deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7919
Published: 2024-08-19
Description: A vulnerability, which was classified as critical, has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. This issue affects some unknown processing of the file /report/ParkChargeRecord/GetDataList. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://vuldb.com/?ctiid.275069; https://vuldb.com/?id.275069; https://vuldb.com/?submit.387124
CVE: CVE-2024-7920
Published: 2024-08-19
Description: A vulnerability, which was classified as problematic, was found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. Affected is an unknown function of the file /Report/ParkCommon/GetParkInThroughDeivces. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://vuldb.com/?ctiid.275070; https://vuldb.com/?id.275070; https://vuldb.com/?submit.387125
CVE: CVE-2024-44067
Published: 2024-08-19
Description: The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged attackers to write to arbitrary physical memory locations, aka GhostWrite.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-123
References: https://ghostwriteattack.com
CVE: CVE-2024-44069
Published: 2024-08-19
Description: Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. NOTE: the supplier reportedly does "not consider the bug a security issue" but the specific motivation for letting arbitrary persons change the value (Celsius, Fahrenheit, or Kelvin), seen by the device owner, is unclear.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/pi-hole/web/pull/3077; https://www.kiyell.com/The-Harmless-Pihole-Bug/
CVE: CVE-2024-44070
Published: 2024-08-19
Description: An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value.
CVSS Score: 7.5 (HIGH)
References: https://github.com/FRRouting/frr/pull/16497; https://lists.debian.org/debian-lts-announce/2024/09/msg00007.html
CVE: CVE-2024-44073
Published: 2024-08-19
Description: The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-674
References: https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0; https://github.com/rust-bitcoin/rust-miniscript/pull/704; https://github.com/rust-bitcoin/rust-miniscript/pull/712
CVE: CVE-2024-44076
Published: 2024-08-19
Description: In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://github.com/microcks/microcks/compare/1.9.1-fix-1...1.10.0; https://github.com/microcks/microcks/issues/1212; https://github.com/microcks/microcks/releases/tag/1.10.0
CVE: CVE-2024-7921
Published: 2024-08-19
Description: A vulnerability has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /report/ParkOutRecord/GetDataList. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://vuldb.com/?ctiid.275071; https://vuldb.com/?id.275071; https://vuldb.com/?submit.387126
CVE: CVE-2024-44083
Published: 2024-08-19
Description: ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the payload from where the actual entry point will be invoked. NOTE: in many use cases, this is an inconvenience but not a security issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/Azvanzed/CVE-2024-44083/; https://github.com/Azvanzed/IdaMeme
CVE: CVE-2024-6330
Published: 2024-08-19
Description: The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/95b532e0-1ffb-421e-b9c0-de03f89491d7/
CVE: CVE-2024-6451
Published: 2024-08-19
Description: AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-532
References: https://wpscan.com/vulnerability/fc06d413-a227-470c-a5b7-cdab57aeab34/
CVE: CVE-2024-6843
Published: 2024-08-19
Description: The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9a5cb440-065a-445a-9a09-55bd5f782e85/
CVE: CVE-2024-25582
Published: 2024-08-19
Description: Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared link to a malicious account. Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that provide the feature, excluding any arbitrary or non-existing modules. No publicly available exploits are known.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0003.json; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6277_7.10.6_2024-05-06.pdf; http://seclists.org/fulldisclosure/2024/Aug/37
CVE: CVE-2024-42675
Published: 2024-08-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-39306
Published: 2024-08-19
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-39304. Reason: This candidate is a duplicate of CVE-2024-39304. Notes: All CVE users should reference CVE-2024-39304 instead of this candidate. This CVE was issued to a vulnerability that is dependent on CVE-2024-39304. According to rule 4.2.15 of the CVE CNA rules, "CNAs MUST NOT assign a different CVE ID to a Vulnerability that is fully interdependent with another Vulnerability. The Vulnerabilities are effectively the same single Vulnerability and MUST use one CVE ID."
CVE: CVE-2024-43372
Published: 2024-08-19
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-43369. Reason: This candidate is a duplicate of CVE-2024-43369. Notes: All CVE users should reference CVE-2024-43369 instead of this candidate. This CVE was issued to a vulnerability that is dependent on CVE-2024-43369. According to rule 4.2.15 of the CVE CNA rules, "CNAs MUST NOT assign a different CVE ID to a Vulnerability that is fully interdependent with another Vulnerability. The Vulnerabilities are effectively the same single Vulnerability and MUST use one CVE ID."
CVE: CVE-2022-1443
Published: 2024-08-19
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1789. Reason: This candidate is a reservation duplicate of CVE-2024-1789. Notes: All CVE users should reference CVE-2024-1789 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-43379
Published: 2024-08-19
Description: TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, the target endpoint must be an unauthenticated GET endpoint that produces side effects. The victim must scan the maliciously crafted data and have such an endpoint targeted for the exploit to succeed. The vulnerability has been resolved in TruffleHog v3.81.9 and later versions.
CVSS Score: 3.4 (LOW)
CWE: CWE-918, CWE-918
References: https://github.com/trufflesecurity/trufflehog/commit/fe5624c[PII_REDACTED]8868cffd647b6e2cfe11443; https://github.com/trufflesecurity/trufflehog/security/advisories/GHSA-3r74-v83p-f4f4
CVE: CVE-2024-43380
Published: 2024-08-19
Description: fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The parse call could hold the thread with no end in sight. Fugit dependents that do not check (user) input length for plausibility are impacted. A fix was released in fugit 1.11.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/floraison/fugit/commit/ad2c1c9c737213d585fff0b51c927d178b2c05a5; https://github.com/floraison/fugit/issues/104; https://github.com/floraison/fugit/security/advisories/GHSA-2m96-52r3-2f3g
CVE: CVE-2024-43399
Published: 2024-08-19
Description: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerability allows an attacker to extract files to any desired location within the server running MobSF. This vulnerability is fixed in 4.0.7.
CVSS Score: 8.0 (HIGH)
CWE: CWE-23, CWE-22
References: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/cc625fe8430f3437a473e82aa2966d100a4dc883; https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-4hh3-vj32-gr6j
CVE: CVE-2024-7922
Published: 2024-08-19
Description: A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this issue is the function cgi_audio_search/cgi_create_playlist/cgi_get_album_all_tracks/cgi_get_alltracks_editlist/cgi_get_artist_all_album/cgi_get_genre_all_tracks/cgi_get_tracks_list/cgi_set_airplay_content/cgi_write_playlist of the file /cgi-bin/myMusic.cgi. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_create_playlist.md; https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_get_tracks_list.md; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE: CVE-2022-4404
Published: 2024-08-19
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-4411
Published: 2024-08-19
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-4425
Published: 2024-08-19
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-42633
Published: 2024-08-19
Description: A Command Injection vulnerability exists in the do_upgrade_post function of the httpd binary in Linksys E1500 v1.0.06.001. As a result, an authenticated attacker can execute OS commands with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/goldds96/Report/blob/main/Linksys/E1500/CI.md
CVE: CVE-2024-6348
Published: 2024-08-19
Description: Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330, CWE-330
References: https://asrg.io/security-advisories/
CVE: CVE-2024-32927
Published: 2024-08-19
Description: In sendDeviceState_1_6 of RadioExt.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://source.android.com/security/bulletin/pixel/2024-08-01
CVE: CVE-2024-32928
Published: 2024-08-19
Description: The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://support.google.com/product-documentation/answer/14771247?hl=en&ref_topic=12974021&sjid=[PII_REDACTED]942032590-NA#zippy=
CVE: CVE-2024-37099
Published: 2024-08-19
Description: Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-3-14-1-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-42657
Published: 2024-08-19
Description: An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-200
References: https://github.com/sudo-subho/CVE-2024-42657; https://www.linkedin.com/in/subhodeep-baroi-397629252/; https://x.com/sudo_subho
CVE: CVE-2024-42658
Published: 2024-08-19
Description: An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's parameter
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://github.com/sudo-subho/CVE-2024-42658; https://www.linkedin.com/in/subhodeep-baroi-397629252/; https://x.com/sudo_subho
CVE: CVE-2024-43221
Published: 2024-08-19
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetGridBuilder allows PHP Local File Inclusion.This issue affects JetGridBuilder: from n/a through 1.1.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/jetgridbuilder/wordpress-jetgridbuilder-plugin-1-1-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-43232
Published: 2024-08-19
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP OnlineSupport, Essential Plugin Timeline and History slider allows PHP Local File Inclusion.This issue affects Timeline and History slider: from n/a through 2.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/timeline-and-history-slider/wordpress-timeline-and-history-slider-plugin-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-43236
Published: 2024-08-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: from n/a through 1.9.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/wp-ecommerce-paypal/wordpress-easy-paypal-stripe-buy-now-button-plugin-1-9-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-43240
Published: 2024-08-19
Description: Improper Authentication vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-287
References: https://patchstack.com/database/Wordpress/Plugin/indeed-membership-pro/vulnerability/wordpress-indeed-ultimate-membership-pro-plugin-12-6-unauthenticated-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-43400
Published: 2024-08-19
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-96, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/27eca8423fc1ad177518077a[PII_REDACTED]68509c; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-wcg9-pgqv-xm5v; https://jira.xwiki.org/browse/XWIKI-21810
CVE: CVE-2024-43401
Published: 2024-08-19
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-269, CWE-862
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7; https://jira.xwiki.org/browse/XWIKI-20331; https://jira.xwiki.org/browse/XWIKI-21311
CVE: CVE-2024-43242
Published: 2024-08-19
Description: Deserialization of Untrusted Data vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/indeed-membership-pro/vulnerability/wordpress-indeed-ultimate-membership-pro-plugin-12-6-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-43245
Published: 2024-08-19
Description: Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/wp-jobsearch/wordpress-jobsearch-plugin-2-3-4-unauthenticated-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-43247
Published: 2024-08-19
Description: Missing Authorization vulnerability in creativeon WHMpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WHMpress: from n/a through 6.2-revision-5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/whmpress/wordpress-whmpress-plugin-6-2-revision-5-subscriber-arbitrary-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-43248
Published: 2024-08-19
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.This issue affects Bit Form Pro: from n/a through 2.6.4.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/bitformpro/wordpress-bit-form-pro-plugin-2-6-4-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-43249
Published: 2024-08-19
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.This issue affects Bit Form Pro: from n/a through 2.6.4.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/bitformpro/wordpress-bit-form-pro-plugin-2-6-4-authenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-43250
Published: 2024-08-19
Description: Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bit Form Pro: from n/a through 2.6.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-863
References: https://patchstack.com/database/vulnerability/bitformpro/wordpress-bit-form-pro-plugin-2-6-4-authenticated-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-43252
Published: 2024-08-19
Description: Deserialization of Untrusted Data vulnerability in Crew HRM Crew HRM hr-management.This issue affects Crew HRM: from n/a through <= 1.1.1.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/hr-management/vulnerability/wordpress-crew-hrm-plugin-1-1-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-43256
Published: 2024-08-19
Description: Missing Authorization vulnerability in nouthemes Leopard - WordPress offload media allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/leopard-wordpress-offload-media/wordpress-leopard-wordpress-offload-media-plugin-2-0-36-subscriber-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-43261
Published: 2024-08-19
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hamed Naderfar Compute Links allows PHP Remote File Inclusion.This issue affects Compute Links: from n/a through 1.2.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-98
References: https://patchstack.com/database/vulnerability/compute-links/wordpress-compute-links-plugin-1-2-1-remote-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-43271
Published: 2024-08-19
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themelocation Woo Products Widgets For Elementor allows PHP Local File Inclusion.This issue affects Woo Products Widgets For Elementor: from n/a through 2.0.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/woo-products-widgets-for-elementor/wordpress-widgets-for-woocommerce-products-on-elementor-plugin-2-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-43272
Published: 2024-08-19
Description: Missing Authentication for Critical Function vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Icegram: from n/a through 3.1.24.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-engage-plugin-3-1-24-unauthenticated-unpublished-campaign-viewer-vulnerability?_s_id=cve