deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-24643
Published: 2025-02-03
Description: Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPGuppy: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpguppy-lite/vulnerability/wordpress-wpguppy-plugin-1-1-0-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-24646
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS.This issue affects XML for Avito: from n/a through <= 2.5.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/xml-for-avito/vulnerability/wordpress-xml-for-avito-plugin-2-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24656
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning realtyna-provisioning allows Reflected XSS.This issue affects Realtyna Provisioning: from n/a through <= 1.2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/realtyna-provisioning/vulnerability/wordpress-realtyna-provisioning-plugin-1-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24660
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages simple-membership-custom-messages allows Reflected XSS.This issue affects Simple Membership Custom Messages: from n/a through <= 2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-membership-custom-messages/vulnerability/wordpress-simple-membership-custom-messages-plugin-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24661
Published: 2025-02-03
Description: Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/ecab-taxi-booking-manager/vulnerability/wordpress-taxi-booking-manager-for-woocommerce-plugin-1-1-8-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24676
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator custom-store-locator allows Reflected XSS.This issue affects Custom WP Store Locator: from n/a through <= 1.4.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-store-locator/vulnerability/wordpress-custom-wp-store-locator-plugin-1-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24684
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through <= 0.4.7.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/media-downloader/vulnerability/wordpress-media-downloader-plugin-0-4-7-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24697
Published: 2025-02-03
Description: Missing Authorization vulnerability in Realwebcare Image Gallery – Responsive Photo Gallery awesome-responsive-photo-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Gallery – Responsive Photo Gallery: from n/a through <= 1.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/awesome-responsive-photo-gallery/vulnerability/wordpress-image-gallery-responsive-photo-gallery-plugin-1-0-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24707
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.24.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gt3-photo-video-gallery/vulnerability/wordpress-photo-gallery-gt3-image-gallery-gutenberg-block-gallery-plugin-2-7-7-24-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24781
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WPJobBoard allows Reflected XSS. This issue affects WPJobBoard: from n/a through 5.10.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/wpjobboard/vulnerability/wordpress-wpjobboard-plugin-5-10-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-38404
Published: 2025-02-03
Description: Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-38411
Published: 2025-02-03
Description: Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-38412
Published: 2025-02-03
Description: Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-38413
Published: 2025-02-03
Description: Memory corruption while processing frame packets.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-38414
Published: 2025-02-03
Description: Information disclosure while processing information on firmware image during core initialization.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-38416
Published: 2025-02-03
Description: Information disclosure during audio playback.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-38417
Published: 2025-02-03
Description: Information disclosure while processing IO control commands.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-38418
Published: 2025-02-03
Description: Memory corruption while parsing the memory map info in IOCTL calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-38420
Published: 2025-02-03
Description: Memory corruption while configuring a Hypervisor based input virtual device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-45560
Published: 2025-02-03
Description: Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-45561
Published: 2025-02-03
Description: Memory corruption while handling  IOCTL call from user-space to set latency level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-45569
Published: 2025-02-03
Description: Memory corruption while parsing the ML IE due to invalid frame content.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-45571
Published: 2025-02-03
Description: Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-45573
Published: 2025-02-03
Description: Memory corruption may occour while generating test pattern due to negative indexing of display ID.
CVSS Score: 7.8 (HIGH)
CWE: CWE-823, CWE-119
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-45582
Published: 2025-02-03
Description: Memory corruption while validating number of devices in Camera kernel .
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-45584
Published: 2025-02-03
Description: Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-119
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-49832
Published: 2025-02-03
Description: Memory corruption in Camera due to unusually high number of nodes passed to AXI port.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-49833
Published: 2025-02-03
Description: Memory corruption can occur in the camera when an invalid CID is used.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-49834
Published: 2025-02-03
Description: Memory corruption while power-up or power-down sequence of the camera sensor.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-49837
Published: 2025-02-03
Description: Memory corruption while reading CPU state data during guest VM suspend.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-49838
Published: 2025-02-03
Description: Information disclosure while parsing the OCI IE with invalid length.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-49839
Published: 2025-02-03
Description: Memory corruption during management frame processing due to mismatch in T2LM info element.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-49840
Published: 2025-02-03
Description: Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-823, CWE-119
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-49843
Published: 2025-02-03
Description: Memory corruption while processing IOCTL from user space to handle GPU AHB bus error.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
CVE: CVE-2024-55456
Published: 2025-02-03
Description: lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-653
References: https://github.com/sammycage/lunasvg/issues/199
CVE: CVE-2024-36437
Published: 2025-02-03
Description: The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-926
References: https://github.com/actuator/com.enflick.android.TextNow/blob/main/CVE-2024-36437; https://play.google.com/store/apps/details?id=com.enflick.android.TextNow
CVE: CVE-2024-53942
Published: 2025-02-03
Description: An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to command injection via the 2.4 GHz and 5 GHz name parameters, allowing a remote attacker to execute arbitrary OS commands on the device (with root-level permissions) via crafted input.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-78
References: https://github.com/actuator/cve/blob/main/NRADIO/CVE-2024-53942.txt; https://github.com/actuator/cve/blob/main/NRADIO/N8-180Firmware-Version-NROS-1.9.2.n3.c5-blind-cmd-injection-outputRedirect.gif; https://www.nradiowifi.net/article/9.html
CVE: CVE-2024-53943
Published: 2025-02-03
Description: An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute JavaScript within the context of the current user by injecting JavaScript into the SSID field. If an administrator logs into the device, the injected script runs in their browser, executing the malicious payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/actuator/cve/blob/main/NRADIO/CVE-2024-53943.txt; https://github.com/actuator/cve/blob/main/NRADIO/N8-180Firmware-Version-NROS-1.9.2.n3.c5-XSS.gif; https://www.nradiowifi.net/article/9.html
CVE: CVE-2024-54840
Published: 2025-02-03
Description: PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-348
References: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-4.htm#Securitybugfixes; https://gist.github.com/Hurdano/8244855ef8ec364fd98a2693de6e30c5
CVE: CVE-2024-56161
Published: 2025-02-03
Description: Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html; http://www.openwall.com/lists/oss-security/2025/02/04/1; http://www.openwall.com/lists/oss-security/2025/03/06/2
CVE: CVE-2024-57175
Published: 2025-02-03
Description: A Stored Cross-Site Scripting (XSS) vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0 via the profile name to /user/certificate-form.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Ajmal101/CVE-2024-57175/blob/main/README.md; https://github.com/Ajmal101/CVE-2024-57175/blob/main/README.md
CVE: CVE-2024-57362
Published: 2025-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-54840. Reason: This candidate is a reservation duplicate of CVE-2024-54840. Notes: All CVE users should reference CVE-2024-54840 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-57967
Published: 2025-02-03
Description: PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mapping.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-266
References: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-4.htm#Securitybugfixes; https://www.cyberark.com/ca24-15/
CVE: CVE-2025-24898
Published: 2025-02-03
Description: rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.
CWE: CWE-416
References: https://crates.io/crates/openssl; https://github.com/sfackler/rust-openssl/pull/2360; https://github.com/sfackler/rust-openssl/security/advisories/GHSA-rpmj-rpgj-qmpm
CVE: CVE-2024-12510
Published: 2025-02-03
Description: If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-287
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/02/Xerox-Security-Bulletin-XRX25-003-for-Xerox%C2%AE-for-VersaLinkPhaser-and-WorkCentre.pdf
CVE: CVE-2024-50656
Published: 2025-02-03
Description: itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/riya98241/CVE/blob/main/CVE-2024-50656; https://itsourcecode.com/free-projects/php-project/placement-management-system-project-in-php-with-source-code/
CVE: CVE-2024-57004
Published: 2025-02-03
Description: Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80
References: https://github.com/riya98241/CVE/blob/main/CVE-2024-57004; https://github.com/roundcube/roundcubemail/releases/tag/1.6.9
CVE: CVE-2024-57237
Published: 2025-02-03
Description: Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get endpoint. The vulnerability arises because the cmd parameter does not properly sanitize input and the response is served with a Content-Type of text/html. This behavior allows the browser to execute injected JavaScript code.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://harryha.substack.com/p/4g-lte-mobile-wifi-dl7203e-xss-cve-2024-57237; https://prolink2u.com/products/dl-7203e-b
CVE: CVE-2024-57238
Published: 2025-02-03
Description: Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/proc_get endpoint. The vulnerability allows an attacker to manipulate SQL queries by injecting malicious SQL code into the order_by parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://harryha.substack.com/p/4g-lte-mobile-wifi-dl7203e-sqli-cve-2024-57238; https://prolink2u.com/products/dl-7203e-b
CVE: CVE-2024-11132
Published: 2025-02-03
Description: The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534; https://www.wordfence.com/threat-intel/vulnerabilities/id/2b747d61-4528-485e-b746-6dddc64485b5?source=cve
CVE: CVE-2024-11133
Published: 2025-02-03
Description: The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function in all versions up to, and including, 3.9.9.5. This makes it possible for unauthenticated attackers to download event tickets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534; https://www.wordfence.com/threat-intel/vulnerabilities/id/1d78b823-fdff-41b2-8059-6564e3eb668d?source=cve
CVE: CVE-2024-11134
Published: 2025-02-03
Description: The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to download bookings, which contains customers' personal data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534; https://www.wordfence.com/threat-intel/vulnerabilities/id/476bc092-c623-4caf-9676-3036d27c4840?source=cve
CVE: CVE-2024-12511
Published: 2025-02-03
Description: With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.
CVSS Score: 7.6 (HIGH)
CWE: CWE-306, CWE-522
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/02/Xerox-Security-Bulletin-XRX25-003-for-Xerox%C2%AE-for-VersaLinkPhaser-and-WorkCentre.pdf
CVE: CVE-2024-12859
Published: 2025-02-03
Description: The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the 'boombox_listing' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://documentation.px-lab.com/boombox/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c3a647b6-ed9e-402d-9424-2937f7aa8960?source=cve
CVE: CVE-2024-56921
Published: 2025-02-03
Description: An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmm_state_exception() function upon receipt of the Nausf_UEAuthentication_Authenticate response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/open5gs/open5gs/commit/f780f9af45c27b6f49987d96ba71dedb3dd85840; https://github.com/open5gs/open5gs/issues/3608
CVE: CVE-2024-56946
Published: 2025-02-03
Description: Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting new DNS-over-QUIC connections by triggering unhandled exceptions in listener threads.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-248
References: https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-133; https://github.com/TechnitiumSoftware/DnsServer/commit/a7d1cfb6e836798ef9171677bf8919cf99d9dcb0