deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-51627
Published: 2024-05-03
Description: D-Link DCS-8300LHV2 ONVIF Duration Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the parsing of Duration XML elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21321.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370; https://www.zerodayinitiative.com/advisories/ZDI-24-047/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370
CVE: CVE-2023-51628
Published: 2024-05-03
Description: D-Link DCS-8300LHV2 ONVIF SetHostName Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the handling of the SetHostName ONVIF call. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21322.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370; https://www.zerodayinitiative.com/advisories/ZDI-24-048/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370
CVE: CVE-2023-51629
Published: 2024-05-03
Description: D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the ONVIF API. The issue results from the use of a hardcoded PIN. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21492.
CVSS Score: 8.8 (HIGH)
CWE: CWE-259, CWE-798
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370; https://www.zerodayinitiative.com/advisories/ZDI-24-049/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370
CVE: CVE-2023-51633
Published: 2024-05-03
Description: Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. User interaction is required to exploit this vulnerability.

The specific flaw exists within the processing of the sysName OID in SNMP. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-20731.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.zerodayinitiative.com/advisories/ZDI-24-416/; https://www.zerodayinitiative.com/advisories/ZDI-24-416/
CVE: CVE-2024-34408
Published: 2024-05-03
Description: Tencent libpag through 4.3.51 has an integer overflow in DecodeStream::checkEndOfFile() in codec/utils/DecodeStream.cpp via a crafted PAG (Portable Animated Graphics) file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-122
References: https://github.com/Tencent/libpag/issues/2230; https://github.com/Tencent/libpag/pull/2243; https://github.com/Tencent/libpag/issues/2230
CVE: CVE-2024-3637
Published: 2024-05-03
Description: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/33f6fea6-c784-40ae-a548-55d41618752d/; https://wpscan.com/vulnerability/33f6fea6-c784-40ae-a548-55d41618752d/
CVE: CVE-2024-3692
Published: 2024-05-03
Description: The Gutenverse  WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6f100f85-3a76-44be-8092-06eb8595b0c9/; https://wpscan.com/vulnerability/6f100f85-3a76-44be-8092-06eb8595b0c9/
CVE: CVE-2024-3703
Published: 2024-05-03
Description: The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3242b820-1da0-41ba-9f35-7be5dbc6d4b0/; https://wpscan.com/vulnerability/3242b820-1da0-41ba-9f35-7be5dbc6d4b0/
CVE: CVE-2024-4439
Published: 2024-05-03
Description: WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
CVSS Score: 7.2 (HIGH)
CWE: CWE-80
References: https://core.trac.wordpress.org/changeset/57951/branches/6.4/src/wp-includes/blocks/avatar.php; https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=57950%40%2F&new=57950%40%2F&sfp_email=&sfph_mail=#file3; https://wordpress.org/news/2024/04/wordpress-6-5-2-maintenance-and-security-release/
CVE: CVE-2024-33928
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon allows Reflected XSS.This issue affects CodeBard's Patron Button and Widgets for Patreon: from n/a through 2.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/patron-button-and-widgets-by-codebard/wordpress-codebard-s-patron-button-and-widgets-for-patreon-plugin-2-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/patron-button-and-widgets-by-codebard/wordpress-codebard-s-patron-button-and-widgets-for-patreon-plugin-2-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33932
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vinod Dalvi Login Logout Register Menu allows Stored XSS.This issue affects Login Logout Register Menu: from n/a through 2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/login-logout-register-menu/wordpress-login-logout-register-menu-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/login-logout-register-menu/wordpress-login-logout-register-menu-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33934
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey Lampert Mini Loops allows Stored XSS.This issue affects Mini Loops: from n/a through 1.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mini-loops/wordpress-mini-loops-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mini-loops/wordpress-mini-loops-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33935
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB MailCrypt allows Stored XSS.This issue affects PB MailCrypt: from n/a through 3.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pb-mailcrypt-antispam-email-encryption/wordpress-pb-mailcrypt-plugin-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pb-mailcrypt-antispam-email-encryption/wordpress-pb-mailcrypt-plugin-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33936
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Print-O-Matic allows Stored XSS.This issue affects Print-O-Matic: from n/a through 2.1.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/print-o-matic/wordpress-print-o-matic-plugin-2-1-10-auth-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/print-o-matic/wordpress-print-o-matic-plugin-2-1-10-auth-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33940
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashan Jay EventON allows Stored XSS.This issue affects EventON: from n/a through 2.2.14.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/eventon-lite/wordpress-eventon-plugin-2-2-14-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/eventon-lite/wordpress-eventon-plugin-2-2-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33943
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyKite Ultimate Under Construction allows Stored XSS.This issue affects Ultimate Under Construction: from n/a through 1.9.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-under-construction/wordpress-ultimate-under-construction-plugin-1-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-under-construction/wordpress-ultimate-under-construction-plugin-1-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33945
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solverwp.Com Eleblog – Elementor Blog And Magazine Addons allows Stored XSS.This issue affects Eleblog – Elementor Blog And Magazine Addons: from n/a through 1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ele-blog/wordpress-eleblog-elementor-blog-and-magazine-addons-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ele-blog/wordpress-eleblog-elementor-blog-and-magazine-addons-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33946
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPify s.R.O. WPify Woo Czech allows Reflected XSS.This issue affects WPify Woo Czech: from n/a through 4.0.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpify-woo/wordpress-wpify-woo-czech-plugin-4-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpify-woo/wordpress-wpify-woo-czech-plugin-4-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33947
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This issue affects RegistrationMagic: from n/a through 5.3.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-3-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-3-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25457
Published: 2024-05-03
Description: Missing Authorization vulnerability in Richteam Slider Carousel – Responsive Image Slider.This issue affects Slider Carousel – Responsive Image Slider: from n/a through 1.5.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/slider-images/wordpress-slider-carousel-responsive-image-slider-plugin-1-5-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slider-images/wordpress-slider-carousel-responsive-image-slider-plugin-1-5-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-44472
Published: 2024-05-03
Description: Missing Authorization vulnerability in ThemeFuse Unyson.This issue affects Unyson: from n/a through 2.7.28.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/unyson/wordpress-unyson-plugin-2-7-28-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/unyson/wordpress-unyson-plugin-2-7-28-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-24710
Published: 2024-05-03
Description: Missing Authorization vulnerability in SlickRemix Feed Them Social.This issue affects Feed Them Social: from n/a through 4.2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/feed-them-social/wordpress-feed-them-social-plugin-4-2-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/feed-them-social/wordpress-feed-them-social-plugin-4-2-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-28072
Published: 2024-05-03
Description: A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly. 







CVSS Score: 5.7 (MEDIUM)
CWE: CWE-532
References: https://solarwindscore.my.site.com/SuccessCenter/s/article/Serv-U-15-4-2-Hotfix-1-Release-Notes?language=en_US; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28072; https://solarwindscore.my.site.com/SuccessCenter/s/article/Serv-U-15-4-2-Hotfix-1-Release-Notes?language=en_US
CVE: CVE-2024-32810
Published: 2024-05-03
Description: Missing Authorization vulnerability in ShortPixel ShortPixel Critical CSS.This issue affects ShortPixel Critical CSS: from n/a through 1.0.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/shortpixel-critical-css/wordpress-shortpixel-critical-css-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shortpixel-critical-css/wordpress-shortpixel-critical-css-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32831
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lorna Timbah (webgrrrl) Accessibility Widget allows Stored XSS.This issue affects Accessibility Widget: from n/a through 2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/accessibility-widget/wordpress-accessibility-widget-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/accessibility-widget/wordpress-accessibility-widget-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33916
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cpo-companion/wordpress-cpo-companion-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cpo-companion/wordpress-cpo-companion-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33918
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maxim K AJAX Login and Registration modal popup + inline form allows Stored XSS.This issue affects AJAX Login and Registration modal popup + inline form: from n/a through 2.23.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ajax-login-and-registration-modal-popup/wordpress-ajax-login-and-registration-modal-popup-inline-form-plugin-2-23-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ajax-login-and-registration-modal-popup/wordpress-ajax-login-and-registration-modal-popup-inline-form-plugin-2-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33924
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Organic IDX plugin allows Reflected XSS.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/real-estate-listing-realtyna-wpl/wordpress-realtyna-organic-idx-plugin-wpl-real-estate-plugin-4-14-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/real-estate-listing-realtyna-wpl/wordpress-realtyna-organic-idx-plugin-wpl-real-estate-plugin-4-14-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33926
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Karl Kiesinger GWP-Histats allows Stored XSS.This issue affects GWP-Histats: from n/a through 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gwp-histats/wordpress-gwp-histats-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gwp-histats/wordpress-gwp-histats-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33927
Published: 2024-05-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team GIPHY Giphypress allows Stored XSS.This issue affects Giphypress: from n/a through 1.6.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/giphypress/wordpress-giphypress-plugin-1-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/giphypress/wordpress-giphypress-plugin-1-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33941
Published: 2024-05-03
Description: Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ipanorama-360-virtual-tour-builder-lite/wordpress-ipanorama-360-plugin-1-8-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ipanorama-360-virtual-tour-builder-lite/wordpress-ipanorama-360-plugin-1-8-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-35701
Published: 2024-05-03
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Hive.

The vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver (client) is running. The malicious user must have sufficient permissions to specify/edit JDBC URL(s) in an endpoint relying on the Hive JDBC driver and the JDBC client process must run under a privileged user to fully exploit the vulnerability. 

The attacker can setup a malicious HTTP server and specify a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with customized payload that can trigger the execution of certain commands in the JDBC client.This issue affects Apache Hive: from 4.0.0-alpha-1 before 4.0.0.

Users are recommended to upgrade to version 4.0.0, which fixes the issue.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/05/03/3; https://lists.apache.org/thread/7zcv6l63spl4r66xwz5jv9rtrg2opx81; http://www.openwall.com/lists/oss-security/2024/05/03/3
CVE: CVE-2024-23912
Published: 2024-05-03
Description: Out-of-bounds Read vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When MC_Open_File() function is used to read a malformed DICOM data, it might result in over-reading memory buffer and could cause memory access violation.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23912; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23912
CVE: CVE-2024-23913
Published: 2024-05-03
Description: Use of Out-of-range Pointer Offset vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When deprecated MC_XML_To_Message() function is used to read a malformed DICOM XML file, it might result in memory access violation.
CVSS Score: 4.0 (MEDIUM)
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23913; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23913
CVE: CVE-2024-23914
Published: 2024-05-03
Description: Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When MC_Open_Association() function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it might result in an unhandled exception.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-134
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23914; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23914
CVE: CVE-2024-33914
Published: 2024-05-03
Description: Missing Authorization vulnerability in Exclusive Addons Exclusive Addons Elementor.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/exclusive-addons-for-elementor/wordpress-exclusive-addons-for-elementor-plugin-2-6-9-1-broken-access-control-on-post-duplication-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/exclusive-addons-for-elementor/wordpress-exclusive-addons-for-elementor-plugin-2-6-9-1-broken-access-control-on-post-duplication-vulnerability?_s_id=cve