deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-31993
Published: 2024-04-19
Description: Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the scrape_image function will retrieve an image based on a user-provided URL, however the provided URL is not validated to point to an external location and does not have any enforced rate limiting. The response from the Mealie server will also vary depending on whether or not the target file is an image, is not an image, or does not exist. Additionally, when a file is retrieved the file may remain stored on Mealie’s file system as original.jpg under the UUID of the recipe it was requested for. If the attacker has access to an admin account (e.g. the default changeme@example.com), this file can then be retrieved. Note that if Mealie is running in a development setting this could be leveraged by an attacker to retrieve any file that the Mealie server had downloaded in this fashion without the need for administrator access. This vulnerability is fixed in 1.4.0.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/mealie-recipes/mealie/blob/ee121a12f8db33ecb4db5f8582f7ea9788d019e4/mealie/services/recipe/recipe_data_service.py#L107; https://github.com/mealie-recipes/mealie/commit/2a3463b7466bc297aede50046da9550d919ec56f; https://github.com/mealie-recipes/mealie/pull/3368
CVE: CVE-2024-32391
Published: 2024-04-19
Description: Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/magicblack/maccms10/issues/1133; https://github.com/magicblack/maccms10/issues/1133
CVE: CVE-2024-32392
Published: 2024-04-19
Description: Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/Hebing123/cve/issues/33; https://github.com/Hebing123/cve/issues/33
CVE: CVE-2024-4017
Published: 2024-04-19
Description: Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (filesystem modules) allows DLL Side-Loading.This issue affects U-Series Appliance: from 3.4 before 4.0.3.


CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.beyondtrust.com/docs/release-notes/u-series-appliance/bt-appliance-u-series-software-4-0-3.htm; https://www.beyondtrust.com/docs/release-notes/u-series-appliance/bt-appliance-u-series-software-4-0-3.htm
CVE: CVE-2024-4018
Published: 2024-04-19
Description: Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (local appliance api modules) allows Privilege Escalation.This issue affects U-Series Appliance: from 3.4 before 4.0.3.


CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.beyondtrust.com/docs/release-notes/u-series-appliance/bt-appliance-u-series-software-4-0-3.htm; https://www.beyondtrust.com/docs/release-notes/u-series-appliance/bt-appliance-u-series-software-4-0-3.htm
CVE: CVE-2024-1480
Published: 2024-04-19
Description: Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-257
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-109-01; https://www.dragos.com/advisory/unitronics-vision-standard/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-109-01
CVE: CVE-2024-31994
Published: 2024-04-19
Description: Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will attempt to retrieve this file in whole. If it can be retrieved, it may be stored on the file system in whole (leading to possible disk consumption), however the more likely scenario given resource limitations is that the container will OOM during file retrieval if the target file size is greater than the allocated memory of the container. At best this can be used to force the container to infinitely restart due to OOM (if so configured in `docker-compose.yml), or at worst this can be used to force the Mealie container to crash and remain offline. In the event that the file can be retrieved, the lack of rate limiting on this endpoint also permits an attacker to generate ongoing requests to any target of their choice, potentially contributing to an external-facing DoS attack. This vulnerability is fixed in 1.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/mealie-recipes/mealie/blob/ee121a12f8db33ecb4db5f8582f7ea9788d019e4/mealie/services/recipe/recipe_data_service.py#L107; https://github.com/mealie-recipes/mealie/commit/2a3463b7466bc297aede50046da9550d919ec56f; https://github.com/mealie-recipes/mealie/pull/3368
CVE: CVE-2024-1057
Published: 2024-04-20
Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishsuite_button' shortcode in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attributes like 'button_class'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3044764/woolentor-addons/tags/2.8.2/includes/modules/wishlist/includes/templates/wishsuite-button-add.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d8212d-7e72-487d-a4e8-0582fa72f602?source=cve; https://plugins.trac.wordpress.org/changeset/3044764/woolentor-addons/tags/2.8.2/includes/modules/wishlist/includes/templates/wishsuite-button-add.php
CVE: CVE-2024-1730
Published: 2024-04-20
Description: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via urls in link fields, images from URLs, and html tags used in widgets in all versions up to, and including, 3.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3072100%40bdthemes-prime-slider-lite&new=3072100%40bdthemes-prime-slider-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a2ed81-254e-460c-b3a4-0cb38e089142?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3072100%40bdthemes-prime-slider-lite&new=3072100%40bdthemes-prime-slider-lite&sfp_email=&sfph_mail=
CVE: CVE-2024-4014
Published: 2024-04-20
Description: The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3072795/hcaptcha-for-forms-and-more/tags/4.0.1/src/php/CF7/CF7.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce70e87-6dee-4d4a-b2fc-93fd4d50957d?source=cve; https://plugins.trac.wordpress.org/changeset/3072795/hcaptcha-for-forms-and-more/tags/4.0.1/src/php/CF7/CF7.php
CVE: CVE-2024-4019
Published: 2024-04-20
Description: A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/scausoft/cve/blob/main/rce.md; https://vuldb.com/?ctiid.261666; https://vuldb.com/?id.261666
CVE: CVE-2024-4020
Published: 2024-04-20
Description: A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument entrys leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://palm-vertebra-fe9.notion.site/fromAddressNat_entrys-b04d5356e5f04e30b37cb9037b94e1b2; https://vuldb.com/?ctiid.261671; https://vuldb.com/?id.261671
CVE: CVE-2024-4021
Published: 2024-04-21
Description: A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /ndmComponents.js of the component Configuration Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261673 was assigned to this vulnerability. NOTE: The vendor is aware of this issue and plans to fix it by the end of 2024.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://netsecfish.notion.site/Information-Disclosure-in-Keenetic-Router-d4a12a499cef4acf80e191bdaf20c151?pvs=4; https://vuldb.com/?ctiid.261673; https://vuldb.com/?id.261673
CVE: CVE-2024-4022
Published: 2024-04-21
Description: A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /version.js of the component Version Data Handler. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261674 is the identifier assigned to this vulnerability. NOTE: The vendor is aware of this issue and plans to fix it by the end of 2024.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://netsecfish.notion.site/Information-Disclosure-in-Keenetic-Router-d4a12a499cef4acf80e191bdaf20c151?pvs=4; https://vuldb.com/?ctiid.261674; https://vuldb.com/?id.261674
CVE: CVE-2024-29217
Published: 2024-04-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.

XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack.
Users are recommended to upgrade to version [1.3.0], which fixes the issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2024/04/19/1; https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x; http://www.openwall.com/lists/oss-security/2024/04/19/1
CVE: CVE-2024-29733
Published: 2024-04-21
Description: Improper Certificate Validation vulnerability in Apache Airflow FTP Provider.

The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly.

This issue affects Apache Airflow FTP Provider: before 3.7.0.

Users are recommended to upgrade to version 3.7.0, which fixes the issue.
CVSS Score: 2.7 (LOW)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2024/04/19/3; https://docs.python.org/3/library/ssl.html#best-defaults; https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280
CVE: CVE-2015-10132
Published: 2024-04-21
Description: A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin.php. The manipulation of the argument Spreadplugin leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.8.6.6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-261676.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/wp-spreadplugin/commit/a9b9afc641854698e80aa5dd9ababfc8e0e57d69; https://github.com/wp-plugins/wp-spreadplugin/releases/tag/3.8.6.6; https://vuldb.com/?ctiid.261676
CVE: CVE-2024-28722
Published: 2024-04-22
Description: Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to the /CMD0/xml_modes.xml endpoint
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: http://innovaphone.com; http://mypbx.com; https://wiki.innovaphone.com/index.php?title=Reference14r1:Release_Notes_Firmware#159317_-_Advanced_UI:_Prevent_XSL_injection
CVE: CVE-2024-30799
Published: 2024-04-22
Description: An issue in PX4 Autopilot v1.14 and before allows a remote attacker to execute arbitrary code and cause a denial of service via the Breach Return Point function.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-120
References: https://github.com/PX4/PX4-Autopilot/issues/22428; https://github.com/PX4/PX4-Autopilot/issues/22428
CVE: CVE-2024-32418
Published: 2024-04-22
Description: An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269, CWE-284
References: https://github.com/PWB003/cms/blob/main/1.md; https://github.com/PWB003/cms/blob/main/1.md
CVE: CVE-2018-25101
Published: 2024-04-22
Description: A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108. This issue affects some unknown processing of the file /cgi-bin/koha/opac-MARCdetail.pl. The manipulation of the argument biblionumber with the input 2"><TEST> leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 950fc8e[PII_REDACTED]9066b33e389a47fb0a9782. It is recommended to upgrade the affected component. The identifier VDB-261677 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/l2c2technologies/Koha/commit/950fc8e[PII_REDACTED]9066b33e389a47fb0a9782; https://vuldb.com/?ctiid.261677; https://vuldb.com/?id.261677
CVE: CVE-2023-7252
Published: 2024-04-22
Description: The Tickera  WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/c452c5da-05a6-4a14-994d-e5049996d496/; https://wpscan.com/vulnerability/c452c5da-05a6-4a14-994d-e5049996d496/
CVE: CVE-2024-32690
Published: 2024-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood RSS Feed Widget allows Stored XSS.This issue affects RSS Feed Widget: from n/a through 2.9.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/rss-feed-widget/wordpress-rss-feed-widget-plugin-2-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rss-feed-widget/wordpress-rss-feed-widget-plugin-2-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32693
Published: 2024-04-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in ValvePress Automatic.This issue affects Automatic: from n/a before 3.93.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-93-0-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-93-0-multiple-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-32694
Published: 2024-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Reflected XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.62.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/real3d-flipbook-lite/wordpress-3d-flipbook-pdf-viewer-pdf-embedder-plugin-3-62-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/real3d-flipbook-lite/wordpress-3d-flipbook-pdf-viewer-pdf-embedder-plugin-3-62-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32695
Published: 2024-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Gasi Language Switcher for Transposh allows Reflected XSS.This issue affects Language Switcher for Transposh: from n/a through 1.5.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/language-switcher-for-transposh/wordpress-language-switcher-for-transposh-plugin-1-5-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/language-switcher-for-transposh/wordpress-language-switcher-for-transposh-plugin-1-5-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32696
Published: 2024-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Infographic Maker – iList allows Stored XSS.This issue affects Infographic Maker – iList: from n/a through 4.6.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/infographic-and-list-builder-ilist/wordpress-ai-infographic-maker-openai-plugin-4-6-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/infographic-and-list-builder-ilist/wordpress-ai-infographic-maker-openai-plugin-4-6-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32697
Published: 2024-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso allows Stored XSS.This issue affects HelloAsso: from n/a through 1.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/helloasso/wordpress-helloasso-plugin-1-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/helloasso/wordpress-helloasso-plugin-1-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32698
Published: 2024-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a through <= 3.10.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-10-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-10-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32681
Published: 2024-04-22
Description: Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/bdthemes-prime-slider-lite/wordpress-prime-slider-plugin-3-13-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bdthemes-prime-slider-lite/wordpress-prime-slider-plugin-3-13-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32682
Published: 2024-04-22
Description: Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/bdthemes-prime-slider-lite/wordpress-prime-slider-plugin-3-13-2-broken-access-control-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/bdthemes-prime-slider-lite/wordpress-prime-slider-plugin-3-13-2-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2024-32684
Published: 2024-04-22
Description: Missing Authorization vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-2-5-broken-access-control-on-review-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-2-5-broken-access-control-on-review-vulnerability?_s_id=cve
CVE: CVE-2024-32687
Published: 2024-04-22
Description: Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woo-bought-together/wordpress-wpc-frequently-bought-together-for-woocommerce-plugin-7-0-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-bought-together/wordpress-wpc-frequently-bought-together-for-woocommerce-plugin-7-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32688
Published: 2024-04-22
Description: Missing Authorization vulnerability in Long Watch Studio MyRewards.This issue affects MyRewards: from n/a through 5.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woorewards/wordpress-myrewards-plugin-5-3-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woorewards/wordpress-myrewards-plugin-5-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32691
Published: 2024-04-22
Description: Missing Authorization vulnerability in realmag777 Active Products Tables for WooCommerce.This issue affects Active Products Tables for WooCommerce: from n/a through 1.0.6.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/profit-products-tables-for-woocommerce/wordpress-active-products-tables-for-woocommerce-plugin-1-0-6-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profit-products-tables-for-woocommerce/wordpress-active-products-tables-for-woocommerce-plugin-1-0-6-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-22807
Published: 2024-04-22
Description: An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing the machine to lose network connectivity and suffer from firmware corruption.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://gist.github.com/VcuCyber/51075894d1728db07fc2df286c003df9; https://gist.github.com/VcuCyber/51075894d1728db07fc2df286c003df9