deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-42574
Published: 2024-08-20
Description: School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/topsky979/7064f8bbd3977ee665a098efcd0170c0
CVE: CVE-2024-42575
Published: 2024-08-20
Description: School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/topsky979/2fddc00b33b038cd778c1e4fb1936a15
CVE: CVE-2024-42576
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/topsky979/50a1d8ad7effd9ccd089952602c831d3
CVE: CVE-2024-42577
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gist.github.com/topsky979/20ad7b251f2905db38e7a6566b1d46cc
CVE: CVE-2024-42578
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://gist.github.com/topsky979/5eacc7e418e3b73b7ad1fa05d1a72aeb
CVE: CVE-2024-42579
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gist.github.com/topsky979/ed59fb8b35a220dfa064a3a3cb1ecb1b
CVE: CVE-2024-42580
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gist.github.com/topsky979/8a[PII_REDACTED]7d8c6ce8c6624ec1e897
CVE: CVE-2024-42581
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gist.github.com/topsky979/2bd26343ccdff7c759f62d332c8caff6
CVE: CVE-2024-42582
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gist.github.com/topsky979/c0d78b257ce1e661be30de1ce9551d27
CVE: CVE-2024-42583
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gist.github.com/topsky979/dac0206b8de14763bdbe2b6bb7020cdc
CVE: CVE-2024-42584
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gist.github.com/topsky979/6037eaac5749430c29cf15fdd9df0ba5
CVE: CVE-2024-42585
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/topsky979/33de7a4bd7a4517a26fa4e4911b7fb1d
CVE: CVE-2024-42586
Published: 2024-08-20
Description: A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/topsky979/533b962efb1779e397a241bf7a19643c
CVE: CVE-2024-6918
Published: 2024-08-20
Description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability
exists that could cause a crash of the Accutech Manager when receiving a specially crafted
request over port 2536/TCP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-226-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-226-01.pdf
CVE: CVE-2024-33872
Published: 2024-08-20
Description: Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-269
References: https://trust.keyfactor.com/?itemUid=d73921fd-bc9e-4e35-a974-cfb628e6a226&source=click
CVE: CVE-2024-34458
Published: 2024-08-20
Description: Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://trust.keyfactor.com/?itemUid=d73921fd-bc9e-4e35-a974-cfb628e6a226&source=click
CVE: CVE-2024-39094
Published: 2024-08-20
Description: Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://friendi.ca/2024/08/17/friendica-2024-08-released/; https://github.com/friendica/friendica/issues/14220; https://github.com/friendica/friendica/releases/tag/2024.08
CVE: CVE-2024-42006
Published: 2024-08-20
Description: Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://trust.keyfactor.com/?itemUid=d73921fd-bc9e-4e35-a974-cfb628e6a226&source=click
CVE: CVE-2024-42608
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/2/readme.md
CVE: CVE-2024-6377
Published: 2024-08-20
Description: An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.
CVSS Score: 8.1 (HIGH)
CWE: CWE-601, CWE-601
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-6378
Published: 2024-08-20
Description: A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-6379
Published: 2024-08-20
Description: A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-8003
Published: 2024-08-20
Description: A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of the file internal/app/routes/routes.go of the component Log Handler. The manipulation leads to deserialization. The patch is identified as 45ac90d6d1f82716f77dbcdf8e7309c229080e3c. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-502, CWE-502
References: https://github.com/Go-Tribe/gotribe-admin/commit/45ac90d6d1f82716f77dbcdf8e7309c229080e3c; https://github.com/Go-Tribe/gotribe-admin/issues/1; https://github.com/Go-Tribe/gotribe-admin/issues/1#issuecomment[PII_REDACTED]
CVE: CVE-2024-8005
Published: 2024-08-20
Description: A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.2 is able to address this issue. The patch is named be702ada7cb6fdabc02689d90b38139c827458a5. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-798
References: https://github.com/demozx/gf_cms/commit/be702ada7cb6fdabc02689d90b38139c827458a5; https://github.com/demozx/gf_cms/commit/de51cc57a96ccca905c837ef925c2cc3a5241383; https://github.com/demozx/gf_cms/issues/5
CVE: CVE-2024-30949
Published: 2024-08-20
Description: An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://gist.github.com/visitorckw/6b26e599241ea80210ea136b28441661; https://inbox.sourceware.org/newlib/[PII_REDACTED]5714.469943-1-visitorckw%40gmail.com/; https://sourceware.org/git/?p=newlib-cygwin.git%3Ba=commit%3Bh=5f15d7c5817b07a6b18cbab17342c95cb7b42be4
CVE: CVE-2024-35540
Published: 2024-08-20
Description: A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://cyberaz0r.info/2024/08/typecho-multiple-vulnerabilities/
CVE: CVE-2024-39690
Published: 2024-08-20
Description: Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace. Version 0.7.1 contains a patch.
CVSS Score: 8.4 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584; https://github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwp
CVE: CVE-2024-42369
Published: 2024-08-20
Description: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-674, CWE-674
References: https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6; https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm
CVE: CVE-2024-42603
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=clearall
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/10/readme.md
CVE: CVE-2024-42604
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_group.php?mode=delete&group_id=3
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/1/readme.md
CVE: CVE-2024-42605
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=1
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/3/readme.md
CVE: CVE-2024-42606
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?clear=1
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/6/readme.md
CVE: CVE-2024-42607
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=database
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/9/readme.md
CVE: CVE-2024-42609
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatars
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/8/readme.md
CVE: CVE-2024-42610
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=files
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/7/readme.md
CVE: CVE-2024-42611
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin_page.php?link_id=1&mode=delete
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/4/readme.md
CVE: CVE-2024-42613
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=install&widget=akismet
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/14/readme.md
CVE: CVE-2024-42616
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=remove&widget=Statistics
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/13/readme.md
CVE: CVE-2024-42617
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_config.php?action=save&var_id=32
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/11/readme.md
CVE: CVE-2024-42618
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/16/readme.md
CVE: CVE-2024-42621
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.php
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/12/readme.md
CVE: CVE-2024-42662
Published: 2024-08-20
Description: An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request.
CVSS Score: 7.5 (HIGH)
References: https://gist.github.com/len0m0/f0886d579de6c075506ab543e054dc7d; https://github.com/len0m0/Apolloinfo/blob/main/README.md
CVE: CVE-2024-43376
Published: 2024-08-20
Description: Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://github.com/umbraco/Umbraco-CMS/commit/b76070c794925932cb159ef50b851db6e966a004; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-77gj-crhp-3gvx
CVE: CVE-2024-43377
Published: 2024-08-20
Description: Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://github.com/umbraco/Umbraco-CMS/commit/72bef8861d94a39d5cc9530a04c4797b91fcbecf; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hrww-x3fq-xcvh
CVE: CVE-2024-43397
Published: 2024-08-20
Description: Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed; https://github.com/apolloconfig/apollo/pull/5192; https://github.com/apolloconfig/apollo/releases/tag/v2.3.0
CVE: CVE-2024-43404
Published: 2024-08-20
Description: MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python code into the `expression` parameter when using `/math` in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in  release version 1.5.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/NicPWNs/MEGABOT/commit/71e79e5581ea[PII_REDACTED]5b112d863053fb7ed6; https://github.com/NicPWNs/MEGABOT/issues/137; https://github.com/NicPWNs/MEGABOT/pull/138
CVE: CVE-2024-43406
Published: 2024-08-20
Description: LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulnerability is fixed in 1.14.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d[PII_REDACTED]12b65503; https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p
CVE: CVE-2024-43409
Published: 2024-08-20
Description: Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-287
References: https://github.com/TryGhost/Ghost/commit/dac25612520b571f58679764ecc27109e641d1db; https://github.com/TryGhost/Ghost/security/advisories/GHSA-78x2-cwp9-5j42
CVE: CVE-2024-27184
Published: 2024-08-20
Description: Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-inadequate-validation-of-internal-urls.html
CVE: CVE-2024-27185
Published: 2024-08-20
Description: The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-444
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-cache-poisoning-in-pagination.html
CVE: CVE-2024-27186
Published: 2024-08-20
Description: The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-in-html-mail-templates.html
CVE: CVE-2024-27187
Published: 2024-08-20
Description: Improper Access Controls allows backend users to overwrite their username when disallowed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-improper-acl-for-backend-profile-view.html
CVE: CVE-2024-40743
Published: 2024-08-20
Description: The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-xss-vectors-in-outputfilter-strip-methods.html
CVE: CVE-2024-42598
Published: 2024-08-20
Description: SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-94
References: https://gitee.com/fushuling/cve/blob/master/CVE-2024-42598.md; https://gitee.com/fushuling/cve/blob/master/SeaCMS%20V13%20admin_editplayer.php%20code%20injection.md
CVE: CVE-2024-42919
Published: 2024-08-20
Description: eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/jeyabalaji711/CVE-2024-42919
CVE: CVE-2024-43408
Published: 2024-08-20
Description: Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability is fixed in commit a62f711d5600e4e5d86f342d52932cb6221672e7.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/discourse/discourse-placeholder-theme-component/commit/a62f711d5600e4e5d86f342d52932cb6221672e7; https://github.com/discourse/discourse-placeholder-theme-component/security/advisories/GHSA-9wx4-cmv3-g5jw
CVE: CVE-2023-1673
Published: 2024-08-20
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-35214
Published: 2024-08-20
Description: A tampering vulnerability in the CylanceOPTICS Windows Installer Package of CylanceOPTICS for Windows version 3.2 and 3.3 could allow an attacker to potentially uninstall CylanceOPTICS from a system thereby leaving it with only the protection of CylancePROTECT.
CWE: CWE-288
References: https://support.blackberry.com/pkb/s/article/140080; http://seclists.org/fulldisclosure/2024/Sep/52
CVE: CVE-2024-42612
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/5/readme.md
CVE: CVE-2024-6322
Published: 2024-08-20
Description: Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266
References: https://grafana.com/security/security-advisories/cve-2024-6322/
CVE: CVE-2024-38175
Published: 2024-08-20
Description: An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a network.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38175
CVE: CVE-2024-42619
Published: 2024-08-20
Description: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?id=0&list=whitelist&remove=pligg.com
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/jinwu[PII_REDACTED]/cms2/tree/main/17/readme.md