deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-36278
Published: 2024-07-02
Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion.
CVSS Score: 3.3 (LOW)
CWE: CWE-843, CWE-843
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md
CVE: CVE-2024-37030
Published: 2024-07-02
Description: in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through use after free.
CVSS Score: 8.2 (HIGH)
CWE: CWE-416, CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md
CVE: CVE-2024-37077
Published: 2024-07-02
Description: in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md
CVE: CVE-2024-37185
Published: 2024-07-02
Description: in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md
CVE: CVE-2024-4836
Published: 2024-07-02
Description: Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user.
The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://cert.pl/en/posts/2024/07/CVE-2024-4836; https://cert.pl/posts/2024/07/CVE-2024-4836; https://www.edito.pl/
CVE: CVE-2024-5260
Published: 2024-07-02
Description: The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘read_more_text’ parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.5.6/widgets/advanced/sina-blogpost.php?rev=3110446; https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.5.6/widgets/basic/sina-table.php?rev=3110446; https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-blogpost.php#L2067
CVE: CVE-2024-20888
Published: 2024-07-02
Description: Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. User interaction is required for triggering this vulnerability.
CVSS Score: 7.8 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20889
Published: 2024-07-02
Description: Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20890
Published: 2024-07-02
Description: Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20891
Published: 2024-07-02
Description: Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
CVSS Score: 7.8 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20892
Published: 2024-07-02
Description: Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors. User interaction is required for triggering this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20893
Published: 2024-07-02
Description: Improper input validation in libmediaextractorservice.so prior to SMR Jul-2024 Release 1 allows local attackers to trigger memory corruption.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20894
Published: 2024-07-02
Description: Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain condition. User interaction is required for triggering this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20895
Published: 2024-07-02
Description: Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features.
CVSS Score: 7.7 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20896
Published: 2024-07-02
Description: Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20897
Published: 2024-07-02
Description: Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20898
Published: 2024-07-02
Description: Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20899
Published: 2024-07-02
Description: Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20900
Published: 2024-07-02
Description: Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-20901
Published: 2024-07-02
Description: Improper input validation in copying data to buffer cache in libsaped prior to SMR Jul-2024 Release 1 allows local attackers to write out-of-bounds memory.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34583
Published: 2024-07-02
Description: Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34584
Published: 2024-07-02
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. Reason: An additional patch is required.
CVE: CVE-2024-34585
Published: 2024-07-02
Description: Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
CVSS Score: 7.8 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34586
Published: 2024-07-02
Description: Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy.
CVSS Score: 5.9 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34587
Published: 2024-07-02
Description: Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34588
Published: 2024-07-02
Description: Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34589
Published: 2024-07-02
Description: Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34590
Published: 2024-07-02
Description: Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34591
Published: 2024-07-02
Description: Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34592
Published: 2024-07-02
Description: Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34593
Published: 2024-07-02
Description: Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34594
Published: 2024-07-02
Description: Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34595
Published: 2024-07-02
Description: Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
CVSS Score: 7.8 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07
CVE: CVE-2024-34596
Published: 2024-07-02
Description: Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE: CVE-2024-34597
Published: 2024-07-02
Description: Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sandbox of Samsung Health. User interaction is required for triggering this vulnerability.
CVSS Score: 4.4 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE: CVE-2024-34599
Published: 2024-07-02
Description: Improper input validation in Tips prior to version 6.2.9.4 in Android 14 allows local attacker to send broadcast with Tips&#39; privilege.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE: CVE-2024-34600
Published: 2024-07-02
Description: Improper verification of intent by broadcast receiver vulnerability in Samsung Flow prior to version 4.9.13.0 allows local attackers to copy image files to external storage.
CVSS Score: 4.4 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE: CVE-2024-34601
Published: 2024-07-02
Description: Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activities of GalaxyStore.
CVSS Score: 5.9 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
CVE: CVE-2024-6011
Published: 2024-07-02
Description: The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://drive.google.com/file/d/1SFQXlRUQw7THm_Vay_pFH3pIX1cjH4AY/view?usp=sharing; https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/templates/frontend/fields/cost-text.php#L15; https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/templates/frontend/fields/cost-text.php#L26
CVE: CVE-2024-6012
Published: 2024-07-02
Description: The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary posts and append arbitrary content to existing posts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/admin.js; https://plugins.trac.wordpress.org/changeset/3108606/; https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7da039-f6b8-46b7-a43a-145e9f8844c3?source=cve
CVE: CVE-2024-4268
Published: 2024-07-02
Description: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37457 may be a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/advanced-heading/block.php; https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/how-to/block.php; https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/image-slider/block.php
CVE: CVE-2024-6088
Published: 2024-07-02
Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user registration to create a new account with the default role.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/class-lp-forms-handler.php#L235; https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/jwt/includes/class-jwt-public.php#L127; https://plugins.trac.wordpress.org/changeset/3109339/
CVE: CVE-2024-6099
Published: 2024-07-02
Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'check_validate_fields' function in the checkout. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-420
References: https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/class-lp-checkout.php#L124; https://plugins.trac.wordpress.org/changeset/3109339/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee714c7-4c9b-4627-9ba9-f83aeca6a0a5?source=cve
CVE: CVE-2024-6264
Published: 2024-07-02
Description: The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/post-meta-data-manager/trunk/includes/admin/html/pmdm_wp_display_post_metadata_html.php#L23; https://plugins.trac.wordpress.org/browser/post-meta-data-manager/trunk/includes/admin/html/pmdm_wp_display_term_metadata_html.php#L32; https://plugins.trac.wordpress.org/browser/post-meta-data-manager/trunk/includes/admin/html/pmdm_wp_display_user_metadata_html.php#L31
CVE: CVE-2024-6438
Published: 2024-07-02
Description: A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-270166 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Hitout/carsale/issues/23; https://vuldb.com/?ctiid.270166; https://vuldb.com/?id.270166
CVE: CVE-2024-6439
Published: 2024-07-02
Description: A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270167.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/GAO-UNO/cve/blob/main/upload.md; https://vuldb.com/?ctiid.270167; https://vuldb.com/?id.270167
CVE: CVE-2024-6440
Published: 2024-07-02
Description: A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270168.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/reverseD0G/cve/blob/main/sql.md; https://vuldb.com/?ctiid.270168; https://vuldb.com/?id.270168
CVE: CVE-2024-6441
Published: 2024-07-02
Description: A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/oripa/persistence/doc/loader/LoaderXML.java. The manipulation leads to deserialization. The attack can be launched remotely. Upgrading to version 1.80 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-270169 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/oripa/oripa/issues/355; https://github.com/oripa/oripa/milestone/15; https://github.com/oripa/oripa/pull/356/commits/1abf8eb9b6b173d86d277426db1a551d6490c94a
CVE: CVE-2024-39119
Published: 2024-07-02
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/[PII_REDACTED]/cms/blob/main/1.md; https://github.com/[PII_REDACTED]/cms/blob/main/1.md