deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9595
Published: 2024-10-12
Description: The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3165531%40tablepress%2Ftrunk&old=3149006%40tablepress%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa3b85c-7d08-4f6a-889e-b75620f72a1a?source=cve
CVE: CVE-2024-9696
Published: 2024-10-12
Description: The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rescue_tab' shortcode in all versions up to, and including, 2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3167329%40rescue-shortcodes&new=3167329%40rescue-shortcodes&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9517db1f-1704-4f25-9b02-795da3c4c067?source=cve
CVE: CVE-2024-8757
Published: 2024-10-12
Description: The WP Post Author – Boost Your Blog&#039;s Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the linked_user_id parameter in all versions up to, and including, 3.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/GumGumZz/wordpress/blob/main/wp-post-author.md; https://plugins.trac.wordpress.org/browser/wp-post-author/trunk/includes/multi-authors/wpa-multi-authors.php#L182; https://plugins.trac.wordpress.org/changeset/3166002/wp-post-author/trunk/includes/multi-authors/wpa-multi-authors.php
CVE: CVE-2024-8902
Published: 2024-10-12
Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_column function in modules/data-table/widgets/data-table.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3163899/addon-elements-for-elementor-page-builder; https://www.wordfence.com/threat-intel/vulnerabilities/id/7317ecf5-d43d-4080-ad2a-7644764dd41e?source=cve
CVE: CVE-2024-9894
Published: 2024-10-12
Description: A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/siyuancn-hub/cve/blob/main/sql7-.md; https://vuldb.com/?ctiid.280164
CVE: CVE-2024-49193
Published: 2024-10-12
Description: Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and used to grant additional authorization for ticket viewing, the mechanism for detecting spoofed e-mail messages is insufficient, and the support e-mail addresses associated with individual tickets are predictable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b9d2cf2e52; https://news.ycombinator.com/item?id=41818459; https://x.com/hackermondev/status/[PII_REDACTED]98537323
CVE: CVE-2024-9903
Published: 2024-10-12
Description: A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/File/fileUpload. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/Mirage/blob/main/CVE19-1.md; https://vuldb.com/?ctiid.280179; https://vuldb.com/?id.280179
CVE: CVE-2024-9904
Published: 2024-10-13
Description: A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/Mirage/blob/main/CVE19-2.md; https://vuldb.com/?ctiid.280180; https://vuldb.com/?id.280180
CVE: CVE-2024-9905
Published: 2024-10-13
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /admin/?page=inventory/view_inventory&id=2. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/higordiego/8679961c9d732e4068aaa37fd8d01439; https://vuldb.com/?ctiid.280181; https://vuldb.com/?id.280181
CVE: CVE-2024-9906
Published: 2024-10-13
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /admin/?page=inventory/view_inventory&id=2. The manipulation of the argument Code leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gist.github.com/higordiego/1c1e1709a6832cb63bbe9e9328f55ff9; https://vuldb.com/?ctiid.280182; https://vuldb.com/?id.280182
CVE: CVE-2024-9907
Published: 2024-10-13
Description: A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/controller/Forget.php of the component Verification Code Handler. The manipulation leads to weak password recovery. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-640
References: https://note.zhaoj.in/share/PZZ7IeudhULs; https://vuldb.com/?ctiid.280234; https://vuldb.com/?id.280234
CVE: CVE-2024-9908
Published: 2024-10-13
Description: A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formSetMACFilter of the file /goform/formSetMACFilter. The manipulation of the argument curTime leads to buffer overflow. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetMACFilter.md; https://vuldb.com/?ctiid.280236; https://vuldb.com/?id.280236
CVE: CVE-2024-6959
Published: 2024-10-13
Description: A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each character, rendering lollms-webui inaccessible. This issue is exacerbated by the lack of Cross-Site Request Forgery (CSRF) protection, enabling remote exploitation. The vulnerability leads to service disruption, resource exhaustion, and extended downtime.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://huntr.com/bounties/6394d32e-f35c-418a-95b8-e7254ed0bc8e
CVE: CVE-2024-9909
Published: 2024-10-13
Description: A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formSetMuti of the file /goform/formSetMuti. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetMuti.md; https://vuldb.com/?ctiid.280237; https://vuldb.com/?id.280237
CVE: CVE-2024-9910
Published: 2024-10-13
Description: A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetPassword.md; https://vuldb.com/?ctiid.280238; https://vuldb.com/?id.280238
CVE: CVE-2024-9911
Published: 2024-10-13
Description: A vulnerability was found in D-Link DIR-619L B1 2.06. It has been classified as critical. This affects the function formSetPortTr of the file /goform/formSetPortTr. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetPortTr.md; https://vuldb.com/?ctiid.280239; https://vuldb.com/?id.280239
CVE: CVE-2024-9912
Published: 2024-10-13
Description: A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formSetQoS of the file /goform/formSetQoS. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetQoS.md; https://vuldb.com/?ctiid.280240; https://vuldb.com/?id.280240
CVE: CVE-2024-9913
Published: 2024-10-13
Description: A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formSetRoute of the file /goform/formSetRoute. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetRoute.md; https://vuldb.com/?ctiid.280241; https://vuldb.com/?id.280241
CVE: CVE-2024-9914
Published: 2024-10-13
Description: A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formSetWizardSelectMode of the file /goform/formSetWizardSelectMode. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetWizardSelectMode.md; https://vuldb.com/?ctiid.280242; https://vuldb.com/?id.280242
CVE: CVE-2024-9915
Published: 2024-10-13
Description: A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formVirtualServ of the file /goform/formVirtualServ. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formVirtualServ.md; https://vuldb.com/?ctiid.280243; https://vuldb.com/?id.280243
CVE: CVE-2024-9916
Published: 2024-10-13
Description: A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://github.com/DeepMountains/zzz/blob/main/CVE5-1.md; https://vuldb.com/?ctiid.280244; https://vuldb.com/?id.280244
CVE: CVE-2024-8070
Published: 2024-10-13
Description: CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test
credentials in the firmware binary
CVSS Score: 8.5 (HIGH)
CWE: CWE-312
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-04.pdf
CVE: CVE-2024-9917
Published: 2024-10-13
Description: A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9. This affects an unknown part of the file app/modules/ut-template/admin/template_creat.php. The manipulation of the argument content leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/DeepMountains/zzz/blob/main/CVE5-2.md; https://vuldb.com/?ctiid.280245; https://vuldb.com/?id.280245
CVE: CVE-2024-9918
Published: 2024-10-13
Description: A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file app/modules/ut-data/admin/sql.php. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/DeepMountains/zzz/blob/main/CVE5-3.md; https://vuldb.com/?ctiid.280246; https://vuldb.com/?id.280246
CVE: CVE-2024-7099
Published: 2024-10-13
Description: netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_files`, and `get_file_by_status`. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/netease-youdao/qanything/commit/a87354f09d93e95350fb45eb343dc[PII_REDACTED]4; https://huntr.com/bounties/bc98983e-06cc-4a4b-be01-67e5010cb2c1
CVE: CVE-2024-9921
Published: 2024-10-14
Description: The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify and delete database contents.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-8125-4a1ad-2.html; https://www.twcert.org.tw/tw/cp-132-8124-d9b92-1.html
CVE: CVE-2024-9922
Published: 2024-10-14
Description: The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://www.twcert.org.tw/en/cp-139-8127-41699-2.html; https://www.twcert.org.tw/tw/cp-132-8126-5d9d2-1.html
CVE: CVE-2024-49214
Published: 2024-10-14
Description: QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://github.com/haproxy/haproxy/commit/f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46; https://www.haproxy.org/download/2.9/src/CHANGELOG; https://www.haproxy.org/download/3.0/src/CHANGELOG
CVE: CVE-2024-9923
Published: 2024-10-14
Description: The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access them.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23
References: https://www.twcert.org.tw/en/cp-139-8129-00002-2.html; https://www.twcert.org.tw/tw/cp-132-8128-772aa-1.html
CVE: CVE-2024-9924
Published: 2024-10-14
Description: The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can download arbitrary system files, which may be deleted subsequently .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-36
References: https://www.twcert.org.tw/en/cp-139-8131-0b5e1-2.html; https://www.twcert.org.tw/tw/cp-132-8130-89bb1-1.html
CVE: CVE-2024-38862
Published: 2024-10-14
Description: Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35, <2.1.0p48 and <=2.0.0p39 (EOL) causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://checkmk.com/werk/17095
CVE: CVE-2024-38863
Published: 2024-10-14
Description: Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-598
References: https://checkmk.com/werk/17096
CVE: CVE-2024-43701
Published: 2024-10-14
Description: Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-416
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities
CVE: CVE-2024-46911
Published: 2024-10-14
Description: Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges attack. This issue affects Apache Roller before 6.1.4.

Roller users who run multi-blog/user Roller websites are recommended to upgrade to version 6.1.4, which fixes the issue.

Roller 6.1.4 release announcement:  https://lists.apache.org/thread/3c3f6rwqptyw6wdc95654fq5vlosqdpw
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352
References: https://lists.apache.org/thread/6m0ghjo9j92qty00t2qb6qf2spds0p5t; http://www.openwall.com/lists/oss-security/2024/10/12/1
CVE: CVE-2024-9137
Published: 2024-10-14
Description: The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-306
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241156-cve-2024-9137-missing-authentication-vulnerability-in-ethernet-switches
CVE: CVE-2024-9139
Published: 2024-10-14
Description: The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances
CVE: CVE-2024-48119
Published: 2024-10-14
Description: Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://okankurtulus.com.tr/2024/09/12/vtiger-crm-v8-2-0-html-injection-authenticated/
CVE: CVE-2024-48120
Published: 2024-10-14
Description: X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating a list.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://okankurtulus.com.tr/2024/09/12/x2crm-v8-5-stored-cross-site-scripting-xss-authenticated/
CVE: CVE-2024-48253
Published: 2024-10-14
Description: Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in-9a3; https://github.com/magicbug/Cloudlog; https://www.magicbug.co.uk/cloudlog/
CVE: CVE-2024-48255
Published: 2024-10-14
Description: Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in-9a3; https://github.com/magicbug/Cloudlog; https://www.magicbug.co.uk/cloudlog/
CVE: CVE-2024-7847
Published: 2024-10-14
Description: VULNERABILITY DETAILS

Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. 

A feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention.  This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-345
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.html