deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39682
Published: 2024-07-18
Description: Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary HTML in pages that will be shown whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-116, CWE-79
References: https://github.com/XjSv/Cooked/security/advisories/GHSA-fx69-f77x-84gr; https://github.com/XjSv/Cooked/security/advisories/GHSA-fx69-f77x-84gr
CVE: CVE-2024-41184
Published: 2024-07-18
Description: In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record might not be worthwhile because an empty ipset name must be configured by the user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/acassen/keepalived/issues/2447#issuecomment[PII_REDACTED]; https://github.com/acassen/keepalived/issues/2447#issuecomment[PII_REDACTED]
CVE: CVE-2024-5726
Published: 2024-07-18
Description: The Timeline Event History plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1 via deserialization of untrusted input 'timelines-data' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/timeline-event-history/trunk/includes/admin/timeline-wp-build.php#L5; https://plugins.trac.wordpress.org/browser/timeline-event-history/trunk/includes/public/templates/style-another/index.php#L5; https://plugins.trac.wordpress.org/browser/timeline-event-history/trunk/includes/public/templates/style-one/index.php#L7
CVE: CVE-2024-5964
Published: 2024-07-18
Description: The Zenon Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/zenon-lite/1.9/lib/includes/shortcodes.php#L138; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9b004a-2050-47e8-ac4d-491b715c87d2?source=cve; https://themes.trac.wordpress.org/browser/zenon-lite/1.9/lib/includes/shortcodes.php#L138
CVE: CVE-2024-6175
Published: 2024-07-18
Description: The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the multiple functions called via AJAX like save_fields_settings, bup_delete_user_avatar,  bup_crop_avatar_user_profile_image, and more in all versions up to, and including, 1.1.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify and delete. multiple plugin options and data such as payments, pricing, booking information, business hours, calendars, profile information, and email templates.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3139187/booking-ultra-pro/trunk/classes/bookingultra.admin.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3139187%40booking-ultra-pro&new=3139187%40booking-ultra-pro&sfp_email=&sfph_mail=; https://wordpress.org/plugins/booking-ultra-pro/#description
CVE: CVE-2024-6599
Published: 2024-07-18
Description: The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API keys. 
CVE-2024-38733 may be a duplicate of this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/meks-video-importer/trunk/includes/class.meks-video-importer-vimeo.php#L74; https://plugins.trac.wordpress.org/browser/meks-video-importer/trunk/includes/class.meks-video-importer-youtube.php#L98; https://www.wordfence.com/threat-intel/vulnerabilities/id/eaf9cc48-1ba6-4e9b-9f49-54f7747c26e0?source=cve
CVE: CVE-2024-6705
Published: 2024-07-18
Description: The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/reglevel/trunk/includes/admin.php#L73; https://plugins.trac.wordpress.org/browser/reglevel/trunk/includes/functions.php#L11; https://wordpress.org/plugins/reglevel/#developers
CVE: CVE-2023-6708
Published: 2024-07-18
Description: The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping, even when the 'Sanitize SVG while uploading' feature is enabled. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that successful exploitation of this vulnerability requires the administrator to allow author-level users to upload SVG files. As of 2.5.6, SVG sanitization can still be bypassed by supplying a content-type other than image/svg+xml.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/svg-support/trunk/functions/attachment.php#L235; https://plugins.trac.wordpress.org/browser/svg-support/trunk/svg-support.php#L110; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3133760%40svg-support&new=3133760%40svg-support&sfp_email=&sfph_mail=
CVE: CVE-2024-6164
Published: 2024-07-18
Description: The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possible for an unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://wpscan.com/vulnerability/40bd880e-67a1-4180-b197-8dcadaa0ace4/; https://wpscan.com/vulnerability/40bd880e-67a1-4180-b197-8dcadaa0ace4/
CVE: CVE-2024-41011
Published: 2024-07-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: don't allow mapping the MMIO HDP page with large pages

We don't get the right offset in that case.  The GPU has
an unused 4K area of the register BAR space into which you can
remap registers.  We remap the HDP flush registers into this
space to allow userspace (CPU or GPU) to flush the HDP when it
updates VRAM.  However, on systems with >4K pages, we end up
exposing PAGE_SIZE of MMIO space.
CVSS Score: 7.8 (HIGH)
CWE: CWE-682
References: https://git.kernel.org/stable/c/009c4d78bcf07c4ac2e3dd9f275b4eaa72b4f884; https://git.kernel.org/stable/c/4b4cff994a27ebf7bd3fb9a798a1cdfa8d01b724; https://git.kernel.org/stable/c/6186c[PII_REDACTED]5bfe0914609c274eff40bbeb5
CVE: CVE-2024-29014
Published: 2024-07-18
Description: Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when processing an EPC Client update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0011; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0011
CVE: CVE-2024-40764
Published: 2024-07-18
Description: Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0012
CVE: CVE-2024-3242
Published: 2024-07-18
Description: The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Version 2.4.44 prevents the upload of files ending in .sh and .php. Version 2.4.45 fully patches the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/zip/archiver.php#L264; https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/zip/archiver.php#L547; https://plugins.trac.wordpress.org/changeset/3086506/brizy/trunk/editor/zip/archiver.php
CVE: CVE-2024-5554
Published: 2024-07-18
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘onclick_event’ parameter in all versions up to, and including, 5.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-39667 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/5.6.4/modules/step-flow/widgets/step-flow.php#L2287; https://plugins.trac.wordpress.org/changeset/3110404/; https://www.wordfence.com/threat-intel/vulnerabilities/id/696c379a-c5a4-489f-8363-8aea9a4da814?source=cve
CVE: CVE-2024-5555
Published: 2024-07-18
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘social-link-title’ parameter in all versions up to, and including, 5.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/member/widgets/member.php#L1273; https://plugins.trac.wordpress.org/changeset/3096559/; https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb69e0e-f3d4-4b5b-9bdf-14018f4c7ecc?source=cve
CVE: CVE-2024-40725
Published: 2024-07-18
Description: A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

Users are recommended to upgrade to version 2.4.62, which fixes this issue.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-40898
Published: 2024-07-18
Description: SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue. 
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2024/07/17/7; https://httpd.apache.org/security/vulnerabilities_24.html
CVE: CVE-2024-6504
Published: 2024-07-18
Description: Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the console to enter an exception handling logging loop, exhausting the CPU.  There is no indication that an attacker can use this method to escalate privilege, acquire unauthorized access to data, or gain control of protected resources. This issue is fixed in version 6.6.261.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://docs.rapid7.com/release-notes/insightvm/20240717/; https://docs.rapid7.com/release-notes/insightvm/20240717/
CVE: CVE-2024-29178
Published: 2024-07-18
Description: On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability.

Mitigation:

all users should upgrade to 2.1.4
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/07/18/1; https://lists.apache.org/thread/n6dhnl68knpxy80t35qxkkw2691l8sfn; http://www.openwall.com/lists/oss-security/2024/07/18/1
CVE: CVE-2024-31143
Published: 2024-07-18
Description: An optional feature of PCI MSI called "Multiple Message" allows a
device to use multiple consecutive interrupt vectors.  Unlike for MSI-X,
the setting up of these consecutive vectors needs to happen all in one
go.  In this handling an error path could be taken in different
situations, with or without a particular lock held.  This error path
wrongly releases the lock even when it is not currently held.

CVSS Score: 7.5 (HIGH)
CWE: CWE-832
References: https://xenbits.xenproject.org/xsa/advisory-458.html; http://www.openwall.com/lists/oss-security/2024/07/16/3; http://xenbits.xen.org/xsa/advisory-458.html
CVE: CVE-2024-34013
Published: 2024-07-18
Description: Local privilege escalation due to OS command injection vulnerability. The following products are affected: Acronis True Image (macOS) before build 41396, Acronis True Image OEM (macOS) before build 42571.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://security-advisory.acronis.com/advisories/SEC-7035; https://security-advisory.acronis.com/advisories/SEC-7035
CVE: CVE-2023-50304
Published: 2024-07-18
Description: IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  273335.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/273335; https://www.ibm.com/support/pages/node/7160471; https://exchange.xforce.ibmcloud.com/vulnerabilities/273335
CVE: CVE-2024-30473
Published: 2024-07-18
Description: Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. A remote high privileged attacker could potentially exploit this vulnerability, gaining access to unauthorized end points.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000227051/dsa-2024-239-security-update-dell-ecs-3-8-1-1-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000227051/dsa-2024-239-security-update-dell-ecs-3-8-1-1-for-multiple-security-vulnerabilities
CVE: CVE-2024-38302
Published: 2024-07-18
Description: Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-311
References: https://www.dell.com/support/kbdoc/en-us/000227053/dsa-2024-303-security-update-for-dell-data-lakehouse-system-software-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000227053/dsa-2024-303-security-update-for-dell-data-lakehouse-system-software-for-multiple-security-vulnerabilities
CVE: CVE-2024-39907
Published: 2024-07-18
Description: 1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6; https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6
CVE: CVE-2024-39911
Published: 2024-07-18
Description: 1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://blog.mo60.cn/index.php/archives/1Panel_SQLinjection2Rce.html; https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7m53-pwp6-v3f5; https://blog.mo60.cn/index.php/archives/1Panel_SQLinjection2Rce.html
CVE: CVE-2023-40159
Published: 2024-07-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-40223
Published: 2024-07-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-40539
Published: 2024-07-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-40704
Published: 2024-07-18
Description: The product does not require unique and complex passwords to be created 
during installation. Using Philips's default password could jeopardize 
the PACS system if the password was hacked or leaked. An attacker could 
gain access to the database impacting system availability and data 
integrity.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1392
References: http://www.philips.com/productsecurity; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01; http://www.philips.com/productsecurity
CVE: CVE-2024-40628
Published: 2024-07-18
Description: JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the ansible playbook to read arbitrary files in the celery container, leading to sensitive information disclosure. The Celery container runs as root and has database access, allowing the attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. This issue has been addressed in release versions 3.10.12 and 4.0.0. It is recommended to upgrade the safe versions. There is no known workarounds for this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-rpf7-g4xh-84v9; https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-rpf7-g4xh-84v9
CVE: CVE-2024-40629
Published: 2024-07-18
Description: JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. This issue has been patched in release versions 3.10.12 and 4.0.0. It is recommended to upgrade the safe versions. There are no known workarounds for this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-3wgp-q8m7-v33v; https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-3wgp-q8m7-v33v
CVE: CVE-2024-40647
Published: 2024-07-18
Description: sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://docs.python.org/3/library/subprocess.html; https://docs.sentry.io/platforms/python/integrations/default-integrations; https://docs.sentry.io/platforms/python/integrations/default-integrations/#stdlib
CVE: CVE-2024-40648
Published: 2024-07-18
Description: matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the `matrix-sdk-crypto` crate. The 0.7.2 release of the `matrix-sdk-crypto` crate includes a fix. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a; https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-4qg4-cvh2-crgg; https://github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a