deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8565
Published: 2024-09-07
Description: A vulnerability was found in SourceCodesters Clinics Patient Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the file /print_diseases.php. The manipulation of the argument disease/from/to leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-Clinic's-Patient-Management-System-SQLi.md; https://vuldb.com/?ctiid.276785; https://vuldb.com/?id.276785
CVE: CVE-2024-8566
Published: 2024-09-08
Description: A vulnerability classified as problematic was found in code-projects Online Shop Store 1.0. This vulnerability affects unknown code of the file /settings.php. The manipulation of the argument error leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://code-projects.org/; https://drive.google.com/file/d/1MmShihcKuzB9Sw54asriKkRKvdUD8-Ag/view?usp=sharing; https://vuldb.com/?ctiid.276796
CVE: CVE-2024-8567
Published: 2024-09-08
Description: A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_deductions. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/ha/issues/8; https://itsourcecode.com/; https://vuldb.com/?ctiid.276797
CVE: CVE-2024-8568
Published: 2024-09-08
Description: A vulnerability, which was classified as critical, was found in Mini-Tmall up to 20240901. Affected is the function rewardMapper.select of the file tmall/admin/order/1/1. The manipulation of the argument orderBy leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/A0kooo/cve_article/blob/master/Mini-Tmall/Tmall_demo%20OrderController.java%20SQL%20Injection.md; https://vuldb.com/?ctiid.276798; https://vuldb.com/?id.276798
CVE: CVE-2024-8569
Published: 2024-09-08
Description: A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file user-login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/teachersongsec/cve/issues/1; https://vuldb.com/?ctiid.276799
CVE: CVE-2024-6852
Published: 2024-09-08
Description: The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/e6c7c153-8080-40b3-85e2-604ce7c66e32/
CVE: CVE-2024-6853
Published: 2024-09-08
Description: The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/d1ce78c3-5d6c-465e-9ce8-6d92f7480333/
CVE: CVE-2024-6855
Published: 2024-09-08
Description: The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1124b07a-6274-49df-be77-615fda8f3a38/
CVE: CVE-2024-6856
Published: 2024-09-08
Description: The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/9700845e-89ca-4f9b-95f0-4b46a975b662/
CVE: CVE-2024-6859
Published: 2024-09-08
Description: The WP MultiTasking  WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/34ae6121-304f-495b-bcc1-4fbd3d70a9fb/
CVE: CVE-2024-6924
Published: 2024-09-08
Description: The TrueBooker  WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/39e79801-6ec7-4579-bc6b-fd7e899733a8/
CVE: CVE-2024-6925
Published: 2024-09-08
Description: The TrueBooker  WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1da75fd7-e44f-4043-b8f4-7ee975356982/
CVE: CVE-2024-6928
Published: 2024-09-08
Description: The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/7bb9474f-2b9d-4856-b36d-a43da3db0245/
CVE: CVE-2024-8570
Published: 2024-09-08
Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /inccatadd.php. The manipulation of the argument title leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/teachersongsec/cve/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.276800
CVE: CVE-2024-8571
Published: 2024-09-08
Description: A vulnerability was found in erjemin roll_cms up to 1484fe2c4e0805946a7bcf46218509fcb34883a9. It has been classified as problematic. This affects an unknown part of the file roll_cms/roll_cms/views.py. The manipulation leads to information exposure through error message. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 3.5 (LOW)
CWE: CWE-209
References: https://github.com/erjemin/roll_cms/issues/1; https://vuldb.com/?ctiid.276801; https://vuldb.com/?id.276801
CVE: CVE-2024-8572
Published: 2024-09-08
Description: A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.1 is able to address this issue. The patch is identified as 3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/gouniverse/cms/commit/3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c; https://github.com/gouniverse/cms/issues/5; https://github.com/gouniverse/cms/issues/5#issuecomment[PII_REDACTED]
CVE: CVE-2024-8573
Published: 2024-09-08
Description: A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc/week/sTime/eTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/AC1200T8/setParentalRules.md; https://vuldb.com/?ctiid.276807; https://vuldb.com/?id.276807
CVE: CVE-2024-8574
Published: 2024-09-08
Description: A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument slaveIpList leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/setUpgradeFW.md; https://vuldb.com/?ctiid.276808; https://vuldb.com/?id.276808
CVE: CVE-2024-42341
Published: 2024-09-08
Description: Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-42342
Published: 2024-09-08
Description: Loway -  CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-444
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-42343
Published: 2024-09-08
Description: Loway - CWE-204: Observable Response Discrepancy
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-8575
Published: 2024-09-08
Description: A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This issue affects the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/AC1200T8/setWiFiScheduleCfg.md; https://vuldb.com/?ctiid.276809; https://vuldb.com/?id.276809
CVE: CVE-2024-8576
Published: 2024-09-08
Description: A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been classified as critical. Affected is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/setIpPortFilterRules.md; https://vuldb.com/?ctiid.276810; https://vuldb.com/?id.276810
CVE: CVE-2024-8577
Published: 2024-09-08
Description: A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/setStaticDhcpRules.md; https://vuldb.com/?ctiid.276811; https://vuldb.com/?id.276811
CVE: CVE-2024-8578
Published: 2024-09-08
Description: A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. It has been rated as critical. Affected by this issue is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument device_name leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/setWiFiMeshName.md; https://vuldb.com/?ctiid.276812; https://vuldb.com/?id.276812
CVE: CVE-2024-8579
Published: 2024-09-08
Description: A vulnerability classified as critical has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This affects the function setWiFiRepeaterCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/setWiFiRepeaterCfg.md; https://vuldb.com/?ctiid.276813; https://vuldb.com/?id.276813
CVE: CVE-2024-8580
Published: 2024-09-08
Description: A vulnerability classified as critical was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This vulnerability affects unknown code of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.1 (HIGH)
CWE: CWE-259
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/shadow.md; https://vuldb.com/?ctiid.276814; https://vuldb.com/?id.276814
CVE: CVE-2024-8582
Published: 2024-09-08
Description: A vulnerability was found in SourceCodester Food Ordering Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument description leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Niu-zida/cve/blob/main/Cross-Site%20Scripting.md; https://vuldb.com/?ctiid.276818; https://vuldb.com/?id.276818
CVE: CVE-2024-8583
Published: 2024-09-08
Description: A vulnerability was found in SourceCodester Online Bank Management System and Online Bank Management System - 1.0. It has been classified as problematic. This affects an unknown part of the file /mfeedback.php of the component Feedback Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Niu-zida/cve/blob/main/Storage-optimized%20Cross-site%20scripting%20vulnerability.md; https://vuldb.com/?ctiid.276819; https://vuldb.com/?id.276819
CVE: CVE-2024-8584
Published: 2024-09-09
Description: Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.twcert.org.tw/en/cp-139-8040-948ef-2.html; https://www.twcert.org.tw/tw/cp-132-8039-24e48-1.html
CVE: CVE-2024-8585
Published: 2024-09-09
Description: Orca HCM from LEARNING DIGITA does not properly restrict a specific parameter of the file download functionality, allowing a remote attacker with regular privileges to download arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.twcert.org.tw/en/cp-139-8042-f9f26-2.html; https://www.twcert.org.tw/tw/cp-132-8041-dfbf9-1.html
CVE: CVE-2024-8586
Published: 2024-09-09
Description: WebITR from Uniong has an Open Redirect vulnerability, which allows unauthorized remote attackers to exploit this vulnerability to forge URLs. Users, believing they are accessing a trusted domain, can be redirected to another page, potentially leading to phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.twcert.org.tw/en/cp-139-8044-65b84-2.html; https://www.twcert.org.tw/tw/cp-132-8043-cc323-1.html
CVE: CVE-2024-45625
Published: 2024-09-09
Description: Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN65724976/; https://plugins.trac.wordpress.org/changeset?new=3135507%40forminator%2Ftrunk%2Fassets%2Fjs%2Ffront%2Ffront.mergetags.js&old=3111152%40forminator%2Ftrunk%2Fassets%2Fjs%2Ffront%2Ffront.mergetags.js; https://wordpress.org/plugins/forminator/
CVE: CVE-2024-5561
Published: 2024-09-09
Description: The Popup Maker  WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6a87cc25-bd7d-40e3-96f9-26646cd6f736/
CVE: CVE-2024-6910
Published: 2024-09-09
Description: The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/468373c6-7e47-489a-92c1-75025c543fd5/
CVE: CVE-2024-7687
Published: 2024-09-09
Description: The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-79
References: https://wpscan.com/vulnerability/b861f18a-40ae-4989-a8e4-37df1771ae23/
CVE: CVE-2024-7688
Published: 2024-09-09
Description: The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary indexes via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/6c1d4354-b88b-46ca-b25a-efb9518f4955/
CVE: CVE-2024-7689
Published: 2024-09-09
Description: The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/4463785c-55db-4f86-80a2-ada4d2241e5e/
CVE: CVE-2024-7918
Published: 2024-09-09
Description: The Pocket Widget WordPress plugin through 0.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/b[PII_REDACTED]-4a2b-9987-cec07428378e/
CVE: CVE-2024-45203
Published: 2024-09-09
Description: Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS versions prior to 6.74.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-939
References: https://jvn.jp/en/jp/JVN81570776/
CVE: CVE-2024-37288
Published: 2024-09-09
Description: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use  Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html  and have configured an  Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119
CVE: CVE-2024-6572
Published: 2024-09-09
Description: Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' in Checkmk before Checkmk 2.3.0p15, 2.2.0p33, 2.1.0p48 and 2.0.0 (EOL) allows man-in-the-middle attackers to intercept traffic
CVSS Score: 7.4 (HIGH)
CWE: CWE-322
References: https://checkmk.com/werk/17148
CVE: CVE-2024-8601
Published: 2024-09-09
Description: This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to unauthorized access to sensitive information belonging to other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-863
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0285
CVE: CVE-2024-44375
Published: 2024-09-09
Description: D-Link DI-8100 v16.07.26A1 has a stack overflow vulnerability in the dbsrv_asp function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Nop3z/CVE/blob/main/dlink/DI-8100/Dlink-di8100-dbsrv_asp-overflow.md; https://www.dlink.com/en/security-bulletin/; https://github.com/Nop3z/CVE/blob/main/dlink/DI-8100/Dlink-di8100-dbsrv_asp-overflow.md
CVE: CVE-2024-7015
Published: 2024-09-09
Description: Missing Authentication for Critical Function vulnerability in Profelis Informatics and Consulting PassBox allows Authentication Abuse.This issue affects PassBox: before v1.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.usom.gov.tr/bildirim/tr-24-1418
CVE: CVE-2024-40643
Published: 2024-09-09
Description: Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/laurent22/joplin/commit/b220413a9b5ed55fb1f565ac786a5c231da8bc87; https://github.com/laurent22/joplin/security/advisories/GHSA-g796-3g6g-jmmc