deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-32937
Published: 2024-07-03
Description: An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1978; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1978; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1978
CVE: CVE-2024-37726
Published: 2024-07-03
Description: Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export System Info function in MSI.CentralServer.exe
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-269
References: https://github.com/carsonchan12345/CVE-2024-37726-MSI-Center-Local-Privilege-Escalation; https://github.com/carsonchan12345/CVE-2024-37726-MSI-Center-Local-Privilege-Escalation
CVE: CVE-2024-6471
Published: 2024-07-03
Description: A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management 1.0. This affects an unknown part of the file sms_setting.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270279.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/ENTICE1208/article/details/140141934; https://vuldb.com/?ctiid.270279; https://vuldb.com/?id.270279
CVE: CVE-2024-39220
Published: 2024-07-03
Description: BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-256
References: https://bas-ip.com/bsa-000001; https://github.com/DrieVlad/BAS-IP-vulnerabilities; https://bas-ip.com/bsa-000001
CVE: CVE-2024-39223
Published: 2024-07-03
Description: An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a; https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229; https://github.com/ginuerzh/gost/issues/1034
CVE: CVE-2024-6052
Published: 2024-07-03
Description: Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HTML elements
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://checkmk.com/werk/17010; https://checkmk.com/werk/17010
CVE: CVE-2024-6126
Published: 2024-07-03
Description: A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.
CVSS Score: 3.2 (LOW)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2024:9325; https://access.redhat.com/security/cve/CVE-2024-6126; https://bugzilla.redhat.com/show_bug.cgi?id=2292897
CVE: CVE-2024-39248
Published: 2024-07-03
Description: A cross-site scripting (XSS) vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field at /admin.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jasonthename/CVE-2024-39248; https://packetstormsecurity.com/files/179219; https://github.com/jasonthename/CVE-2024-39248
CVE: CVE-2024-39844
Published: 2024-07-03
Description: In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/07/03/9; https://github.com/znc/znc/releases/tag/znc-1.9.1; https://wiki.znc.in/Category:ChangeLog
CVE: CVE-2024-3332
Published: 2024-07-03
Description: A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jmr9-xw2v-5vf4; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jmr9-xw2v-5vf4
CVE: CVE-2023-52168
Published: 2024-07-03
Description: The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512*i-2, for i=9, i=10, i=11, etc.
CVSS Score: 8.4 (HIGH)
CWE: CWE-122
References: http://www.openwall.com/lists/oss-security/2024/07/03/10; https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/; https://sourceforge.net/p/sevenzip/bugs/2402/
CVE: CVE-2023-52169
Published: 2024-07-03
Description: The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2024/07/03/10; https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/; https://sourceforge.net/p/sevenzip/bugs/2402/
CVE: CVE-2024-29506
Published: 2024-07-03
Description: Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=707510; https://git.ghostscript.com/?p=ghostpdl.git%3Bh=77dc7f699beba606937b7ea23b50cf5974fa64b1; https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE: CVE-2024-29508
Published: 2024-07-03
Description: Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.
CVSS Score: 3.3 (LOW)
CWE: CWE-122
References: https://bugs.ghostscript.com/show_bug.cgi?id=707510; https://git.ghostscript.com/?p=ghostpdl.git%3Bh=ff1013a0ab485b66783b70145e342a82c670906a; https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE: CVE-2024-29509
Published: 2024-07-03
Description: Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugs.ghostscript.com/show_bug.cgi?id=707510; https://git.ghostscript.com/?p=ghostpdl.git%3Bh=917b3a71fb[PII_REDACTED]4631199ad98210d6c2fb; https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE: CVE-2024-31223
Published: 2024-07-03
Description: Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://github.com/ethyca/fides/commit/[PII_REDACTED]f18a5aacff452c590ac9a1b56d7097; https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg; https://github.com/ethyca/fides/commit/[PII_REDACTED]f18a5aacff452c590ac9a1b56d7097
CVE: CVE-2024-35227
Published: 2024-07-03
Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known workarounds available for this vulnerability. 
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/discourse/discourse/commit/10afe5fcf1ebf2e49cb80716d5e62e184c53519b; https://github.com/discourse/discourse/commit/6ce5673d2c1a511b602e1b2ade6cdc898d14ab36; https://github.com/discourse/discourse/security/advisories/GHSA-664f-xwjw-752c
CVE: CVE-2024-5821
Published: 2024-07-03
Description: The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names. When a user requests the content of a file with a misspelled name, the agent attempts to correct the command and inadvertently reveals the content of the intended file, such as /etc/passwd. This can lead to unauthorized access to sensitive information and potential server compromise.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22
References: https://huntr.com/bounties/6b729046-b9e1-4fa2-a0c5-603745a6db6b; https://huntr.com/bounties/6b729046-b9e1-4fa2-a0c5-603745a6db6b
CVE: CVE-2024-5887
Published: 2024-07-03
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-29507
Published: 2024-07-03
Description: Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=707510; https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=7745dbe24514; https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE: CVE-2024-29510
Published: 2024-07-03
Description: Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-693
References: https://bugs.ghostscript.com/show_bug.cgi?id=707662; https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/; https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE: CVE-2024-29511
Published: 2024-07-03
Description: Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd.
CVSS Score: 7.5 (HIGH)
CWE: CWE-489
References: https://bugs.ghostscript.com/show_bug.cgi?id=707510; https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=3d4cfdc1a44; https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE: CVE-2024-33869
Published: 2024-07-03
Description: An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://bugs.ghostscript.com/show_bug.cgi?id=707691; https://www.openwall.com/lists/oss-security/2024/06/28/2; https://bugs.ghostscript.com/show_bug.cgi?id=707691
CVE: CVE-2024-33870
Published: 2024-07-03
Description: An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://bugs.ghostscript.com/show_bug.cgi?id=707686; https://www.openwall.com/lists/oss-security/2024/06/28/2; https://bugs.ghostscript.com/show_bug.cgi?id=707686
CVE: CVE-2024-33871
Published: 2024-07-03
Description: An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://bugs.ghostscript.com/show_bug.cgi?id=707754; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=[PII_REDACTED]bb52cc23964f0aa2aec1b1c82b5908; https://www.openwall.com/lists/oss-security/2024/06/28/2
CVE: CVE-2024-35234
Published: 2024-07-03
Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd; https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2; https://github.com/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58
CVE: CVE-2024-36113
Published: 2024-07-03
Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch, a rogue staff user could suspend other staff users preventing them from logging in to the site. The issue is patched in version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch. No known workarounds are available.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/discourse/discourse/commit/8470546f59b04bd82ce9b711406758fd5439936d; https://github.com/discourse/discourse/commit/9c4a5f39d3ad351410a1453ff5e5f7ffce17cd7e; https://github.com/discourse/discourse/security/advisories/GHSA-3w3f-76p7-3c4g
CVE: CVE-2024-6488
Published: 2024-07-03
Description: Rejected reason: This is REJECTED.
CVE: CVE-2024-34750
Published: 2024-07-03
Description: Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-755
References: https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l; https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l; https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
CVE: CVE-2024-36122
Published: 2024-07-03
Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses setting is disabled. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. As possible workarounds, either prevent moderators from accessing the review queue or disable the approve suspect users site setting and the must approve users site setting to prevent users from being added to the review queue.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://github.com/discourse/discourse/commit/8d5b21170efa4766e1a213ff07dc36d36cf3dfb4; https://github.com/discourse/discourse/commit/e2a7265dba3d9e943338db21ca38c50276b22f47; https://github.com/discourse/discourse/security/advisories/GHSA-rr93-hcw4-cv3f
CVE: CVE-2024-37157
Published: 2024-07-03
Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, a malicious actor could get the FastImage library to redirect requests to an internal Discourse IP. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. No known workarounds are available.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/discourse/discourse/commit/5b8cf11b69e05d5c058c1148ec69ec309491fa6e; https://github.com/discourse/discourse/commit/67e78086035cec494b15ce79342a0cb9052c2d95; https://github.com/discourse/discourse/security/advisories/GHSA-46pq-7958-fc68
CVE: CVE-2024-39683
Published: 2024-07-03
Description: ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions. Versions 2.55.1, 2.54.5, and 2.53.8 contain a fix for the issue. There is no workaround since a patch is already available.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://discord.com/channels/[PII_REDACTED]56643850/[PII_REDACTED]37347153; https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04; https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da
CVE: CVE-2024-6461
Published: 2024-07-03
Description: Rejected reason: **REJECT** This is a duplicate CVE issued in error on a framework vulnerability. Please use CVE-2024-5324 instead.
CVE: CVE-2024-6463
Published: 2024-07-03
Description: Rejected reason: **REJECT** This is a duplicate CVE issued in error on a framework vulnerability. Please use CVE-2024-5324 instead.
CVE: CVE-2024-6464
Published: 2024-07-03
Description: Rejected reason: **REJECT** This is a duplicate CVE issued in error on a framework vulnerability. Please use CVE-2024-5324 instead.
CVE: CVE-2024-6383
Published: 2024-07-03
Description: The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-122
References: https://jira.mongodb.org/browse/CDRIVER-5628; https://jira.mongodb.org/browse/CDRIVER-5628; https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html
CVE: CVE-2024-6284
Published: 2024-07-03
Description: In  https://github.com/google/nftables  IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended (might block or not block the desired addresses).

This issue affects:  https://pkg.go.dev/github.com/google/nftables@v0.1.0 

The bug was fixed in the next released version:  https://pkg.go.dev/github.com/google/nftables@v0.2.0
CVSS Score: 7.3 (HIGH)
CWE: CWE-1286, CWE-1389
References: https://bugs.launchpad.net/ubuntu/+source/crowdsec-firewall-bouncer/+bug/2069596; https://github.com/crowdsecurity/cs-firewall-bouncer/issues/368; https://github.com/google/nftables/issues/225
CVE: CVE-2024-38344
Published: 2024-07-04
Description: A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN34977158/; https://wordpress.org/plugins/wp-tweet-walls/; https://jvn.jp/en/jp/JVN34977158/
CVE: CVE-2024-38345
Published: 2024-07-04
Description: A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN34977158/; https://wordpress.org/plugins/sola-testimonials/; https://jvn.jp/en/jp/JVN34977158/
CVE: CVE-2024-38471
Published: 2024-07-04
Description: Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU99784493/; https://www.tp-link.com/jp/support/download/; https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware
CVE: CVE-2024-2385
Published: 2024-07-04
Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.4 via several of the plugin's widgets through the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVE-2024-37547 is likely a duplicate of this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/8.3.5/includes/helper-functions.php#L726; https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/8.3.5/includes/widgets/heading.php#L267; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3114385%40addons-for-elementor&new=3114385%40addons-for-elementor&sfp_email=&sfph_mail=#file1
CVE: CVE-2024-2926
Published: 2024-07-04
Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 8.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/8.3.6/templates/addons/animated-text/loop.php#L40; https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/8.3.6/templates/addons/animated-text/loop.php#L45; https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/8.3.6/templates/addons/carousel/loop.php#L47