baa628ce?source=cve
CVE: CVE-2024-8292
Published: 2024-09-06
Description: The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for unauthenticated attackers to supply any email through the user_email field and update the password for that user during new order creation. This requires the commerce addon to be enabled in order to exploit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/wp-recall/tags/16.26.8/add-on/commerce/classes/class-rcl-create-order.php#L127; https://plugins.trac.wordpress.org/browser/wp-recall/tags/16.26.8/add-on/commerce/functions-frontend.php#L113; https://plugins.trac.wordpress.org/browser/wp-recall/tags/16.26.8/rcl-functions.php#L1339
CVE: CVE-2024-8317
Published: 2024-09-06
Description: The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ad_alignment’ attribute in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpadcenter/trunk/admin/class-wpadcenter-admin.php#L2922; https://plugins.trac.wordpress.org/browser/wpadcenter/trunk/admin/class-wpadcenter-admin.php#L3020; https://plugins.trac.wordpress.org/browser/wpadcenter/trunk/admin/class-wpadcenter-admin.php#L3127
CVE: CVE-2024-8427
Published: 2024-09-06
Description: The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.2/includes/classes/admin/class-fpsml-ajax-admin.php#L25; https://plugins.trac.wordpress.org/changeset/3147218/frontend-post-submission-manager-lite/trunk/includes/classes/admin/class-fpsml-ajax-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e84b68b6-1ce8-45fb-823f-a61158aa4d21?source=cve
CVE: CVE-2023-52915
Published: 2024-09-06
Description: In the Linux kernel, the following vulnerability has been resolved:

media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer

In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0143f282b15f7cedc0392ea10050fb6000fd16e6; https://git.kernel.org/stable/c/41b7181a40af84448a2b144fb02d8bf32b7e9a23; https://git.kernel.org/stable/c/6c01ef65de0b321b2db1ef9abf8f1d15862b937e
CVE: CVE-2023-52916
Published: 2024-09-06
Description: In the Linux kernel, the following vulnerability has been resolved:

media: aspeed: Fix memory overwrite if timing is 1600x900

When capturing 1600x900, system could crash when system memory usage is
tight.

The way to reproduce this issue:
1. Use 1600x900 to display on host
2. Mount ISO through 'Virtual media' on OpenBMC's web
3. Run script as below on host to do sha continuously
  #!/bin/bash
  while [ [1] ];
  do
	find /media -type f -printf '"%h/%f"\n' | xargs sha256sum
  done
4. Open KVM on OpenBMC's web

The size of macro block captured is 8x8. Therefore, we should make sure
the height of src-buf is 8 aligned to fix this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/4c823e4027dd1d6e88c31028dec13dd19bc7b02d; https://git.kernel.org/stable/c/c281355068bc258fd619c5aefd978595bede7bfe; https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
CVE: CVE-2024-1744
Published: 2024-09-06
Description: Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data.This issue affects Accord ORS: before 7.3.2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-862
References: https://www.usom.gov.tr/bildirim/tr-24-1408
CVE: CVE-2024-44739
Published: 2024-09-06
Description: Sourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/?page=manage_user&id=.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/zach341/Cve_report/blob/main/simple-forum-website/SQLi-1.md
CVE: CVE-2024-45039
Published: 2024-09-06
Description: gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case of multiple commitments used inside the circuit the prover is able to choose all but the last commitment. As gnark uses the commitments for optimized non-native multiplication, lookup checks etc. as random challenges, then it could impact the soundness of the whole circuit. However, using multiple commitments has been discouraged due to the additional cost to the verifier and it has not been supported in the recursive in-circuit Groth16 verifier and Solidity verifier. gnark's maintainers expect the impact of the issue be very small - only for the users who have implemented the native Groth16 verifier or are using it with multiple commitments. We do not have information of such users. The issue has been patched in version 0.11.0. As a workaround, users should follow gnark maintainers' recommendation to use only a single commitment and then derive in-circuit commitments as needed using the `std/multicommit` package.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://github.com/Consensys/gnark/commit/e7c66b000454f4d2a4ae48c005c34154d4cfc2a2; https://github.com/Consensys/gnark/security/advisories/GHSA-q3hw-3gm4-w5cr
CVE: CVE-2024-45040
Published: 2024-09-06
Description: gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments to private witnesses in Groth16 as implemented break the zero-knowledge property. The vulnerability affects only Groth16 proofs with commitments. Notably, PLONK proofs are not affected. The vulnerability affects the zero-knowledge property of the proofs - in case the witness (secret or internal) values are small, then the attacker may be able to enumerate all possible choices to deduce the actual value. If the possible choices for the variables to be committed is large or there are many values committed, then it would be computationally infeasible to enumerate all valid choices. It doesn't affect the completeness/soundness of the proofs. The vulnerability has been fixed in version 0.11.0. The patch to fix the issue is to add additional randomized value to the list of committed value at proving time to mask the rest of the values which were committed. As a workaround, the user can manually commit to a randomized value.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/Consensys/gnark/commit/afda68a38acca37becb8ba6d8982d03fee9559a0; https://github.com/Consensys/gnark/pull/1245; https://github.com/Consensys/gnark/security/advisories/GHSA-9xcg-3q8v-7fq6
CVE: CVE-2024-45299
Published: 2024-09-06
Description: alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The Content-Security-Policy directive blocks any potential script execution. The administrator or event administrator can override the texts for customization purpose. The texts are not properly escaped. Version 2.0-M5 fixes this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116, CWE-116
References: https://github.com/alfio-event/alf.io/commit/e7131c588f4ac31067a41d0e31e6a6a721b2ff4b; https://github.com/alfio-event/alf.io/security/advisories/GHSA-mcx6-25f8-8rqw
CVE: CVE-2024-45300
Published: 2024-09-06
Description: alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-362
References: https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245; https://github.com/alfio-event/alf.io/security/advisories/GHSA-67jg-m6f3-473g
CVE: CVE-2024-45405
Published: 2024-09-06
Description: `gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in Rust) dealing paths and their conversions. Prior to version 0.10.11, `gix-path` runs `git` to find the path of a configuration file associated with the `git` installation, but improperly resolves paths containing unusual or non-ASCII characters, in rare cases enabling a local attacker to inject configuration leading to code execution. Version 0.10.11 contains a patch for the issue.

In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` to find the path of a file to treat as belonging to the `git` installation. Affected versions of `gix-path` do not pass `-z`/`--null` to cause `git` to report literal paths. Instead, to cover the occasional case that `git` outputs a quoted path, they attempt to parse the path by stripping the quotation marks. The problem is that, when a path is quoted, it may change in substantial ways beyond the concatenation of quotation marks. If not reversed, these changes can result in another valid path that is not equivalent to the original.

On a single-user system, it is not possible to exploit this, unless `GIT_CONFIG_SYSTEM` and `GIT_CONFIG_GLOBAL` have been set to unusual values or Git has been installed in an unusual way. Such a scenario is not expected. Exploitation is unlikely even on a multi-user system, though it is plausible in some uncommon configurations or use cases. In general, exploitation is more likely to succeed if users are expected to install `git` themselves, and are likely to do so in predictable locations; locations where `git` is installed, whether due to usernames in their paths or otherwise, contain characters that `git` quotes by default in paths, such as non-English letters and accented letters; a custom `system`-scope configuration file is specified with the `GIT_CONFIG_SYSTEM` environment variable, and its path is in an unusual location or has strangely named components; or a `system`-scope configuration file is absent, empty, or suppressed by means other than `GIT_CONFIG_NOSYSTEM`. Currently, `gix-path` can treat a `global`-scope configuration file as belonging to the installation if no higher scope configuration file is available. This increases the likelihood of exploitation even on a system where `git` is installed system-wide in an ordinary way. However, exploitation is expected to be very difficult even under any combination of those factors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-41, CWE-427
References: https://github.com/Byron/gitoxide/blob/1cfe577d461293879e91538dbc4bbfe01722e1e8/gix-path/src/env/git/mod.rs#L138-L142; https://github.com/Byron/gitoxide/commit/650a1b5cf25e086197cc55a68525a411e1c28031; https://github.com/Byron/gitoxide/security/advisories/GHSA-m8rp-vv92-46c7
CVE: CVE-2024-44837
Published: 2024-09-06
Description: A cross-site scripting (XSS) vulnerability in the component \bean\Manager.java of Drug v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kaput-raptorex-7c1.notion.site/drug-1-0-DOM-based-cross-site-scripting-fae620f769304f67a7488a961d048672
CVE: CVE-2024-6445
Published: 2024-09-06
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal.This issue affects DataDiodeX: from v3.0.0 before v3.1.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.usom.gov.tr/bildirim/tr-24-1409
CVE: CVE-2024-7493
Published: 2024-09-06
Description: The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wp_insert_user() during registration. This makes it possible for unauthenticated attackers to update their role to that of an administrator during registration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.5.2/includes/form-validation.php#L267; https://plugins.trac.wordpress.org/changeset/3147399/wpcom-member/trunk/includes/form-validation.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7f3e0c-a07c-4082-9b6b-12d0fbe0fdc8?source=cve
CVE: CVE-2024-7599
Published: 2024-09-06
Description: The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermon_video_embed’ parameter in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/advanced-sermons/trunk/admin/meta/sermon-details.php#L396; https://plugins.trac.wordpress.org/browser/advanced-sermons/trunk/include/templates/sections/video-template.php#L124; https://plugins.trac.wordpress.org/browser/advanced-sermons/trunk/include/templates/sections/video-template.php#L18
CVE: CVE-2024-7611
Published: 2024-09-06
Description: The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/enteraddons/trunk/widgets/events_card/traits/Templates_Components.php?rev=3097339#L25; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3148550%40enteraddons&new=3148550%40enteraddons&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f7580145-03da-4aff-b804-39125e7daad1?source=cve
CVE: CVE-2024-7622
Published: 2024-09-06
Description: The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the _a_ajaxQuickEmailTestCallback() function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to send emails with arbitrary content to any individual through the vulnerable web server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/revision-manager-tmc/trunk/src/Components/Notifications.php#L357; https://plugins.trac.wordpress.org/changeset/3147298/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8a6ff9-6aa8-4e0f-b058-759561a55508?source=cve
CVE: CVE-2024-8428
Published: 2024-09-06
Description: The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submit_form_handler due to missing validation on the 'user_id' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address of administrative user accounts which can then be leveraged to reset the administrative users password and gain access to their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/forumwp/trunk/includes/frontend/class-actions-listener.php#L179; https://plugins.trac.wordpress.org/changeset/3161123/forumwp/tags/2.1.0/includes/frontend/class-actions-listener.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b5818587-0a52-4734-8f75-263b4ab5020e?source=cve