deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-33910
Published: 2024-05-06
Description: Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/digital-publications-by-supsystic/wordpress-digital-publications-by-supsystic-plugin-1-7-7-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/digital-publications-by-supsystic/wordpress-digital-publications-by-supsystic-plugin-1-7-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33912
Published: 2024-05-06
Description: Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/academy/wordpress-academy-lms-plugin-1-9-16-broken-access-control-on-paid-courses-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/academy/wordpress-academy-lms-plugin-1-9-16-broken-access-control-on-paid-courses-vulnerability?_s_id=cve
CVE: CVE-2024-34366
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AltText.Ai Download Alt Text AI allows Stored XSS.This issue affects Download Alt Text AI: from n/a through 1.3.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/alttext-ai/wordpress-alttext-ai-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/alttext-ai/wordpress-alttext-ai-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34367
Published: 2024-05-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ays-popup-box/wordpress-popup-box-plugin-4-1-2-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ays-popup-box/wordpress-popup-box-plugin-4-1-2-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34368
Published: 2024-05-06
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mooberry Dreams Mooberry Book Manager.This issue affects Mooberry Book Manager: from n/a through 4.15.12.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/mooberry-book-manager/wordpress-mooberry-book-manager-plugin-4-15-12-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mooberry-book-manager/wordpress-mooberry-book-manager-plugin-4-15-12-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-34369
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webpushr Web Push Notifications Webpushr allows Reflected XSS.This issue affects Webpushr: from n/a through 4.35.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/webpushr-web-push-notifications/wordpress-web-push-notifications-webpushr-plugin-4-35-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/webpushr-web-push-notifications/wordpress-web-push-notifications-webpushr-plugin-4-35-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34371
Published: 2024-05-06
Description: Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.18.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/login-with-phone-number/vulnerability/wordpress-login-with-phone-number-plugin-1-7-18-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/login-with-phone-number/wordpress-login-with-phone-number-plugin-1-7-18-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34372
Published: 2024-05-06
Description: Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-7-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34373
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-plugin-5-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/the-plus-addons-for-elementor-page-builder/wordpress-the-plus-addons-for-elementor-plugin-5-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34374
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuomodoSoft ElementsReady Addons for Elementor allows Stored XSS.This issue affects ElementsReady Addons for Elementor: from n/a through 5.8.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/element-ready-lite/wordpress-elementsready-addons-for-elementor-plugin-5-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/element-ready-lite/wordpress-elementsready-addons-for-elementor-plugin-5-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34375
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.This issue affects Sheets To WP Table Live Sync: from n/a through 3.7.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sheets-to-wp-table-live-sync/wordpress-sheets-to-wp-table-live-sync-plugin-3-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sheets-to-wp-table-live-sync/wordpress-sheets-to-wp-table-live-sync-plugin-3-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34376
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Edge allows Stored XSS.This issue affects Edge: from n/a through 2.0.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/edge/wordpress-edge-theme-2-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/edge/wordpress-edge-theme-2-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34377
Published: 2024-05-06
Description: Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/new-video-gallery/wordpress-video-gallery-api-gallery-youtube-and-vimeo-link-gallery-plugin-1-5-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/new-video-gallery/wordpress-video-gallery-api-gallery-youtube-and-vimeo-link-gallery-plugin-1-5-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34378
Published: 2024-05-06
Description: Missing Authorization vulnerability in LeadConnector.This issue affects LeadConnector: from n/a through 1.7.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/leadconnector/wordpress-leadconnector-plugin-1-7-api-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/leadconnector/wordpress-leadconnector-plugin-1-7-api-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34379
Published: 2024-05-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/restaurant-and-cafe/wordpress-restaurant-and-cafe-theme-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/restaurant-and-cafe/wordpress-restaurant-and-cafe-theme-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-34380
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through 1.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/conversational-forms/wordpress-chatbot-conversational-forms-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/conversational-forms/wordpress-chatbot-conversational-forms-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34381
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-2-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-2-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34386
Published: 2024-05-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lucian Apostol Auto Affiliate Links.This issue affects Auto Affiliate Links: from n/a through 6.4.3.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wp-auto-affiliate-links/wordpress-auto-affiliate-links-plugin-6-4-3-1-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-auto-affiliate-links/wordpress-auto-affiliate-links-plugin-6-4-3-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-34387
Published: 2024-05-06
Description: Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-post-author/wordpress-wp-post-author-plugin-3-6-4-rating-value-manipulation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-post-author/wordpress-wp-post-author-plugin-3-6-4-rating-value-manipulation-vulnerability?_s_id=cve
CVE: CVE-2024-34389
Published: 2024-05-06
Description: Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-post-author/wordpress-wp-post-author-plugin-3-6-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-post-author/wordpress-wp-post-author-plugin-3-6-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34390
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue affects Post Grid Master: from n/a through 3.4.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-8-auth-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-8-auth-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34412
Published: 2024-05-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Parcel Panel ParcelPanel.This issue affects ParcelPanel: from n/a through 3.8.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/parcelpanel/wordpress-parcelpanel-plugin-3-8-1-subscriber-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/parcelpanel/wordpress-parcelpanel-plugin-3-8-1-subscriber-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-3661
Published: 2024-05-06
Description: DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
CVSS Score: 7.6 (HIGH)
CWE: CWE-306, CWE-501, CWE-306
References: https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/; https://bst.cisco.com/quickview/bug/CSCwk05814; https://datatracker.ietf.org/doc/html/rfc2131#section-7
CVE: CVE-2024-33117
Published: 2024-05-06
Description: crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/33117.txt; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/33117.txt
CVE: CVE-2024-33118
Published: 2024-05-06
Description: LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController.
CVSS Score: 7.5 (HIGH)
CWE: CWE-494
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/33118.txt; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/33118.txt
CVE: CVE-2024-33121
Published: 2024-05-06
Description: Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/33121.txt; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/33121.txt
CVE: CVE-2024-33570
Published: 2024-05-06
Description: Missing Authorization vulnerability in Roxnor Metform metform.This issue affects Metform: from n/a through <= 3.8.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/metform/vulnerability/wordpress-metform-plugin-3-8-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/metform/wordpress-metform-plugin-3-8-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33576
Published: 2024-05-06
Description: Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wppizza/wordpress-wppizza-plugin-3-18-10-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wppizza/wordpress-wppizza-plugin-3-18-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33599
Published: 2024-05-06
Description: nscd: Stack-based buffer overflow in netgroup cache

If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted
by client requests then a subsequent client request for netgroup data
may result in a stack-based buffer overflow.  This flaw was introduced
in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-121
References: http://www.openwall.com/lists/oss-security/2024/07/22/5; https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-33600
Published: 2024-05-06
Description: nscd: Null pointer crashes after notfound response

If the Name Service Cache Daemon's (nscd) cache fails to add a not-found
netgroup response to the cache, the client request can result in a null
pointer dereference.  This flaw was introduced in glibc 2.15 when the
cache was added to nscd.

This vulnerability is only present in the nscd binary.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2024/07/22/5; https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-33601
Published: 2024-05-06
Description: nscd: netgroup cache may terminate daemon on memory allocation failure

The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or
xrealloc and these functions may terminate the process due to a memory
allocation failure resulting in a denial of service to the clients.  The
flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.
CVSS Score: 7.3 (HIGH)
CWE: CWE-617
References: http://www.openwall.com/lists/oss-security/2024/07/22/5; https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-33602
Published: 2024-05-06
Description: nscd: netgroup cache assumes NSS callback uses in-buffer strings

The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory
when the NSS callback does not store all strings in the provided buffer.
The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.
CVSS Score: 7.4 (HIGH)
CWE: CWE-466
References: http://www.openwall.com/lists/oss-security/2024/07/22/5; https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-33907
Published: 2024-05-06
Description: Missing Authorization vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.26.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/print-my-blog/vulnerability/wordpress-print-my-blog-plugin-3-26-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/print-my-blog/wordpress-print-my-blog-plugin-3-26-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33908
Published: 2024-05-06
Description: Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/widgetkit-for-elementor/wordpress-widgetkit-plugin-2-4-8-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/widgetkit-for-elementor/wordpress-widgetkit-plugin-2-4-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-4568
Published: 2024-05-06
Description: In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow.
CVSS Score: 2.9 (LOW)
CWE: CWE-674, CWE-674
References: https://www.xpdfreader.com/security-bug/object-loops.html; https://www.xpdfreader.com/security-bug/object-loops.html
CVE: CVE-2022-37460
Published: 2024-05-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-33548
Published: 2024-05-06
Description: Cross Site Scripting (XSS) vulnerability in ASUS RT-AC51U with firmware versions up to and including 3.0.0.4.380.8591 allows attackers to run arbitrary code via the WPA Pre-Shared Key field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Idaht/ASUS_RT-AC51U_CVE/blob/main/XSS%20-%20WPA%20Pre-Shared%20Key; https://github.com/Idaht/ASUS_RT-AC51U_CVE/blob/main/XSS%20-%20WPA%20Pre-Shared%20Key
CVE: CVE-2024-1695
Published: 2024-05-06
Description: A potential security vulnerability has been identified in the HP Application Enabling Software Driver for certain HP PC products, which might allow escalation of privilege. HP is releasing software updates to mitigate this potential vulnerability.
CVSS Score: 5.7 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]5627-16/hpsbhf03932; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]5627-16/hpsbhf03932
CVE: CVE-2024-28725
Published: 2024-05-06
Description: Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/asenzhenshuai/DongDong/blob/main/yzmcms-xss.pdf; https://github.com/asenzhenshuai/DongDong/issues/1; https://github.com/asenzhenshuai/DongDong/blob/main/yzmcms-xss.pdf
CVE: CVE-2024-34413
Published: 2024-05-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SliceWP allows Stored XSS.This issue affects SliceWP: from n/a through 1.1.10.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/slicewp/wordpress-slicewp-affiliates-plugin-1-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slicewp/wordpress-slicewp-affiliates-plugin-1-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34532
Published: 2024-05-06
Description: A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker to gain privileges via the query parameter to models/querydeluxe.py:QueryDeluxe::get_result_from_query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/luvsn/OdZoo/tree/main/exploits/query_deluxe; https://github.com/luvsn/OdZoo/tree/main/exploits/query_deluxe
CVE: CVE-2024-34533
Published: 2024-05-06
Description: A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a remote attacker to gain privileges via a query to IZITools::query_check, IZITools::query_fetch, or IZITools::query_execute.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/luvsn/OdZoo/tree/main/exploits/izi_data; https://github.com/luvsn/OdZoo/tree/main/exploits/izi_data
CVE: CVE-2024-34534
Published: 2024-05-06
Description: A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote attacker to gain privileges via the data parameter to models/ir_model.py:IrModel::chech_model.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/luvsn/OdZoo/tree/main/exploits/text_commander; https://github.com/luvsn/OdZoo/tree/main/exploits/text_commander