deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-50353
Published: 2024-10-30
Description: ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired. Users not implemented SAS Uri's are unaffected. This issue was resolved in version 8.0.0 of the library.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/commit/8ea534481181a063175f457082662fdcad9a41ff; https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/security/advisories/GHSA-24mc-gc52-47jv
CVE: CVE-2024-51257
Published: 2024-10-30
Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51296
Published: 2024-10-30
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51298
Published: 2024-10-30
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51299
Published: 2024-10-30
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51300
Published: 2024-10-30
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51301
Published: 2024-10-30
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-50419
Published: 2024-10-30
Description: Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greenshift: from n/a through <= 9.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://patchstack.com/database/Wordpress/Plugin/greenshift-animation-and-page-builder-blocks/vulnerability/wordpress-greenshift-animation-and-page-builder-blocks-plugin-9-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-50344
Published: 2024-10-30
Description: I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-80
References: https://github.com/mkucej/i-librarian-free/commit/a67d7949ffb02fd912ebdcf552df006b44066d78; https://github.com/mkucej/i-librarian-free/security/advisories/GHSA-c2rm-w62w-5xmj
CVE: CVE-2024-51258
Published: 2024-10-30
Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-9110
Published: 2024-10-30
Description: A medium severity vulnerability has been identified within Privileged Identity which can allow an attacker to perform reflected cross-site scripting attacks.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.beyondtrust.com/trust-center/security-advisories/bt24-09
CVE: CVE-2024-10456
Published: 2024-10-30
Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-303-03
CVE: CVE-2024-31972
Published: 2024-10-30
Description: EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execution (under the context of the user's session) via the Wi-Fi SSID input fields. Web scripts embedded into the vulnerable fields this way are executed immediately when a user logs into the admin page. This affects /admin/wifi/wlan1 and /admin/wifi/wlan_guest.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-31972
CVE: CVE-2024-31973
Published: 2024-10-30
Description: Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'Network Name (SSID)' input fields to the /index.html#wireless_basic page.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79
References: https://github.com/actuator/cve/blob/main/Hitron/CVE-2024-31973
CVE: CVE-2024-31975
Published: 2024-10-30
Description: EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vulnerable field is executed when the user clicks the SSID field's corresponding EDIT button.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-31975
CVE: CVE-2024-36060
Published: 2024-10-30
Description: EnGenius EnStation5-AC A8J-ENS500AC 1.0.0 devices allow blind OS command injection via shell metacharacters in the Ping and Speed Test parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-36060
CVE: CVE-2024-37573
Published: 2024-10-30
Description: The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.talkatone.vedroid.ui.launcher.OutgoingCallInterceptor component.
CVSS Score: 8.4 (HIGH)
References: https://github.com/actuator/com.talkatone.android/blob/main/CVE-2024-37573
CVE: CVE-2024-42041
Published: 2024-10-30
Description: The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://github.com/actuator/com.videodownload.browser.videodownloader/blob/main/CVE-2024-42041
CVE: CVE-2024-48214
Published: 2024-10-30
Description: KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. This vulnerability allows an attacker to create a custom, unauthenticated QR code and abuse one of the parameters, either SSID or PASSWORD, in the JSON data contained within the QR code. By that, the attacker can execute arbitrary code on the camera.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://medium.com/%40shenhavmor/exploiting-a-chinese-camera-for-fun-cve-2024-48214-2d56848870c2
CVE: CVE-2024-48241
Published: 2024-10-30
Description: An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/St-Andrews-Bug-Busters/Vuln_info/blob/main/radare2/CVE-2024-48241.md; https://github.com/radareorg/radare2/issues/23317; https://github.com/radareorg/radare2/pull/23318
CVE: CVE-2024-48569
Published: 2024-10-30
Description: Proactive Risk Manager version 9.1.1.0 is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in the add/edit form fields, at the urls starting with the subpaths: /ar/config/configuation/ and /ar/config/risk-strategy-control/
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/MarioTesoro/CVE-2024-48569; https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-48569
CVE: CVE-2024-48646
Published: 2024-10-30
Description: An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files, such as HTML, scripts, or other executable content, that may be executed on the server, leading to further system compromise.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://github.com/hx381/Sage-1000-v7.0.0-Exploit/blob/main/README.md
CVE: CVE-2024-48647
Published: 2024-10-30
Description: A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's file system by manipulating the URL parameter in HTTP requests. The attacker can exploit this flaw to access sensitive information, including configuration files that may contain credentials and system settings, which could lead to further compromise of the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-552
References: https://github.com/hx381/Sage-1000-v7.0.0-Exploit/blob/main/README.md
CVE: CVE-2024-48648
Published: 2024-10-30
Description: A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. This vulnerability allows attackers to inject malicious scripts into URLs, which are reflected back by the server in the response without proper sanitization or encoding.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hx381/Sage-1000-v7.0.0-Exploit/blob/main/README.md
CVE: CVE-2024-9419
Published: 2024-10-30
Description: Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege. A client using the HP Smart Universal Printing Driver that sends a print job comprised of a malicious XPS file could potentially lead to Remote Code Execution and/or Elevation of Privilege on the PC.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.hp.com/us-en/document/ish_1[PII_REDACTED]5972-16
CVE: CVE-2024-46531
Published: 2024-10-30
Description: phpgurukul Vehicle Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchinputdata parameter at /index.php.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/shouvikdutta1998/Vehicle_Record_Management_System
CVE: CVE-2024-48202
Published: 2024-10-30
Description: icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Lunax0/LogLunax/blob/main/icecms/CVE-2024-48202.md
CVE: CVE-2024-10546
Published: 2024-10-30
Description: A vulnerability classified as critical was found in open-scratch Teaching 在线教学平台 up to 2.7. This vulnerability affects unknown code of the file /api/sys/ng-alain/getDictItemsByTable/ of the component URL Handler. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.282520; https://vuldb.com/?id.282520; https://vuldb.com/?submit.429033
CVE: CVE-2024-48271
Published: 2024-10-30
Description: D-Link DSL6740C v6.TR[PII_REDACTED]0 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentication and escalate privileges on the device via a bruteforce attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-521
References: https://gist.github.com/stevenyu113228/e264c145d6e6e6b59cf53fddc27409ad#1--predictable-administrator-credentials-in-d-link-dsl6740c-modem; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48272
Published: 2024-10-30
Description: D-Link DSL6740C v6.TR[PII_REDACTED]0 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforce attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-521
References: https://gist.github.com/stevenyu113228/e264c145d6e6e6b59cf53fddc27409ad#2--predictable-wifi-password-in-d-link-dsl6740c-modem; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2023-52066
Published: 2024-10-30
Description: http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter.
CVSS Score: 7.2 (HIGH)
References: https://github.com/karlseguin/http.zig/issues/25
CVE: CVE-2024-43382
Published: 2024-10-30
Description: Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client side encryption.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-f686-hw9c-xw9c
CVE: CVE-2024-48093
Published: 2024-10-30
Description: Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing malicious files without validating file extensions or content types.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://github.com/yamerooo123/CVE/blob/main/CVE-2024-48093/Description.md; https://youtu.be/rCYIohrQdxM
CVE: CVE-2024-48112
Published: 2024-10-30
Description: A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/nn0nkey/nn0nkey/blob/main/Thinkphp/CVE-2024-48112.md; https://github.com/top-think/think
CVE: CVE-2024-48346
Published: 2024-10-30
Description: xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered through the fileUrl parameter, which allows an attacker to make arbitrary requests to internal or external systems.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-918
References: https://github.com/xtreme1-io/xtreme1/issues/284
CVE: CVE-2024-48733
Published: 2024-10-30
Description: SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://sas.com; https://github.com/ACN-CVEs/CVE-2024-48733/blob/ea2da31c3d6e0140edd6a1455e6157b8ba2f7a67/SQL%20injection.pdf
CVE: CVE-2024-48734
Published: 2024-10-30
Description: Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://sas.com; https://github.com/ACN-CVEs/CVE-2024-48734/blob/d59cca7b03bce3a516035d1a0f488d67c3d10ae6/Unrestricted%20file%20upload.pdf
CVE: CVE-2024-48735
Published: 2024-10-30
Description: Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: http://sas.com; https://github.com/ACN-CVEs/CVE-2024-48735/blob/67e86e12393650e1df16c845ceff487d016f31f0/LFI.pdf
CVE: CVE-2024-48807
Published: 2024-10-30
Description: Cross Site Scripting vulnerability in PHPGurukul Doctor Appointment Management System v.1.0 allows a local attacker to execute arbitrary code via the search parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40KrishnaChaganti/cross-site-scripting-xss-in-appointment-management-system-cve-2024-48807-0f7523be9fa2; https://phpgurukul.com/doctor-appointment-management-system-using-php-and-mysql/
CVE: CVE-2024-51242
Published: 2024-10-30
Description: A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/shadia0/Patienc/blob/main/eladmin_ssrf.md
CVE: CVE-2024-51243
Published: 2024-10-30
Description: The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/shadia0/Patienc/blob/main/eladmin_rce.md
CVE: CVE-2024-51419
Published: 2024-10-30
Description: Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to execute arbitrary code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/475bd8bc21c4f4dfc8f26ce35eb6ca28.git
CVE: CVE-2024-51424
Published: 2024-10-30
Description: An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Wzy-source/Gala/blob/main/CVEs/AURA_0x967d176328948e4db4446b8caf623ff9b47221fb.md
CVE: CVE-2024-51425
Published: 2024-10-30
Description: An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is disputed by third parties because the impact is limited to function calls.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://github.com/Wzy-source/Gala/blob/main/CVEs/WaterToken_0x[PII_REDACTED]f895aca11fbe4679a1f9cc472f6531.md
CVE: CVE-2024-51426
Published: 2024-10-30
Description: An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer function. NOTE: this is disputed by third parties because the impact is limited to function calls.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://github.com/Wzy-source/Gala/blob/main/CVEs/EOTT_0x5fe[PII_REDACTED]aade651f76492f8489e43ceb48a.md
CVE: CVE-2024-51427
Published: 2024-10-30
Description: An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Wzy-source/Gala/blob/main/CVEs/PepeGxng_0x5d8d1f28cad84fad8d2fea9fdd4ab5022d23b0fe.md
CVE: CVE-2024-10005
Published: 2024-10-30
Description: A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-10006
Published: 2024-10-30
Description: A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.
CVSS Score: 8.3 (HIGH)
CWE: CWE-644, CWE-116
References: https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-10086
Published: 2024-10-30
Description: A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.hashicorp.com/t/hcsec-2024-24-consul-vulnerable-to-reflected-xss-on-content-type-error-manipulation; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-10556
Published: 2024-10-31
Description: A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file birdsadd.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/28; https://vuldb.com/?ctiid.282558; https://vuldb.com/?id.282558
CVE: CVE-2024-10557
Published: 2024-10-31
Description: A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /file/updateprofile.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://code-projects.org/; https://github.com/bevennyamande/bloodbank_profile_update_csrf; https://vuldb.com/?ctiid.282559
CVE: CVE-2024-48307
Published: 2024-10-31
Description: JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jeecgboot; https://github.com/jeecgboot/JeecgBoot; https://github.com/jeecgboot/JeecgBoot/issues/7237
CVE: CVE-2024-10544
Published: 2024-10-31
Description: The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://plugins.trac.wordpress.org/browser/woo-manage-fraud-orders/trunk/includes/class-wmfo-debug-log.php#L25; https://www.wordfence.com/threat-intel/vulnerabilities/id/a62df5f6-64b0-4489-9dde-0d472040ee12?source=cve