deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-23354
Published: 2024-05-06
Description: Memory corruption when the IOCTL call is interrupted by a signal.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2024-bulletin.html
CVE: CVE-2024-32972
Published: 2024-05-06
Description: go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version `1.13.15` and onwards.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/ethereum/go-ethereum/compare/v1.13.14...v1.13.15; https://github.com/ethereum/go-ethereum/security/advisories/GHSA-4xc9-8hmq-j652; https://github.com/ethereum/go-ethereum/compare/v1.13.14...v1.13.15
CVE: CVE-2024-32982
Published: 2024-05-06
Description: Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22
References: https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70; https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b; https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf
CVE: CVE-2024-33110
Published: 2024-05-06
Description: D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Permission Bypass via the getcfg.php component.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md; https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md
CVE: CVE-2024-33111
Published: 2024-05-06
Description: D-Link DIR-845L router <=v1.01KRb03 is vulnerable to Cross Site Scripting (XSS) via /htdocs/webinc/js/bsc_sms_inbox.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md; https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md
CVE: CVE-2024-33112
Published: 2024-05-06
Description: D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-77
References: https://github.com/yj94/Yj_learning/blob/b597925953d8bbb286a63f0019bb547c1617cb61/Week16/D-LINK-POC.md; https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md; https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md
CVE: CVE-2024-33113
Published: 2024-05-06
Description: D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77, CWE-79
References: https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md; https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md
CVE: CVE-2024-33294
Published: 2024-05-06
Description: An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable in the student_edit_photo.php component.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://github.com/CveSecLook/cve/issues/16; https://github.com/CveSecLook/cve/issues/16
CVE: CVE-2024-34064
Published: 2024-05-06
Description: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb; https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC/
CVE: CVE-2024-34069
Published: 2024-05-06
Description: Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692; https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR/
CVE: CVE-2024-34078
Published: 2024-05-06
Description: html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550; https://github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3; https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550
CVE: CVE-2024-34249
Published: 2024-05-06
Description: wasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function "DeallocateSlot" in wasm3/source/m3_compile.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://github.com/wasm3/wasm3/issues/485; https://github.com/wasm3/wasm3/issues/485
CVE: CVE-2024-34252
Published: 2024-05-06
Description: wasm3 v0.5.0 was discovered to contain a global buffer overflow which leads to segmentation fault via the function "PreserveRegisterIfOccupied" in wasm3/source/m3_compile.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/wasm3/wasm3/issues/483; https://github.com/wasm3/wasm3/issues/483
CVE: CVE-2024-34466
Published: 2024-05-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-34467. Reason: This candidate is a reservation duplicate of CVE-2024-34467. Notes: All CVE users should reference CVE-2024-34467 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-34470
Published: 2024-05-06
Description: An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server.
CVSS Score: 8.6 (HIGH)
CWE: CWE-29
References: https://github.com/osvaldotenorio/CVE-2024-34470; https://github.com/osvaldotenorio/CVE-2024-34470
CVE: CVE-2024-34472
Published: 2024-05-06
Description: An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerability exists in the mliRealtimeEmails.php file. The ordemGrid parameter in a POST request to /mailinspector/mliRealtimeEmails.php does not properly sanitize input, allowing an authenticated attacker to execute arbitrary SQL commands, leading to the potential disclosure of the entire application database.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/osvaldotenorio/CVE-2024-34472; https://github.com/osvaldotenorio/CVE-2024-34472
CVE: CVE-2024-26312
Published: 2024-05-06
Description: Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://archerirm.com; https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963; https://archerirm.com
CVE: CVE-2024-34089
Published: 2024-05-06
Description: An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 P3 (6.14.0.3) is also a fixed release.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://archerirm.com; https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963; https://archerirm.com
CVE: CVE-2024-34090
Published: 2024-05-06
Description: An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. The login banner in the Archer Control Panel (ACP) did not previously escape content appropriately. 6.14 P3 (6.14.0.3) is also a fixed release.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://archerirm.com; https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963; https://archerirm.com
CVE: CVE-2024-34091
Published: 2024-05-06
Description: An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed in the background of the application and renders content inaccessible. 6.14 P3 (6.14.0.3) is also a fixed release.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://archerirm.com; https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963; https://archerirm.com
CVE: CVE-2024-34092
Published: 2024-05-06
Description: An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0.3) is also a fixed release.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613, CWE-613
References: https://archerirm.com; https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963; https://archerirm.com
CVE: CVE-2024-34093
Published: 2024-05-06
Description: An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. An unauthenticated attacker could potentially bypass intended whitelisting when X-Forwarded-For header is enabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://archerirm.com; https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963; https://archerirm.com
CVE: CVE-2024-34246
Published: 2024-05-06
Description: wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platforms/app/main.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/wasm3/wasm3/issues/484; https://github.com/wasm3/wasm3/issues/484
CVE: CVE-2024-34250
Published: 2024-05-06
Description: A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the "wasm_loader_check_br" function in core/iwasm/interpreter/wasm_loader.c.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-122
References: https://github.com/bytecodealliance/wasm-micro-runtime/issues/3346; https://github.com/bytecodealliance/wasm-micro-runtime/issues/3346
CVE: CVE-2024-34251
Published: 2024-05-06
Description: An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the "block_type_get_arity" function in core/iwasm/interpreter/wasm.h.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/bytecodealliance/wasm-micro-runtime/issues/3347; https://github.com/bytecodealliance/wasm-micro-runtime/issues/3347
CVE: CVE-2024-34471
Published: 2024-05-06
Description: An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exists in the mliRealtimeEmails.php file. The filename parameter in the export HTML functionality does not properly validate the file location, allowing an attacker to read and delete arbitrary files on the server. This was observed when the mliRealtimeEmails.php file itself was read and subsequently deleted, resulting in a 404 error for the file and disruption of email information loading.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/osvaldotenorio/CVE-2024-34471; https://github.com/osvaldotenorio/CVE-2024-34471
CVE: CVE-2024-32807
Published: 2024-05-06
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brevo Sendinblue for WooCommerce allows Relative Path Traversal, Manipulating Web Input to File System Calls.This issue affects Sendinblue for WooCommerce: from n/a through 4.0.17.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/woocommerce-sendinblue-newsletter-subscription/wordpress-brevo-for-woocommerce-plugin-4-0-17-arbitrary-file-download-and-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-sendinblue-newsletter-subscription/wordpress-brevo-for-woocommerce-plugin-4-0-17-arbitrary-file-download-and-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-33403
Published: 2024-05-06
Description: A SQL injection vulnerability in /model/get_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the event_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2010.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%202.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2010.pdf
CVE: CVE-2024-33404
Published: 2024-05-06
Description: A SQL injection vulnerability in /model/add_student_first_payment.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the index parameter.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%203.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%203.pdf
CVE: CVE-2024-33405
Published: 2024-05-06
Description: SQL injection vulnerability in add_friends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the friend_index parameter.
CVSS Score: 8.6 (HIGH)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%204.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%207.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%204.pdf
CVE: CVE-2024-33406
Published: 2024-05-06
Description: SQL injection vulnerability in /model/delete_student_grade_subject.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the index parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%205.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%207.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%205.pdf
CVE: CVE-2024-33407
Published: 2024-05-06
Description: SQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%206.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%206.pdf
CVE: CVE-2024-33408
Published: 2024-05-06
Description: A SQL injection vulnerability in /model/get_classroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%207.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%209.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%207.pdf
CVE: CVE-2024-33409
Published: 2024-05-06
Description: SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the name parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%201.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%208.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%201.pdf
CVE: CVE-2024-33410
Published: 2024-05-06
Description: SQL injection vulnerability in /model/delete_range_grade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%205.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%209.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%205.pdf
CVE: CVE-2024-33411
Published: 2024-05-06
Description: A SQL injection vulnerability in /model/get_admin_profile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the my_index parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2010.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%208.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2010.pdf
CVE: CVE-2024-34382
Published: 2024-05-06
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-18-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-18-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-34383
Published: 2024-05-06
Description: Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/wp-seopress/wordpress-seopress-plugin-7-6-1-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-seopress/wordpress-seopress-plugin-7-6-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-34388
Published: 2024-05-06
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/gdpr-compliance/wordpress-gdpr-compliance-plugin-1-2-5-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gdpr-compliance/wordpress-gdpr-compliance-plugin-1-2-5-sensitive-data-exposure-vulnerability?_s_id=cve