deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-7066
Published: 2024-08-12
Description: The affected applications contain an out of bounds read past the end of 
an allocated structure while parsing specially crafted PDF files. This 
could allow an attacker to execute code in the context of the current 
process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-722010.html; https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-03
CVE: CVE-2024-43151
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite allows Stored XSS.This issue affects Ultimate Addons for Beaver Builder – Lite: from n/a through 1.5.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-addons-for-beaver-builder-lite/wordpress-ultimate-addons-for-beaver-builder-lite-plugin-1-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43152
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery allows Stored XSS.This issue affects 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery: from n/a through 1.15.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/interactive-3d-flipbook-powered-physics-engine/wordpress-3d-flipbook-plugin-1-15-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43155
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins ComboBlocks allows Stored XSS.This issue affects ComboBlocks: from n/a through 2.2.86.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/post-grid/wordpress-comboblocks-plugin-2-2-86-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43156
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Reflected XSS.This issue affects Post Grid Master: from n/a through 3.4.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43161
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.1.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/depicter/wordpress-slider-popup-builder-by-depicter-plugin-3-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43163
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Parcel Panel ParcelPanel allows Reflected XSS.This issue affects ParcelPanel: from n/a through 4.3.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/parcelpanel/wordpress-parcelpanel-plugin-4-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43164
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Blockspare allows Stored XSS.This issue affects Blockspare: from n/a through 3.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/blockspare/wordpress-blockspare-plugin-3-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43210
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.9.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43213
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Reflected XSS.This issue affects WC Marketplace: from n/a through 4.1.17.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dc-woocommerce-multi-vendor/wordpress-multivendorx-marketplace-plugin-4-1-17-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43216
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Filr filr-protection.This issue affects Filr: from n/a through <= 1.2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/filr-protection/vulnerability/wordpress-filr-secure-document-library-plugin-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43217
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes allows Reflected XSS.This issue affects Kodex Posts likes: from n/a through 2.5.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/kodex-posts-likes/wordpress-kodex-posts-likes-plugin-2-5-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43218
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mediavine Mediavine Control Panel mediavine-control-panel.This issue affects Mediavine Control Panel: from n/a through <= 2.10.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mediavine-control-panel/vulnerability/wordpress-mediavine-control-panel-plugin-2-10-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43220
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Reflected XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.26.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-plugin-1-15-26-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43224
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yuri Baranov YaMaps for WordPress allows Stored XSS.This issue affects YaMaps for WordPress: from n/a through 0.6.27.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/yamaps/wordpress-yamaps-for-wordpress-plugin-plugin-0-6-27-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43225
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeLooks Enter Addons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/enteraddons/wordpress-enter-addons-plugin-2-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43226
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jeroen Sormani WP Dashboard Notes allows Stored XSS.This issue affects WP Dashboard Notes: from n/a through 1.0.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-dashboard-notes/wordpress-wp-dashboard-notes-plugin-1-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-7590
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows DOM-Based XSS.This issue affects Spectra: from n/a through <= 2.14.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-14-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35775
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Authentication vulnerability in Soliloquy Team Slider by Soliloquy allows Cross-Site Scripting (XSS).This issue affects Slider by Soliloquy: from n/a through 2.7.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-287
References: https://patchstack.com/database/vulnerability/soliloquy-lite/wordpress-slider-by-soliloquy-plugin-2-7-6-broken-access-control-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37924
Published: 2024-08-12
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wp2speed WP2Speed Faster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP2Speed Faster: from n/a through 1.0.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/wp2speed/wordpress-wp2speed-faster-optimize-pagespeed-insights-score-90-100-plugin-1-0-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-37930
Published: 2024-08-12
Description: Insertion of Sensitive Information into Log File vulnerability in ThemeSphere SmartMag smartmag-responsive-retina-wordpress-magazine.This issue affects SmartMag: from n/a through < 10.1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532, CWE-862
References: https://patchstack.com/database/Wordpress/Theme/smartmag-responsive-retina-wordpress-magazine/vulnerability/wordpress-smartmag-theme-9-3-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-43123
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Card Elements for Elementor allows Stored XSS.This issue affects Card Elements for Elementor: from n/a through 1.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/card-elements-for-elementor/wordpress-card-elements-for-elementor-plugin-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43124
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Iqonic Design Graphina allows Stored XSS.This issue affects Graphina: from n/a through 1.8.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/graphina-elementor-charts-and-graphs/wordpress-graphina-plugin-1-8-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43125
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder – WordPress Table Plugin allows Stored XSS.This issue affects WP Table Builder – WordPress Table Plugin: from n/a through 1.4.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-table-builder/wordpress-wp-table-builder-plugin-1-4-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43126
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce allows Reflected XSS.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sender-net-automated-emails/wordpress-sender-newsletter-sms-and-email-marketing-automation-for-woocommerce-plugin-2-6-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43127
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPFactory Products, Order & Customers Export for WooCommerce allows Reflected XSS.This issue affects Products, Order & Customers Export for WooCommerce: from n/a through 2.0.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/export-woocommerce/wordpress-products-order-customers-export-for-woocommerce-plugin-2-0-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43130
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.10.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/football-pool/wordpress-football-pool-plugin-2-11-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43133
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themify Themify Shortcodes allows Stored XSS.This issue affects Themify Shortcodes: from n/a through 2.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/themify-shortcodes/wordpress-themify-shortcodes-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43137
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WappPress Team WappPress allows Stored XSS.This issue affects WappPress: from n/a through 6.0.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wapppress-builds-android-app-for-website/wordpress-wapppress-basic-plugin-6-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43139
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/football-pool/wordpress-football-pool-plugin-2-11-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43147
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Merkulove Selection Lite allows Stored XSS.This issue affects Selection Lite: from n/a through 1.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/selection-lite/wordpress-selection-lite-plugin-1-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43148
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins StreamCast allows Stored XSS.This issue affects StreamCast: from n/a through 2.2.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/streamcast/wordpress-streamcast-2-2-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43149
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through 4.3.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/enhanced-tooltipglossary/wordpress-cm-tooltip-glossary-plugin-4-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43150
Published: 2024-08-12
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through 1.4.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/xpro-elementor-addons/wordpress-xpro-elementor-addons-plugin-1-4-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-7705
Published: 2024-08-12
Description: A vulnerability was found in Fujian mwcms 1.0.0. It has been declared as critical. Affected by this vulnerability is the function uploadeditor of the file /uploadeditor.html?action=uploadimage of the component Image Upload. The manipulation of the argument upfile leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/Mirage/blob/main/CVE12-1.md; https://vuldb.com/?ctiid.274183; https://vuldb.com/?id.274183
CVE: CVE-2024-7706
Published: 2024-08-12
Description: A vulnerability was found in Fujian mwcms 1.0.0. It has been rated as critical. Affected by this issue is the function uploadimage of the file /uploadfile.html. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/Mirage/blob/main/CVE12-2.md; https://vuldb.com/?ctiid.274184; https://vuldb.com/?id.274184
CVE: CVE-2024-7707
Published: 2024-08-13
Description: A vulnerability was found in Tenda FH1206 02.03.01.35 and classified as critical. Affected by this issue is the function formSafeEmailFilter of the file /goform/SafeEmailFilter of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/VodkaVortex/IoT/blob/main/formSafeEmailFilter.md; https://vuldb.com/?ctiid.274190; https://vuldb.com/?id.274190
CVE: CVE-2024-7709
Published: 2024-08-13
Description: A vulnerability, which was classified as problematic, has been found in OcoMon 4.0RC1/4.0/5.0RC1. This issue affects some unknown processing of the file /includes/common/require_access_recovery.php of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.1 and 5.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://ocomon.com.br/site/atualizacao-de-seguranca/; https://ocomon.com.br/site/downloads/; https://vuldb.com/?ctiid.274205
CVE: CVE-2022-38382
Published: 2024-08-13
Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information.  IBM X-Force ID:  233672.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233672; https://www.ibm.com/support/pages/node/7165286
CVE: CVE-2024-7094
Published: 2024-08-13
Description: The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added. CVE-2024-43274 is likely a duplicate of this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/includes/css/style.php; https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/includes/formhandler.php; https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/modules/themes/controller.php
CVE: CVE-2024-7388
Published: 2024-08-13
Description: The WP Bannerize Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via banner alt data in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3133241/wp-bannerize-pro/trunk/plugin/CustomPostTypes/WPBannerizeCustomPostType.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/ba08dbad-15f9-43cf-b0d7-a2a4604cb4af?source=cve
CVE: CVE-2024-28166
Published: 2024-08-13
Description: SAP BusinessObjects Business Intelligence
  Platform allows an authenticated attacker to upload malicious code over the
  network, that could be executed by the application. On successful
  exploitation, the attacker can cause a low impact on the Integrity of the
  application.
CVSS Score: 3.7 (LOW)
CWE: CWE-434
References: https://me.sap.com/notes/3433545; https://me.sap.com/notes/3515653; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-33003
Published: 2024-08-13
Description: Some OCC API endpoints in SAP Commerce Cloud
allows Personally Identifiable Information (PII) data, such as passwords, email
addresses, mobile numbers, coupon codes, and voucher codes, to be included in
the request URL as query or path parameters. On successful exploitation, this
could lead to a High impact on confidentiality and integrity of the
application.
CVSS Score: 7.4 (HIGH)
CWE: CWE-200
References: https://me.sap.com/notes/3459935; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-33005
Published: 2024-08-13
Description: Due to the missing authorization checks in the
local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application
Server (ABAP and Java), and SAP Content Server can impersonate other users and
may perform some unintended actions. This could lead to a low impact on
confidentiality and a high impact on the integrity and availability of the
applications.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3438085; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-41730
Published: 2024-08-13
Description: In SAP BusinessObjects Business Intelligence
Platform, if Single Signed On is enabled on Enterprise authentication, an
unauthorized user can get a logon token using a REST endpoint. The attacker can
fully compromise the system resulting in High impact on confidentiality,
integrity and availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://me.sap.com/notes/3479478; https://url.sap/sapsecuritypatchday