deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-21117
Published: 2024-04-16
Description: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).  Supported versions that are affected are 8.5.6 and  8.5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77, CWE-922
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-21118
Published: 2024-04-16
Description: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).  Supported versions that are affected are 8.5.6 and  8.5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-21119
Published: 2024-04-16
Description: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).  Supported versions that are affected are 8.5.6 and  8.5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
CVSS Score: 5.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-21120
Published: 2024-04-16
Description: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).  Supported versions that are affected are 8.5.6 and  8.5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-21121
Published: 2024-04-16
Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://www.oracle.com/security-alerts/cpuapr2024.html; https://www.oracle.com/security-alerts/cpuapr2024.html
CVE: CVE-2024-27086
Published: 2024-04-16
Description: The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability.   
A malicious application running on a customer Android device    can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix.  As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.
CVSS Score: 3.9 (LOW)
CWE: CWE-863, CWE-926
References: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/commit/413e319472ccf48c86647f19fa2aa49ff6038488; https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/security/advisories/GHSA-x674-v45j-fwxw; https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/commit/413e319472ccf48c86647f19fa2aa49ff6038488
CVE: CVE-2024-31452
Published: 2024-04-16
Description: OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`). This vulnerability is fixed in v1.5.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c[PII_REDACTED]576076289f48ed2; https://github.com/openfga/openfga/security/advisories/GHSA-8cph-m685-6v6r; https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c[PII_REDACTED]576076289f48ed2
CVE: CVE-2024-31887
Published: 2024-04-16
Description: IBM Security Verify Privilege 11.6.25 could allow an unauthenticated actor to obtain sensitive information from the SOAP API.   IBM X-Force ID:  287651.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287651; https://www.ibm.com/support/pages/node/7148438; https://exchange.xforce.ibmcloud.com/vulnerabilities/287651
CVE: CVE-2024-29291
Published: 2024-04-16
Description: An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
CWE: CWE-200
References: https://gist.github.com/whiteman007/43bd7fa1fa0e47554b33f0cf93066784; https://gist.github.com/whiteman007/43bd7fa1fa0e47554b33f0cf93066784
CVE: CVE-2024-29402
Published: 2024-04-16
Description: cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-613
References: https://gist.github.com/menghaining/8d424faebfe869c80eadaea12bbdd158; https://github.com/cskefu/cskefu/issues/781; https://github.com/cskefu/cskefu/pull/803
CVE: CVE-2024-31759
Published: 2024-04-16
Description: An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://1drv.ms/v/s%21AmTWEcd1YDpUjgoJ8lkA8pN8zYEJ?e=gIlbGf; https://gist.github.com/menghaining/8d424faebfe869c80eadaea12bbdd158; https://github.com/menghaining/PoC/blob/main/PublicCMS/publishCMS--PoC.md
CVE: CVE-2024-31760
Published: 2024-04-16
Description: An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges via the Session Expiration component.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-266
References: https://gist.github.com/menghaining/8d424faebfe869c80eadaea12bbdd158; https://github.com/flipped-aurora/gin-vue-admin/issues/1324; https://github.com/menghaining/PoC/blob/main/gin-vue-admin/gin-vue-admin--PoC.md
CVE: CVE-2024-31503
Published: 2024-04-17
Description: Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352, CWE-284
References: https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-31503.md; https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-31503.md
CVE: CVE-2024-31680
Published: 2024-04-17
Description: File Upload vulnerability in Shibang Communications Co., Ltd. IP network intercom broadcasting system v.1.0 allows a local attacker to execute arbitrary code via the my_parser.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/heidashuai5588/cve/blob/main/upload.md; https://github.com/heidashuai5588/cve/blob/main/upload.md
CVE: CVE-2024-22354
Published: 2024-04-17
Description: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack. IBM X-Force ID: 280401.
CVSS Score: 7.0 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/280401; https://www.ibm.com/support/pages/node/7148426; https://exchange.xforce.ibmcloud.com/vulnerabilities/280401
CVE: CVE-2024-22329
Published: 2024-04-17
Description: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to conduct the SSRF attack.  X-Force ID:  279951.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/279951; https://www.ibm.com/support/pages/node/7148380; https://exchange.xforce.ibmcloud.com/vulnerabilities/279951
CVE: CVE-2024-0868
Published: 2024-04-17
Description: The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/bb7c2d2b-cdfe-433b-96cf-714e71d12b22/; https://wpscan.com/vulnerability/bb7c2d2b-cdfe-433b-96cf-714e71d12b22/
CVE: CVE-2024-1219
Published: 2024-04-17
Description: The Easy Social Feed  WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ce4ac9c4-d293-4464-b6a0-82ddf8d4860b/; https://wpscan.com/vulnerability/ce4ac9c4-d293-4464-b6a0-82ddf8d4860b/
CVE: CVE-2024-2101
Published: 2024-04-17
Description: The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Customers' page and the malicious script is executed in the admin context.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b3a0bb3f-50b2-4dcb-b23c-b08480363a4a/; https://wpscan.com/vulnerability/b3a0bb3f-50b2-4dcb-b23c-b08480363a4a/
CVE: CVE-2024-2102
Published: 2024-04-17
Description: The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Bookings' page and the malicious script is executed in the admin context.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3d15f589-956c-4c71-98b1-3ba89d22262c/; https://wpscan.com/vulnerability/3d15f589-956c-4c71-98b1-3ba89d22262c/
CVE: CVE-2024-2118
Published: 2024-04-17
Description: The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e9d53cb9-a5cb-49f5-bcba-295ae6fa44c3/; https://wpscan.com/vulnerability/e9d53cb9-a5cb-49f5-bcba-295ae6fa44c3/
CVE: CVE-2024-2309
Published: 2024-04-17
Description: The WP STAGING WordPress Backup Plugin  WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a4152818-1e07-46a7-aec4-70f1a1b579a6/; https://wpscan.com/vulnerability/a4152818-1e07-46a7-aec4-70f1a1b579a6/
CVE: CVE-2024-22440
Published: 2024-04-17
Description: 
A potential security vulnerability has been identified in HPE Compute Scale-up Server 3200 server. This vulnerability could cause disclosure of sensitive information in log files.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-532
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04634en_us&docLocale=en_US; https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04634en_us&docLocale=en_US
CVE: CVE-2024-32506
Published: 2024-04-17
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/radio-player/wordpress-radio-player-plugin-2-0-73-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/radio-player/wordpress-radio-player-plugin-2-0-73-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-32509
Published: 2024-04-17
Description: Missing Authorization vulnerability in Loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.76.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-estimation-form/wordpress-wp-cost-estimation-payment-forms-builder-plugin-10-1-76-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-estimation-form/wordpress-wp-cost-estimation-payment-forms-builder-plugin-10-1-76-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32513
Published: 2024-04-17
Description: Insertion of Sensitive Information into Log File vulnerability in AdTribes.Io Product Feed PRO for WooCommerce.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.3.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/woo-product-feed-pro/wordpress-product-feed-pro-for-woocommerce-plugin-13-3-1-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-product-feed-pro/wordpress-product-feed-pro-for-woocommerce-plugin-13-3-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-32514
Published: 2024-04-17
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker.This issue affects WP Poll Maker: from n/a through 3.4.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/epoll-wp-voting/wordpress-wp-poll-maker-plugin-3-4-authenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/epoll-wp-voting/wordpress-wp-poll-maker-plugin-3-4-authenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-32515
Published: 2024-04-17
Description: Missing Authorization vulnerability in Qamar Sheeraz, Nasir Ahmad Mega Addons For Elementor.This issue affects Mega Addons For Elementor: from n/a through 1.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ultimate-addons-for-elementor/wordpress-mega-addons-for-elementor-plugin-1-8-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-addons-for-elementor/wordpress-mega-addons-for-elementor-plugin-1-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32516
Published: 2024-04-17
Description: Missing Authorization vulnerability in Palscode Multi Currency For WooCommerce.This issue affects Multi Currency For WooCommerce: from n/a through 1.5.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wc-multi-currency/wordpress-multi-currency-for-woocommerce-plugin-1-5-5-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc-multi-currency/wordpress-multi-currency-for-woocommerce-plugin-1-5-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32517
Published: 2024-04-17
Description: Missing Authorization vulnerability in WooCommerce & WordPress Tutorials Custom Thank You Page Customize For WooCommerce by Binary Carpenter.This issue affects Custom Thank You Page Customize For WooCommerce by Binary Carpenter: from n/a through 1.4.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/bc-woo-custom-thank-you-pages/wordpress-custom-thank-you-page-customize-for-woocommerce-by-binary-carpenter-plugin-1-4-12-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bc-woo-custom-thank-you-pages/wordpress-custom-thank-you-page-customize-for-woocommerce-by-binary-carpenter-plugin-1-4-12-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32518
Published: 2024-04-17
Description: Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/pepro-ultimate-invoice/wordpress-peprodev-ultimate-invoice-plugin-2-0-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pepro-ultimate-invoice/wordpress-peprodev-ultimate-invoice-plugin-2-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32519
Published: 2024-04-17
Description: Missing Authorization vulnerability in GutenGeek GG Woo Feed for WooCommerce.This issue affects GG Woo Feed for WooCommerce: from n/a through 1.2.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/gg-woo-feed/wordpress-gg-woo-feed-for-woocommerce-plugin-1-2-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gg-woo-feed/wordpress-gg-woo-feed-for-woocommerce-plugin-1-2-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32520
Published: 2024-04-17
Description: Missing Authorization vulnerability in WPClever WPC Grouped Product for WooCommerce.This issue affects WPC Grouped Product for WooCommerce: from n/a through 4.4.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wpc-grouped-product/wordpress-wpc-grouped-product-for-woocommerce-plugin-4-4-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpc-grouped-product/wordpress-wpc-grouped-product-for-woocommerce-plugin-4-4-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32522
Published: 2024-04-17
Description: Missing Authorization vulnerability in Jaed Mosharraf & Pluginbazar Team Open Close WooCommerce Store.This issue affects Open Close WooCommerce Store: from n/a through 4.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woc-open-close/wordpress-open-close-woocommerce-store-plugin-4-9-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woc-open-close/wordpress-open-close-woocommerce-store-plugin-4-9-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32524
Published: 2024-04-17
Description: Missing Authorization vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/custom-order-statuses-for-woocommerce/wordpress-custom-order-statuses-for-woocommerce-plugin-1-5-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-order-statuses-for-woocommerce/wordpress-custom-order-statuses-for-woocommerce-plugin-1-5-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32525
Published: 2024-04-17
Description: Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/theme-my-login/wordpress-theme-my-login-plugin-7-1-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/theme-my-login/wordpress-theme-my-login-plugin-7-1-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32532
Published: 2024-04-17
Description: Missing Authorization vulnerability in SiteGround Speed Optimizer.This issue affects Speed Optimizer: from n/a through 7.4.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/sg-cachepress/wordpress-speed-optimizer-plugin-7-4-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sg-cachepress/wordpress-speed-optimizer-plugin-7-4-6-broken-access-control-vulnerability?_s_id=cve