deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-27439
Published: 2024-03-19
Description: An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.
This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series.
Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.

Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-444
References: http://www.openwall.com/lists/oss-security/2024/03/19/2; https://lists.apache.org/thread/o825rvjjtmz3qv21ps5k7m2w9193g1lo; http://www.openwall.com/lists/oss-security/2024/03/19/2
CVE: CVE-2023-40278
Published: 2024-03-19
Description: An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md; https://sourceforge.net/projects/open-clinic/; https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md
CVE: CVE-2023-5388
Published: 2024-03-19
Description: NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1780432; https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html; https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE: CVE-2024-1144
Published: 2024-03-19
Description: Improper access control vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an unauthenticated user to access the application's functionalities without the need for credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog
CVE: CVE-2024-1145
Published: 2024-03-19
Description: User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog
CVE: CVE-2024-1146
Published: 2024-03-19
Description: Cross-Site Scripting vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an attacker to store a malicious JavaScript payload within the application by adding the payload to 'Community Description' or 'Community Rules'.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog
CVE: CVE-2024-2605
Published: 2024-03-19
Description: An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS Score: 5.9 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1872920; https://www.mozilla.org/security/advisories/mfsa2024-12/; https://www.mozilla.org/security/advisories/mfsa2024-13/
CVE: CVE-2024-2606
Published: 2024-03-19
Description: Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into pointer values. This vulnerability affects Firefox < 124.
CVSS Score: 3.7 (LOW)
CWE: CWE-704
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1879237; https://www.mozilla.org/security/advisories/mfsa2024-12/; https://bugzilla.mozilla.org/show_bug.cgi?id=1879237
CVE: CVE-2024-2607
Published: 2024-03-19
Description: Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-123
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1879939; https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html; https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE: CVE-2024-2608
Published: 2024-03-19
Description: `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS Score: 8.4 (HIGH)
CWE: CWE-680
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1880692; https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html; https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE: CVE-2024-2609
Published: 2024-03-19
Description: The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-356
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1866100; https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html; https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html
CVE: CVE-2024-2610
Published: 2024-03-19
Description: Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1871112; https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html; https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE: CVE-2024-2611
Published: 2024-03-19
Description: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS Score: 5.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1876675; https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html; https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE: CVE-2024-2612
Published: 2024-03-19
Description: If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1879444; https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html; https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE: CVE-2024-2613
Published: 2024-03-19
Description: Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox < 124.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1021, CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1875701; https://www.mozilla.org/security/advisories/mfsa2024-12/; https://bugzilla.mozilla.org/show_bug.cgi?id=1875701
CVE: CVE-2024-2614
Published: 2024-03-19
Description: Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685358%2C1861016%2C1880405%2C1881093; https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html; https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE: CVE-2024-2615
Published: 2024-03-19
Description: Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1881074%2C1882438%2C1881650; https://www.mozilla.org/security/advisories/mfsa2024-12/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1881074%2C1882438%2C1881650
CVE: CVE-2024-2616
Published: 2024-03-19
Description: To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vulnerability affects Firefox ESR < 115.9 and Thunderbird < 115.9.
CVSS Score: 2.7 (LOW)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1846197; https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html; https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE: CVE-2024-2632
Published: 2024-03-19
Description: A Information Exposure Vulnerability has been found on Meta4 HR. This vulnerability allows an attacker to obtain a lot of information about the application such as the variables set in the process, the Tomcat versions, library versions and underlying operation system via HTTP GET '/sitetest/english/dumpenv.jsp'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE: CVE-2024-2633
Published: 2024-03-19
Description: A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sitetest/english/dumpenv.jsp' is vulnerable to XSS attack by 'lang' query, i.e. '/sitetest/english/dumpenv.jsp?snoop=yes&lang=%27%3Cimg%20src/onerror=alert(1)%3E&params'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE: CVE-2024-2634
Published: 2024-03-19
Description: A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sse_generico/generico_login.jsp' is vulnerable to XSS attack via 'lang' query, i.e. '/sse_generico/generico_login.jsp?lang=%27%3balert(%27BLEUSS%27)%2f%2f&params='.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE: CVE-2024-2635
Published: 2024-03-19
Description:  The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality 
CVSS Score: 7.3 (HIGH)
CWE: CWE-698
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE: CVE-2023-40279
Published: 2024-03-19
Description: An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/BugBountyHunterCVE/CVE-2023-40279/blob/main/CVE-2023-40279_Authenticated-Directory-Path-Traversal_OpenClinic-GA_5.247.01_Report.md; https://sourceforge.net/projects/open-clinic/; https://github.com/BugBountyHunterCVE/CVE-2023-40279/blob/main/CVE-2023-40279_Authenticated-Directory-Path-Traversal_OpenClinic-GA_5.247.01_Report.md
CVE: CVE-2024-29143
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs, sareiodata Passwordless Login passwordless-login allows Stored XSS.This issue affects Passwordless Login: from n/a through 1.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/passwordless-login/wordpress-passwordless-login-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/passwordless-login/wordpress-passwordless-login-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-2636
Published: 2024-03-19
Description:  An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espanol/update_password.jsp' file. Modifying the 'M4_NEW_PASSWORD' parameter, an attacker could store a malicious JSP file inside the file directory, to be executed the the file is loaded in the application. 
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE: CVE-2024-28734
Published: 2024-03-19
Description: Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/177619/Financials-By-Coda-Cross-Site-Scripting.html; https://www.unit4.com/; https://www.unit4.com/products/financial-management-software
CVE: CVE-2024-29127
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Reflected XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-access-manager/wordpress-advanced-access-manager-plugin-6-9-20-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-access-manager/wordpress-advanced-access-manager-plugin-6-9-20-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29128
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Post SMTP POST SMTP allows Reflected XSS.This issue affects POST SMTP: from n/a through 2.8.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/post-smtp/wordpress-post-smtp-mailer-plugin-2-8-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/post-smtp/wordpress-post-smtp-mailer-plugin-2-8-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29129
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPLIT Pty Ltd OxyExtras allows Reflected XSS.This issue affects OxyExtras: from n/a through 1.4.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/oxyextras/wordpress-oxyextras-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/oxyextras/wordpress-oxyextras-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29130
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/contact-form-7-paypal-add-on/wordpress-contact-form-7-paypal-stripe-add-on-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-7-paypal-add-on/wordpress-contact-form-7-paypal-stripe-add-on-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29134
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-11-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tourfic/wordpress-tourfic-plugin-2-11-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29135
Published: 2024-03-19
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-11-15-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tourfic/wordpress-tourfic-plugin-2-11-15-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-29136
Published: 2024-03-19
Description: Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.
CVSS Score: 8.5 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-11-17-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tourfic/wordpress-tourfic-plugin-2-11-17-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-29137
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-11-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tourfic/wordpress-tourfic-plugin-2-11-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29138
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joachim Jensen Restrict User Access – Membership Plugin with Force restrict-user-access.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through <= 2.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/restrict-user-access/vulnerability/wordpress-restrict-user-access-plugin-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/restrict-user-access/wordpress-restrict-user-access-plugin-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29139
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Tilly MyCurator Content Curation allows Reflected XSS.This issue affects MyCurator Content Curation: from n/a through 3.76.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mycurator/wordpress-mycurator-content-curation-plugin-3-76-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mycurator/wordpress-mycurator-content-curation-plugin-3-76-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29140
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Manning MJM Clinic allows Stored XSS.This issue affects MJM Clinic: from n/a through 1.1.22.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mjm-clinic/wordpress-mjm-clinic-plugin-1-1-22-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/mjm-clinic/wordpress-mjm-clinic-plugin-1-1-22-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-29141
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PDF Embedder allows Stored XSS.This issue affects PDF Embedder: from n/a through 4.6.4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pdf-embedder/wordpress-pdf-embedder-plugin-4-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pdf-embedder/wordpress-pdf-embedder-plugin-4-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29142
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebberZone Better Search – Relevant search results for WordPress allows Stored XSS.This issue affects Better Search – Relevant search results for WordPress: from n/a through 3.3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/better-search/wordpress-better-search-plugin-3-3-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/better-search/wordpress-better-search-plugin-3-3-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50966
Published: 2024-03-19
Description: erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/P3ngu1nW/CVE_Request/blob/main/erlang-jose.md; https://github.com/potatosalad/erlang-jose; https://hexdocs.pm/jose/JOSE.html
CVE: CVE-2024-1401
Published: 2024-03-19
Description: The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/91064ba5-cf65-46e6-88df-0e4d96a3ef9f/; https://wpscan.com/vulnerability/91064ba5-cf65-46e6-88df-0e4d96a3ef9f/