deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7424
Published: 2024-11-01
Description: The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those functions intended for admin use resulting in subscribers being able to upload csv files and view the contents of MPG projects.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/controllers/DatasetController.php#L261; https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/models/ProjectModel.php#L286; https://plugins.trac.wordpress.org/changeset/3174918/multiple-pages-generator-by-porthas/trunk/controllers/DatasetController.php
CVE: CVE-2024-9655
Published: 2024-11-01
Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/kadence-blocks/trunk/includes/assets/js/kb-tippy.min.js; https://plugins.trac.wordpress.org/changeset?old_path=%2Fkadence-blocks&old=3162912&new_path=%2Fkadence-blocks&new=3170375&sfp_email=&sfph_mail=; https://wordpress.org/plugins/kadence-blocks/#developers
CVE: CVE-2024-10232
Published: 2024-11-01
Description: The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atomchat shortcode in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3178522/; https://wordpress.org/plugins/atomchat/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c10993bd-b4f3-44b6-bb0f-cb783dbcf314?source=cve
CVE: CVE-2024-10651
Published: 2024-11-01
Description: IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrator privileges to exploit this vulnerability to read arbitrary system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-36
References: https://www.twcert.org.tw/en/cp-139-8171-29297-2.html; https://www.twcert.org.tw/tw/cp-132-8170-48a4e-1.html
CVE: CVE-2024-10652
Published: 2024-11-01
Description: IDExpert from CHANGING Information Technology does not properly validate a parameter for a specific functionality, allowing unauthenticated remote attackers to inject JavsScript code and perform Reflected Cross-site scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-8173-f8bbc-2.html; https://www.twcert.org.tw/tw/cp-132-8172-a02cc-1.html
CVE: CVE-2024-10653
Published: 2024-11-01
Description: IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-8175-57245-2.html; https://www.twcert.org.tw/tw/cp-132-8174-a17fd-1.html
CVE: CVE-2024-10367
Published: 2024-11-01
Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3178637/; https://wordpress.org/plugins/otter-blocks/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/9d83c085-b33a-4003-9e0a-8457669d6634?source=cve
CVE: CVE-2024-10654
Published: 2024-11-01
Description: A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 9.3.5u.6698_B20230810 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-285, CWE-639, CWE-639
References: https://github.com/c0nyy/IoT_vuln/blob/main/TOTOLINK%20LR350%20Vuln.md; https://vuldb.com/?ctiid.282667; https://vuldb.com/?id.282667
CVE: CVE-2024-7456
Published: 2024-11-01
Description: A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2. The `order by` clause of the SQL query uses `sql.unsafe` without prior sanitization, allowing for SQL injection. The `orderByClause` variable is constructed without server-side validation or sanitization, enabling an attacker to execute arbitrary SQL commands. Successful exploitation can lead to complete data loss, modification, or corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/lunary-ai/lunary/commit/6a0bc201181e0f4a0cc375ccf4ef0d7ae65c8a8e; https://huntr.com/bounties/bfb3015e-5642-4d94-ab49-e8b49c4e07e4
CVE: CVE-2024-10655
Published: 2024-11-01
Description: A vulnerability was found in Tongda OA 2017 up to 11.9. It has been declared as critical. This vulnerability affects unknown code of the file /pda/reportshop/new.php. The manipulation of the argument repid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/LvZCh/td/issues/11; https://vuldb.com/?ctiid.282670; https://vuldb.com/?id.282670
CVE: CVE-2024-37094
Published: 2024-11-01
Description: Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects MasterStudy LMS: from n/a through 3.2.12.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-2-12-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-48270
Published: 2024-11-01
Description: An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack.
CVSS Score: 7.5 (HIGH)
References: https://github.com/majic-banana/vulnerability/blob/main/POC/Verification%20Code%20Reuse--misstt123oasys.md; https://github.com/misstt123/oasys
CVE: CVE-2024-51406
Published: 2024-11-01
Description: Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlight, which in turn leads to missed hosts inside and outside the cluster.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-290
References: https://github.com/floodlight/floodlight; https://github.com/floodlight/floodlight/issues/870; https://ieeexplore.ieee.org/document/10246976
CVE: CVE-2024-51407
Published: 2024-11-01
Description: Floodlight SDN OpenFlow Controller v.1.2 has an issue that allows local hosts to construct false broadcast ports causing inter-host communication anomalies.
CVSS Score: 6.2 (MEDIUM)
References: https://github.com/floodlight/floodlight; https://github.com/floodlight/floodlight/issues/869; https://ieeexplore.ieee.org/document/10246976
CVE: CVE-2024-10656
Published: 2024-11-01
Description: A vulnerability was found in Tongda OA 2017 up to 11.9. It has been rated as critical. This issue affects some unknown processing of the file /pda/meeting/apply.php. The manipulation of the argument mr_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/LvZCh/td/issues/12; https://vuldb.com/?ctiid.282671; https://vuldb.com/?id.282671
CVE: CVE-2024-10657
Published: 2024-11-01
Description: A vulnerability classified as critical has been found in Tongda OA up to 11.10. Affected is an unknown function of the file /pda/approve_center/prcs_info.php. The manipulation of the argument RUN_ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/LvZCh/td/issues/13; https://vuldb.com/?ctiid.282672; https://vuldb.com/?id.282672
CVE: CVE-2024-10658
Published: 2024-11-01
Description: A vulnerability classified as critical was found in Tongda OA up to 11.10. Affected by this vulnerability is an unknown functionality of the file /pda/approve_center/check_seal.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/LvZCh/td/issues/14; https://vuldb.com/?ctiid.282673; https://vuldb.com/?id.282673
CVE: CVE-2024-27524
Published: 2024-11-01
Description: Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/53275c152275958b33a1f87a21843daa52fb543a; https://www.less-secure.com/2024/10/chamilo-lms-cve-2024-27524-cve-2024.html
CVE: CVE-2024-27525
Published: 2024-11-01
Description: Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the home.php component.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/a63e03ef961e7bf2dab56f4ede6f87edef40ba0c; https://www.less-secure.com/2024/10/chamilo-lms-cve-2024-27524-cve-2024.html
CVE: CVE-2024-37095
Published: 2024-11-01
Description: Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.7.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/envira-gallery-lite/wordpress-envira-photo-gallery-plugin-1-8-7-3-csrf-leading-to-notice-dismissal-vulnerability?_s_id=cve
CVE: CVE-2024-37096
Published: 2024-11-01
Description: Missing Authorization vulnerability in Popup Box Team Popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup box: from n/a through 4.5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ays-popup-box/wordpress-popup-box-plugin-4-5-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37106
Published: 2024-11-01
Description: Missing Authorization vulnerability in WishList Products WishList Member X allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WishList Member X: from n/a through 3.26.6
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unautenticated-plugin-settings-change-leading-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37108
Published: 2024-11-01
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishList Member X allows Path Traversal.This issue affects WishList Member X: from n/a through 3.26.6.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-authenticated-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-37119
Published: 2024-11-01
Description: Missing Authorization vulnerability in Uncanny Owl Uncanny Automator Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator Pro: from n/a through 5.3.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/uncanny-automator-pro/wordpress-uncanny-automator-pro-plugin-5-3-unauthenticated-license-settings-reset-vulnerability?_s_id=cve
CVE: CVE-2024-37123
Published: 2024-11-01
Description: Missing Authorization vulnerability in VowelWeb Ibtana allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through 1.2.3.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ibtana-visual-editor/wordpress-ibtana-wordpress-website-builder-plugin-1-2-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37201
Published: 2024-11-01
Description: Missing Authorization vulnerability in javmah Woocommerce Customers Order History allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woocommerce Customers Order History: from n/a through 5.2.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woo-customers-order-history/wordpress-woocommerce-customers-order-history-plugin-5-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37203
Published: 2024-11-01
Description: Missing Authorization vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/laybuy-gateway-for-woocommerce/wordpress-laybuy-payment-extension-for-woocommerce-plugin-5-3-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37204
Published: 2024-11-01
Description: Missing Authorization vulnerability in PropertyHive PropertyHive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through 2.0.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-2-0-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37207
Published: 2024-11-01
Description: Missing Authorization vulnerability in Theme4Press Demo Awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Awesome: from n/a through 1.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/demo-awesome/wordpress-demo-awesome-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37209
Published: 2024-11-01
Description: Access Control vulnerability in Prism IT Systems User Rights Access Manager allows .

This issue affects User Rights Access Manager: from n/a through 1.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/user-rights-access-manager/wordpress-user-rights-access-manager-plugin-1-1-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37214
Published: 2024-11-01
Description: Missing Authorization vulnerability in Dropshipping Guru Ali2Woo Lite Exploiting Incorrectly Configured Access Control Security Levels, Stored XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ali2woo-lite/wordpress-aliexpress-dropshipping-with-alinext-lite-plugin-3-3-5-broken-access-control-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37218
Published: 2024-11-01
Description: Missing Authorization vulnerability in WordPress Page Builder Sandwich Team Page Builder Sandwich – Front-End Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Builder Sandwich – Front-End Page Builder: from n/a through 5.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/page-builder-sandwich/wordpress-page-builder-sandwich-5-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37220
Published: 2024-11-01
Description: Missing Authorization vulnerability in OptinlyHQ Optinly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optinly: from n/a through 1.0.18.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/optinly/wordpress-optinly-plugin-1-0-18-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37226
Published: 2024-11-01
Description: Missing Authorization vulnerability in Kanban for WordPress Kanban Boards for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/kanban/wordpress-kanban-boards-for-wordpress-plugin-2-5-21-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37232
Published: 2024-11-01
Description: Missing Authorization vulnerability in Hercules Design Hercules Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hercules Core: from n/a through 6.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/hercules-core/wordpress-hercules-core-plugin-6-4-subscriber-arbitrary-settings-change-access-vulnerability?_s_id=cve
CVE: CVE-2024-37249
Published: 2024-11-01
Description: Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-3-2-contributor-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37250
Published: 2024-11-01
Description: Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-6-3-2-subscriber-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37254
Published: 2024-11-01
Description: Missing Authorization vulnerability in mndpsingh287 File Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Manager: from n/a through 7.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-file-manager/wordpress-wp-file-manager-plugin-7-2-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37255
Published: 2024-11-01
Description: Missing Authorization vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through <= 3.1.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/elementskit-lite/vulnerability/wordpress-elementskit-lite-plugin-3-1-4-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37269
Published: 2024-11-01
Description: Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/masterstudy-elementor-widgets/wordpress-masterstudy-elementor-widgets-plugin-1-2-2-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37276
Published: 2024-11-01
Description: Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/featured-image-from-url/wordpress-featured-image-from-url-fifu-plugin-4-8-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37277
Published: 2024-11-01
Description: Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-3-0-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-37411
Published: 2024-11-01
Description: Missing Authorization vulnerability in Progress Planner Progress Planner progress-planner.This issue affects Progress Planner: from n/a through <= 0.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/progress-planner/vulnerability/wordpress-progress-planner-plugin-0-9-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37415
Published: 2024-11-01
Description: Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/e2pdf/vulnerability/wordpress-e2pdf-plugin-1-20-27-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37423
Published: 2024-11-01
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/newspack-blocks/wordpress-newspack-blocks-plugin-3-0-8-contributor-arbitrary-directory-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-37425
Published: 2024-11-01
Description: Missing Authorization vulnerability in Automattic Newspack Blocks newspack-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Blocks: from n/a through 3.0.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/newspack-blocks/wordpress-newspack-blocks-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-37427
Published: 2024-11-01
Description: Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.21.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/timetics/wordpress-timetics-plugin-1-0-21-broken-access-control-vulnerability?_s_id=cve