deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-21764
Published: 2024-02-02
Description: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a specific port.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://rapidscada.org/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03; https://rapidscada.org/contact/
CVE: CVE-2024-21794
Published: 2024-02-02
Description: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://rapidscada.org/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03; https://rapidscada.org/contact/
CVE: CVE-2024-21866
Published: 2024-02-02
Description: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it receives a specific malformed request.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://rapidscada.org/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03; https://rapidscada.org/contact/
CVE: CVE-2024-21869
Published: 2024-02-02
Description: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an attacker with local access to see them.

CVSS Score: 6.2 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://rapidscada.org/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03; https://rapidscada.org/contact/
CVE: CVE-2024-22016
Published: 2024-02-02
Description: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege escalation.

CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://rapidscada.org/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03; https://rapidscada.org/contact/
CVE: CVE-2024-22096
Published: 2024-02-02
Description: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://rapidscada.org/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03; https://rapidscada.org/contact/
CVE: CVE-2023-50326
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.  IBM X-Force ID:  275107.


CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275107; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275107
CVE: CVE-2023-50327
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 uses insecure HTTP methods which could allow a remote attacker to perform unauthorized file request modification.  IBM X-Force ID:  275109.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-650, CWE-436
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275109; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275109
CVE: CVE-2023-50933
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.  IBM X-Force ID:  275113.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275113; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275113
CVE: CVE-2023-50936
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.  IBM X-Force ID:  275116.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275116; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275116
CVE: CVE-2023-50937
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  275117.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275117; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275117
CVE: CVE-2023-50940
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.  IBM X-Force ID:  275130.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-942, CWE-697
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275130; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275130
CVE: CVE-2024-21399
Published: 2024-02-02
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 8.3 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21399; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21399
CVE: CVE-2023-32333
Published: 2024-02-02
Description: IBM Maximo Asset Management 7.6.1.3 could allow a remote attacker to log into the admin panel due to improper access controls.  IBM X-Force ID:  255073.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/255073; https://www.ibm.com/support/pages/node/7112388; https://exchange.xforce.ibmcloud.com/vulnerabilities/255073
CVE: CVE-2023-46344
Published: 2024-02-02
Description: A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate their privileges by exploiting a stored cross-site scripting (XSS) vulnerability in the switch group function under /#ilang=DE&b=c_smartenergy_swgroups in the web portal. The vulnerability can be exploited to gain the rights of an installer or PM, which can then be used to gain administrative access to the web portal and execute further attacks. NOTE: The vendor states that this vulnerability has been fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://solar-log.com; https://github.com/vinnie1717/CVE-2023-46344/blob/main/Solar-Log%20XSS; https://www.solar-log.com/en/support/firmware-database-1
CVE: CVE-2023-48792
Published: 2024-02-02
Description: Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://manageengine.com; https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html; https://manageengine.com
CVE: CVE-2023-48793
Published: 2024-02-02
Description: Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://manageengine.com; https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html; https://manageengine.com
CVE: CVE-2023-50328
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings.  IBM X-Force ID:  275110.


CVSS Score: 3.7 (LOW)
CWE: CWE-598, CWE-668
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275110; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275110
CVE: CVE-2023-50934
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.  IBM X-Force ID:  275114.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-308, CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275114; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275114
CVE: CVE-2023-50935
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to application functionality and/or resources.  IBM X-Force ID:  275115.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-425
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275115; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275115
CVE: CVE-2023-50938
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.  IBM X-Force ID:  275128.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275128; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275128
CVE: CVE-2023-50941
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using session fixation.  IBM X-Force ID:  275131.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275131; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275131
CVE: CVE-2023-50962
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism.  IBM X-Force ID:  276004.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/276004; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/276004
CVE: CVE-2024-22779
Published: 2024-02-02
Description: Directory Traversal vulnerability in Kihron ServerRPExposer v.1.0.2 and before allows a remote attacker to execute arbitrary code via the loadServerPack in ServerResourcePackProviderMixin.java.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://gist.github.com/apple502j/[PII_REDACTED]5fe1a6708309ce934e4ed; https://github.com/Kihron/ServerRPExposer/commit/8f7b829df633f59e828d677f736c53652d6f1b8f; https://modrinth.com/mod/serverrpexposer
CVE: CVE-2024-22899
Published: 2024-02-02
Description: Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://vinchin.com; https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/; https://seclists.org/fulldisclosure/2024/Jan/29
CVE: CVE-2024-22900
Published: 2024-02-02
Description: Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://vinchin.com; https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/; https://seclists.org/fulldisclosure/2024/Jan/29
CVE: CVE-2024-22901
Published: 2024-02-02
Description: Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
CVSS Score: 9.8 (CRITICAL)
References: http://vinchin.com; https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/; https://seclists.org/fulldisclosure/2024/Jan/30
CVE: CVE-2024-22902
Published: 2024-02-02
Description: Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.
CVSS Score: 9.8 (CRITICAL)
References: http://default.com; http://vinchin.com; https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/
CVE: CVE-2024-22903
Published: 2024-02-02
Description: Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://vinchin.com; https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/; https://seclists.org/fulldisclosure/2024/Jan/32
CVE: CVE-2024-23746
Published: 2024-02-02
Description: Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection; https://github.com/louiselalanne/CVE-2024-23746; https://miro.com/about/
CVE: CVE-2023-46159
Published: 2024-02-02
Description: IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW.  IBM X-Force ID:  268906.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/268906; https://www.ibm.com/support/pages/node/7112263; https://exchange.xforce.ibmcloud.com/vulnerabilities/268906
CVE: CVE-2024-22319
Published: 2024-02-02
Description: 


IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.




CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/279145; https://www.ibm.com/support/pages/node/7112382; https://exchange.xforce.ibmcloud.com/vulnerabilities/279145
CVE: CVE-2024-22320
Published: 2024-02-02
Description: IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM.  IBM X-Force ID:  279146.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/279146; https://www.ibm.com/support/pages/node/7112382; https://exchange.xforce.ibmcloud.com/vulnerabilities/279146
CVE: CVE-2024-22533
Published: 2024-02-02
Description: Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://gitee.com/xiandafu/beetl/issues/I8RU01; https://gitee.com/xiandafu/beetl/issues/I8RU01
CVE: CVE-2022-40744
Published: 2024-02-02
Description: IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  236441.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/236441; https://www.ibm.com/support/pages/node/7111778; https://exchange.xforce.ibmcloud.com/vulnerabilities/236441
CVE: CVE-2023-38019
Published: 2024-02-02
Description: IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  260575.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260575; https://www.ibm.com/support/pages/node/7111679; https://exchange.xforce.ibmcloud.com/vulnerabilities/260575
CVE: CVE-2023-38020
Published: 2024-02-02
Description: IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to manipulate output written to log files.  IBM X-Force ID:  260576.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-117
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260576; https://www.ibm.com/support/pages/node/7111679; https://exchange.xforce.ibmcloud.com/vulnerabilities/260576
CVE: CVE-2023-38263
Published: 2024-02-02
Description: IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to perform unauthorized actions due to improper access controls.  IBM X-Force ID:  260577.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260577; https://www.ibm.com/support/pages/node/7111679; https://exchange.xforce.ibmcloud.com/vulnerabilities/260577
CVE: CVE-2024-0685
Published: 2024-02-02
Description: The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to inject SQL in their email address that will append additional into the already existing query when an administrator triggers a personal data export.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/3028929/ninja-forms/trunk/includes/Admin/UserDataRequests.php; https://sec.stealthcopter.com/ninja-contact-forms/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb73d5d-ca4a-4103-866d-f7bb369a8ce4?source=cve
CVE: CVE-2024-1073
Published: 2024-02-02
Description: The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-slimstat/trunk/admin/index.php#L1004; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3029858%40wp-slimstat&new=3029858%40wp-slimstat&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/33cba63c-4629-48fd-850f-f68dad626a67?source=cve
CVE: CVE-2024-21485
Published: 2024-02-02
Description: Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server.**Note:**This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://github.com/plotly/dash/commit/9920073c9a8619ae8f90fcec1924f2f3a4332a8c; https://github.com/plotly/dash/issues/2729; https://github.com/plotly/dash/pull/2732
CVE: CVE-2024-24482
Published: 2024-02-02
Description: Aprktool before 2.9.3 on Windows allows ../ and /.. directory traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-vgwr-4w3p-xmjv; https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-vgwr-4w3p-xmjv
CVE: CVE-2023-46045
Published: 2024-02-02
Description: Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: http://seclists.org/fulldisclosure/2024/Feb/24; https://gitlab.com/graphviz/graphviz/-/issues/2441; https://seclists.org/fulldisclosure/2024/Feb/24
CVE: CVE-2024-1047
Published: 2024-02-02
Description: Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php#L175; https://plugins.trac.wordpress.org/changeset/3029507/themeisle-companion/tags/2.10.29/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040302%40templates-patterns-collection&new=3040302%40templates-patterns-collection&sfp_email=&sfph_mail=
CVE: CVE-2024-1143
Published: 2024-02-02
Description: Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8; https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8
CVE: CVE-2024-1162
Published: 2024-02-02
Description: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. This is due to missing or incorrect nonce validation on the register_reference() function. This makes it possible for unauthenticated attackers  to update the connected API keys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030173%40themeisle-companion&new=3030173%40themeisle-companion&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/88f6a24f-f14a-4d0a-be5a-f8c84910b4fc?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030173%40themeisle-companion&new=3030173%40themeisle-companion&sfp_email=&sfph_mail=