deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3711
Published: 2024-05-23
Description: The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the functions action_request_disable, action_change_template, and action_request_enable in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with contributor access or above, to enable/disable the Brizy editor and modify the template used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/brizy/trunk/admin/main.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3086506%40brizy%2Ftrunk&old=3058896%40brizy%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/7092ce4a-bad9-4426-b94e-d9d688344272?source=cve
CVE: CVE-2024-3917
Published: 2024-05-23
Description: The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/88162016-9fc7-4194-9e81-44c50991f6e9/; https://wpscan.com/vulnerability/88162016-9fc7-4194-9e81-44c50991f6e9/
CVE: CVE-2024-3918
Published: 2024-05-23
Description: The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2074d0f5-4165-4130-9391-37cb21e8aa1b/; https://wpscan.com/vulnerability/2074d0f5-4165-4130-9391-37cb21e8aa1b/
CVE: CVE-2024-3920
Published: 2024-05-23
Description: The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2fb28c77-3c35-4a2f-91ed-823d0d011048/; https://wpscan.com/vulnerability/2fb28c77-3c35-4a2f-91ed-823d0d011048/
CVE: CVE-2024-4347
Published: 2024-05-23
Description: The WP Fastest Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the specificDeleteCache function. This makes it possible for authenticated attackers to delete arbitrary files on the server, which can include wp-config.php files of the affected site or other sites in a shared hosting environment.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/wp-fastest-cache/trunk/wpFastestCache.php#L1342; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3089597%40wp-fastest-cache%2Ftrunk&old=3081797%40wp-fastest-cache%2Ftrunk&sfp_email=&sfph_mail=#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/634d4062-7004-4e89-89a8-323c939aae93?source=cve
CVE: CVE-2024-4388
Published: 2024-05-23
Description: This  does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/5c791747-f60a-40a7-94fd-e4b9bb5ea2b0/; https://wpscan.com/vulnerability/5c791747-f60a-40a7-94fd-e4b9bb5ea2b0/
CVE: CVE-2024-4399
Published: 2024-05-23
Description: The  does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://wpscan.com/vulnerability/0690327e-da60-4d71-8b3c-ac9533d82302/; https://wpscan.com/vulnerability/0690327e-da60-4d71-8b3c-ac9533d82302/
CVE: CVE-2024-5177
Published: 2024-05-23
Description: The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/hash-elements/trunk/modules/news-module-one/widgets/news-module-one.php#L720; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3090981%40hash-elements%2Ftrunk&old=3089165%40hash-elements%2Ftrunk&sfp_email=&sfph_mail=#file18; https://www.wordfence.com/threat-intel/vulnerabilities/id/9ba07137-f834-4f56-bcd5-0f6fde756681?source=cve
CVE: CVE-2024-5237
Published: 2024-05-23
Description: A vulnerability, which was classified as critical, has been found in Campcodes Complete Web-Based School Management System 1.0. Affected by this issue is some unknown functionality of the file /view/timetable_grade_wise.php. The manipulation of the argument grade leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265988.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2027.pdf; https://vuldb.com/?ctiid.265988; https://vuldb.com/?id.265988
CVE: CVE-2024-5238
Published: 2024-05-23
Description: A vulnerability, which was classified as critical, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /view/timetable_insert_form.php. The manipulation of the argument grade leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265989 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2028.pdf; https://vuldb.com/?ctiid.265989; https://vuldb.com/?id.265989
CVE: CVE-2024-5239
Published: 2024-05-23
Description: A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/timetable_update_form.php. The manipulation of the argument grade leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-265990 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2029.pdf; https://vuldb.com/?ctiid.265990; https://vuldb.com/?id.265990
CVE: CVE-2024-2038
Published: 2024-05-23
Description: The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.22.6. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to modify plugin settings, delete posts, modify post titles, and upload images.
CVSS Score: 7.5 (HIGH)
CWE: CWE-259
References: https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/3.18/inc/wpf_api.php; https://plugins.trac.wordpress.org/changeset?old=3076514&old_path=atarim-visual-collaboration%2Ftrunk%2Fatarim-visual-collaboration.php&new=3090249&new_path=atarim-visual-collaboration%2Ftrunk%2Fatarim-visual-collaboration.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/29532f4d-e830-4c99-ad77-076eebbbe98d?source=cve
CVE: CVE-2024-2874
Published: 2024-05-23
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/451911; https://hackerone.com/reports/2426166; https://gitlab.com/gitlab-org/gitlab/-/issues/451911
CVE: CVE-2024-36011
Published: 2024-05-23
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HCI: Fix potential null-ptr-deref

Fix potential null-ptr-deref in hci_le_big_sync_established_evt().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/1f7ebb69c1d65732bcac2fda9d15421f76f01e81; https://git.kernel.org/stable/c/9f3be61f55d4eedc20eedc56c0f04a5ce2b4a55a; https://git.kernel.org/stable/c/d2706004a1b8b526592e823d7e52551b518a7941
CVE: CVE-2024-36012
Published: 2024-05-23
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

Tying the msft->data lifetime to hdev by freeing it in
hci_release_dev() to fix the following case:

[use]
msft_do_close()
  msft = hdev->msft_data;
  if (!msft)                      ...(1) <- passed.
    return;
  mutex_lock(&msft->filter_lock); ...(4) <- used after freed.

[free]
msft_unregister()
  msft = hdev->msft_data;
  hdev->msft_data = NULL;         ...(2)
  kfree(msft);                    ...(3) <- msft is freed.

==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common
kernel/locking/mutex.c:587 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30
kernel/locking/mutex.c:752
Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac; https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56; https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead[PII_REDACTED]b23940
CVE: CVE-2024-36013
Published: 2024-05-23
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()

Extend a critical section to prevent chan from early freeing.
Also make the l2cap_connect() return type void. Nothing is using the
returned value but it is ugly to return a potentially freed pointer.
Making it void will help with backports because earlier kernels did use
the return value. Now the compile will break for kernels where this
patch is not a complete fix.

Call stack summary:

[use]
l2cap_bredr_sig_cmd
  l2cap_connect
  ┌ mutex_lock(&conn->chan_lock);
  │ chan = pchan->ops->new_connection(pchan); <- alloc chan
  │ __l2cap_chan_add(conn, chan);
  │   l2cap_chan_hold(chan);
  │   list_add(&chan->list, &conn->chan_l);   ... (1)
  └ mutex_unlock(&conn->chan_lock);
    chan->conf_state              ... (4) <- use after free

[free]
l2cap_conn_del
┌ mutex_lock(&conn->chan_lock);
│ foreach chan in conn->chan_l:            ... (2)
│   l2cap_chan_put(chan);
│     l2cap_chan_destroy
│       kfree(chan)               ... (3) <- chan freed
└ mutex_unlock(&conn->chan_lock);

==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read
include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in _test_bit
include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0
net/bluetooth/l2cap_core.c:4260
Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f[PII_REDACTED]744b658; https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6; https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5
CVE: CVE-2024-3648
Published: 2024-05-23
Description: The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3089529/sharethis-share-buttons; https://www.wordfence.com/threat-intel/vulnerabilities/id/03b37c90-4bb5-4003-a440-3fb57a5c1cae?source=cve; https://plugins.trac.wordpress.org/changeset/3089529/sharethis-share-buttons
CVE: CVE-2024-4043
Published: 2024-05-23
Description: The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpupg-text' shortcode in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-ultimate-post-grid/trunk/includes/public/shortcodes/general/class-wpupg-sc-text.php#L97; https://plugins.trac.wordpress.org/changeset/3086319/; https://wordpress.org/plugins/wp-ultimate-post-grid/#developers
CVE: CVE-2024-4835
Published: 2024-05-23
Description: A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/461328; https://hackerone.com/reports/2497024; https://gitlab.com/gitlab-org/gitlab/-/issues/461328
CVE: CVE-2024-5240
Published: 2024-05-23
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /view/unread_msg.php. The manipulation of the argument my_index leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265991.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2030.pdf; https://vuldb.com/?ctiid.265991; https://vuldb.com/?id.265991
CVE: CVE-2024-5241
Published: 2024-05-23
Description: A vulnerability was found in Huashi Private Cloud CDN Live Streaming Acceleration Server up to 20240520. It has been classified as critical. Affected is an unknown function of the file /manager/ipconfig_new.php. The manipulation of the argument dev leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265992.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/8I~%2CbRx%5E4%26%3Fu%7D2tS/Huashi_Private_Cloud_CDN_Live_Streaming_Acceleration_Server_RCE_Vulnerability-ipconfig_new.php.pdf; https://vuldb.com/?ctiid.265992; https://vuldb.com/?id.265992
CVE: CVE-2024-4706
Published: 2024-05-23
Description: The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3090428/wpo365-login; https://www.wordfence.com/threat-intel/vulnerabilities/id/602a8030-087b-459f-b649-b4116404cf3e?source=cve; https://plugins.trac.wordpress.org/changeset/3090428/wpo365-login
CVE: CVE-2024-30279
Published: 2024-05-23
Description: Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb24-29.html; https://helpx.adobe.com/security/products/acrobat/apsb24-29.html
CVE: CVE-2024-30280
Published: 2024-05-23
Description: Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb24-29.html; https://helpx.adobe.com/security/products/acrobat/apsb24-29.html
CVE: CVE-2024-32969
Published: 2024-05-23
Description: vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in.  This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.

CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56; https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx; https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56
CVE: CVE-2024-35186
Published: 2024-05-23
Description: gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23
References: https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c; https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c
CVE: CVE-2024-35223
Published: 2024-05-23
Description: Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This vulnerability impacts Dapr users who use Dapr as a gRPC proxy for remote service invocation as well as the Dapr App API token functionality. An attacker could exploit this vulnerability to gain access to the app token of the invoker app, potentially compromising security and authentication mechanisms. This vulnerability was patched in version 1.13.3.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/dapr/dapr/commit/e0591e43d0cdfd30a2f2960dce5d9892dc98bc2c; https://github.com/dapr/dapr/issues/7344; https://github.com/dapr/dapr/pull/7404
CVE: CVE-2024-5264
Published: 2024-05-23
Description: Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-338, CWE-338
References: https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50da3cd9c302c218204e2a6ce00131b9&sysparm_article=KB0028531; https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50da3cd9c302c218204e2a6ce00131b9&sysparm_article=KB0028531
CVE: CVE-2024-2861
Published: 2024-05-23
Description: The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3090831/wp-user-avatar; https://www.wordfence.com/threat-intel/vulnerabilities/id/487731cd-da5a-45b6-8f39-4ae6420dd252?source=cve; https://plugins.trac.wordpress.org/changeset/3090831/wp-user-avatar
CVE: CVE-2024-4779
Published: 2024-05-23
Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[post_ids][0]’ parameter in all versions up to, and including, 1.5.107 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/3090199/unlimited-elements-for-elementor/trunk/provider/functions_wordpress.class.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b155f8ca-9d09-47d7-a7c2-7744df029c19?source=cve; https://plugins.trac.wordpress.org/changeset/3090199/unlimited-elements-for-elementor/trunk/provider/functions_wordpress.class.php
CVE: CVE-2024-5165
Published: 2024-05-23
Description: In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse  Ditto Explorer User Interface https://eclipse.dev/ditto/user-interface.html  was not properly neutralized and thus vulnerable to both Reflected and Stored XSS (Cross Site Scripting).





Several inputs were not persisted at the backend of Eclipse Ditto, but only in local browser storage to save settings of "environments" of the UI and e.g. the last performed "search queries", resulting in a "Reflected XSS" vulnerability.




However, several other inputs were persisted at the backend of Eclipse Ditto, leading to a "Stored XSS" vulnerability. Those mean that authenticated and authorized users at Eclipse Ditto can persist Things in Ditto which can - when being displayed by other users also being authorized to see those Things in the Eclipse Ditto UI - cause scripts to be executed in the browser of other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.eclipse.org/security/cve-assignement/-/issues/23; https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/201; https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/202