deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1787
Published: 2024-03-20
Description: The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_rewards_fuel_api_key' parameter in all versions up to, and including, 2.0.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051990%40contests-from-rewards-fuel&new=3051990%40contests-from-rewards-fuel&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9eeec949-e440-4df3-8c26-db92498cada3?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051990%40contests-from-rewards-fuel&new=3051990%40contests-from-rewards-fuel&sfp_email=&sfph_mail=
CVE: CVE-2024-1995
Published: 2024-03-20
Description: The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 4.2.2. This makes it possible for authenticated attackers, with subscrber-level access and above, to retrieve post content that is password protected and/or private.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/inc2734/smart-custom-fields/commit/67cb6d75bd8189668f721dbd2dc7a3036851be1b; https://plugins.trac.wordpress.org/browser/smart-custom-fields/trunk/classes/fields/class.field-related-posts.php#L78; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3052172%40smart-custom-fields&new=3052172%40smart-custom-fields&sfp_email=&sfph_mail=
CVE: CVE-2024-2387
Published: 2024-03-20
Description: The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms plugin for WordPress is vulnerable to SQL Injection via the ‘integration_id’ parameter in all versions up to, and including, 1.82.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries and subsequently inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/advanced-form-integration/trunk/includes/class-adfoin-log-table.php#L227; https://plugins.trac.wordpress.org/browser/advanced-form-integration/trunk/includes/class-adfoin-log-table.php#L275; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3052201%40advanced-form-integration&new=3052201%40advanced-form-integration&sfp_email=&sfph_mail=
CVE: CVE-2024-2668
Published: 2024-03-20
Description: A vulnerability has been found in Campcodes Online Job Finder System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/vacancy/controller.php. The manipulation of the argument id/CATEGORY leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257368.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Job%20Finder%20System/Online%20Job%20Finder%20System%20-%20vuln%2010.pdf; https://vuldb.com/?ctiid.257368; https://vuldb.com/?id.257368
CVE: CVE-2024-2669
Published: 2024-03-20
Description: A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/employee/controller.php of the component GET Parameter Handler. The manipulation of the argument EMPLOYEEID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257369 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Job%20Finder%20System/Online%20Job%20Finder%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.257369; https://vuldb.com/?id.257369
CVE: CVE-2024-1799
Published: 2024-03-20
Description: The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to SQL Injection via the 'achievement_types' attribute of the gamipress_earnings shortcode in all versions up to, and including, 6.8.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051688%40gamipress&new=3051688%40gamipress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f357fe2a-aa24-42cd-ac2c-c948e18a4710?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051688%40gamipress&new=3051688%40gamipress&sfp_email=&sfph_mail=
CVE: CVE-2024-2384
Published: 2024-03-20
Description: The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not properly verifying the authentication and authorization of the current user This makes it possible for authenticated attackers, with customer-level access and above, to view potentially sensitive information about other users by leveraging their order id
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3053833%40woocommerce-pos&new=3053833%40woocommerce-pos&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b8ba69-aa8b-436f-990c-39e283f5d2f2?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3053833%40woocommerce-pos&new=3053833%40woocommerce-pos&sfp_email=&sfph_mail=
CVE: CVE-2024-2460
Published: 2024-03-20
Description: The GamiPress – Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gamipress_button' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051778%40gamipress-button&new=3051778%40gamipress-button&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/af39e563-5d88-460d-b02d-1aaa111c89dd?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051778%40gamipress-button&new=3051778%40gamipress-button&sfp_email=&sfph_mail=
CVE: CVE-2024-22258
Published: 2024-03-20
Description: Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.

Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.

An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-470
References: https://spring.io/security/cve-2024-22258; https://spring.io/security/cve-2024-22258
CVE: CVE-2024-2255
Published: 2024-03-20
Description: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping on user supplied attributes such as listStyle. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/essential-blocks/tags/4.5.2/blocks/TableOfContents.php#L120; https://plugins.trac.wordpress.org/changeset/3053199/essential-blocks/trunk/blocks/TableOfContents.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/cfcd59ae-085f-47d2-a4d2-2d1239f035d2?source=cve
CVE: CVE-2024-2670
Published: 2024-03-20
Description: A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/vacancy/index.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257370 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Job%20Finder%20System/Online%20Job%20Finder%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.257370; https://vuldb.com/?id.257370
CVE: CVE-2024-2671
Published: 2024-03-20
Description: A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/user/index.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257371.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Job%20Finder%20System/Online%20Job%20Finder%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.257371; https://vuldb.com/?id.257371
CVE: CVE-2023-7246
Published: 2024-03-20
Description: The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7413d5ec-10a7-4cb8-ac1c-4ef554751518/; https://wpscan.com/vulnerability/7413d5ec-10a7-4cb8-ac1c-4ef554751518/
CVE: CVE-2024-0337
Published: 2024-03-20
Description: The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://wpscan.com/vulnerability/2f17a274-8676-4f4e-989f[PII_REDACTED]90/; https://wpscan.com/vulnerability/2f17a274-8676-4f4e-989f[PII_REDACTED]90/
CVE: CVE-2024-0856
Published: 2024-03-20
Description: The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/; https://wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/
CVE: CVE-2024-1983
Published: 2024-03-20
Description: The Simple Ajax Chat  WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users.
CVSS Score: 7.1 (HIGH)
References: https://wpscan.com/vulnerability/bf3a31de-a227-4db1-bd18-ce6a78dc96fb/; https://wpscan.com/vulnerability/bf3a31de-a227-4db1-bd18-ce6a78dc96fb/
CVE: CVE-2024-22077
Published: 2024-03-20
Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The SQLite database file has weak permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-280
References: https://www.elspec-ltd.com/support/security-advisories/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-22078
Published: 2024-03-20
Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable files. The network configuration script has weak filesystem permissions. This results in write access for all authenticated users and the possibility to escalate from user privileges to administrative privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-280
References: https://www.elspec-ltd.com/support/security-advisories/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-22079
Published: 2024-03-20
Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Directory traversal can occur via the system logs download mechanism.
CVSS Score: 7.5 (HIGH)
CWE: CWE-24
References: https://www.elspec-ltd.com/support/security-advisories/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-22080
Published: 2024-03-20
Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur during XML body parsing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.elspec-ltd.com/support/security-advisories/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-22081
Published: 2024-03-20
Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur in the HTTP header parsing mechanism.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://www.elspec-ltd.com/support/security-advisories/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-22082
Published: 2024-03-20
Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated directory listing can occur: the web interface cay be abused be an attacker get a better understanding of the operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-548
References: https://www.elspec-ltd.com/support/security-advisories/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-22083
Published: 2024-03-20
Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. A hardcoded backdoor session ID exists that can be used for further access to the device, including reconfiguration tasks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://www.elspec-ltd.com/support/security-advisories/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-22084
Published: 2024-03-20
Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Cleartext passwords and hashes are exposed through log files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://www.elspec-ltd.com/support/security-advisories/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-22085
Published: 2024-03-20
Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The shadow file is world readable.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-276
References: https://www.elspec-ltd.com/support/security-advisories/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-2124
Published: 2024-03-20
Description: The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/weglot/trunk/src/actions/class-register-widget-weglot.php#L53; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051523%40weglot&new=3051523%40weglot&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d87134e8-9d73-4a39-b071-37a5dac033b4?source=cve
CVE: CVE-2024-2474
Published: 2024-03-20
Description: The Standout Color Boxes and Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'color-button' shortcode in all versions up to, and including, 0.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/standout-color-boxes-and-buttons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a826dff8-60ae-4e25-9d3e-be93f192aaca?source=cve; https://wordpress.org/plugins/standout-color-boxes-and-buttons/
CVE: CVE-2024-2672
Published: 2024-03-20
Description: A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/user/controller.php. The manipulation of the argument UESRID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257372.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Job%20Finder%20System/Online%20Job%20Finder%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.257372; https://vuldb.com/?id.257372
CVE: CVE-2024-2673
Published: 2024-03-20
Description: A vulnerability classified as critical has been found in Campcodes Online Job Finder System 1.0. This affects an unknown part of the file /admin/login.php. The manipulation of the argument user_email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257373 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Job%20Finder%20System/Online%20Job%20Finder%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.257373; https://vuldb.com/?id.257373
CVE: CVE-2024-28562
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Imf_2_2::copyIntoFrameBuffer() component when reading images in EXR format.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2024/04/11/10; http://www.openwall.com/lists/oss-security/2024/04/11/2; http://www.openwall.com/lists/oss-security/2024/04/11/3
CVE: CVE-2024-28563
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the Imf_2_2::DwaCompressor::Classifier::Classifier() function when reading images in EXR format.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-121
References: http://www.openwall.com/lists/oss-security/2024/04/11/10; http://www.openwall.com/lists/oss-security/2024/04/11/2; http://www.openwall.com/lists/oss-security/2024/04/11/3
CVE: CVE-2024-28564
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the Imf_2_2::CharPtrIO::readChars() function when reading images in EXR format.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2024/04/11/10; http://www.openwall.com/lists/oss-security/2024/04/11/2; http://www.openwall.com/lists/oss-security/2024/04/11/3
CVE: CVE-2024-28565
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the psdParser::ReadImageData() function when reading images in PSD format.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2024/04/11/10; http://www.openwall.com/lists/oss-security/2024/04/11/2; http://www.openwall.com/lists/oss-security/2024/04/11/3
CVE: CVE-2024-28566
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the AssignPixel() function when reading images in TIFF format.
CVSS Score: 8.4 (HIGH)
CWE: CWE-121
References: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909; https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
CVE: CVE-2024-28567
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the FreeImage_CreateICCProfile() function when reading images in TIFF format.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-121
References: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909; https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
CVE: CVE-2024-28568
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the read_iptc_profile() function when reading images in TIFF format.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-121
References: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909; https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
CVE: CVE-2024-28569
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Imf_2_2::Xdr::read() function when reading images in EXR format.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909; https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
CVE: CVE-2024-28570
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the processMakerNote() function when reading images in JPEG format.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909; https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
CVE: CVE-2024-28571
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the fill_input_buffer() function when reading images in JPEG format.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909; https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
CVE: CVE-2024-28572
Published: 2024-03-20
Description: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the FreeImage_SetTagValue() function when reading images in JPEG format.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-122
References: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909; https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909