deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-54228
Published: 2024-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Wot Elementor Widgets wot-elementor-widgets allows DOM-Based XSS.This issue affects Wot Elementor Widgets: from n/a through <= 1.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wot-elementor-widgets/vulnerability/wordpress-wot-elementor-widgets-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54230
Published: 2024-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masud Hasan Unlock Addons for Elementor unlock-addons-for-elementor allows DOM-Based XSS.This issue affects Unlock Addons for Elementor: from n/a through <= 2.2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/unlock-addons-for-elementor/vulnerability/wordpress-unlock-addons-for-elementor-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54232
Published: 2024-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RRDevs RRAddons for Elementor rrdevs-for-elementor allows Stored XSS.This issue affects RRAddons for Elementor: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rrdevs-for-elementor/vulnerability/wordpress-rraddons-for-elementor-plugin-1-1-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54247
Published: 2024-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABCBiz ABCBiz Addons and Templates for Elementor allows Stored XSS.This issue affects ABCBiz Addons and Templates for Elementor: from n/a through 2.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/abcbiz-addons/vulnerability/wordpress-abcbiz-addons-and-templates-for-elementor-plugin-2-0-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54251
Published: 2024-12-09
Description: Missing Authorization vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prodigy Commerce: from n/a through <= 3.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/prodigy-commerce/vulnerability/wordpress-prodigy-commerce-plugin-3-0-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54253
Published: 2024-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.6.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/xpro-elementor-addons/vulnerability/wordpress-xpro-addons-for-elementor-plugin-1-4-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54254
Published: 2024-12-09
Description: Missing Authorization vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.3.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cf7-message-filter/vulnerability/wordpress-message-filter-for-contact-form-7-plugin-1-6-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54255
Published: 2024-12-09
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue affects Login Widget With Shortcode: from n/a through <= 6.1.2.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/login-sidebar-widget/vulnerability/wordpress-login-widget-with-shortcode-plugin-6-1-2-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-54260
Published: 2024-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41953
Published: 2024-12-09
Description: Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/wp-user-avatar/vulnerability/wordpress-profilepress-plugin-4-13-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-52385
Published: 2024-12-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpmart Team Member team-showcase-supreme.This issue affects Team Member: from n/a through <= 7.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/team-showcase-supreme/vulnerability/wordpress-team-member-multi-language-supported-team-plugin-7-1-limited-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-52391
Published: 2024-12-09
Description: Missing Authorization vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/pie-register-premium/vulnerability/wordpress-pie-register-premium-plugin-3-8-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-52480
Published: 2024-12-09
Description: Missing Authorization vulnerability in Astoundify Jobify jobify.This issue affects Jobify: from n/a through < 4.3.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/jobify/vulnerability/wordpress-jobify-plugin-4-2-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-53814
Published: 2024-12-09
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a through <= 5.4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/wp-analytify/vulnerability/wordpress-analytify-plugin-5-4-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-53947
Published: 2024-12-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema.

This issue affects Apache Superset: <4.1.0.

Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://lists.apache.org/thread/hj3gfsjh67vqw12nlrshlsym4bkopjmn
CVE: CVE-2024-53948
Published: 2024-12-09
Description: Generation of Error Message Containing analytics metadata Information in Apache Superset.

This issue affects Apache Superset: before 4.1.0.

Users are recommended to upgrade to version 4.1.0, which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://lists.apache.org/thread/8howpf3png0wrgpls46ggk441oczlfvf; http://www.openwall.com/lists/oss-security/2024/12/09/3
CVE: CVE-2024-53949
Published: 2024-12-09
Description: Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API.

 issue affects Apache Superset: from 2.0.0 before 4.1.0.

Users are recommended to upgrade to version 4.1.0, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://lists.apache.org/thread/d3scbwmfpzbpm6npnzdw5y4owtqqyq8d; http://www.openwall.com/lists/oss-security/2024/12/09/4
CVE: CVE-2024-54218
Published: 2024-12-09
Description: Missing Authorization vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through <= 2.8.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/aio-contact/vulnerability/wordpress-aio-contact-plugin-2-8-1-unauthenticated-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-54929
Published: 2024-12-09
Description: KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_subject.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20subject.pdf
CVE: CVE-2024-54936
Published: 2024-12-09
Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message.php of Kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the my_message parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20teacher%20message.pdf; https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20teacher%20message.pdf
CVE: CVE-2024-54937
Published: 2024-12-09
Description: A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/assets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Directory%20listing%20-%20admin-assets.pdf
CVE: CVE-2024-8259
Published: 2024-12-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.



NOTE: The vendor was contacted and it was learned that the product is not supported.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1881
CVE: CVE-2023-7298
Published: 2024-12-09
Description: A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://autodesk.com/trust/security-advisories/adsk-sa-2023-0025
CVE: CVE-2024-11991
Published: 2024-12-09
Description: Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the Canister to enable the incremental garbage collector or enhanced orthogonal persistence, which are non-default features in Motoko.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-908
References: https://github.com/dfinity/motoko/pull/4677; https://github.com/dfinity/motoko/security/advisories/GHSA-9rhg-3qf8-hrv3
CVE: CVE-2024-38485
Published: 2024-12-09
Description: Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://www.dell.com/support/kbdoc/en-us/000256185/dsa-2024-331-security-update-for-dell-ecs-host-header-injection-vulnerability
CVE: CVE-2024-42426
Published: 2024-12-09
Description: Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability. A low privilege remote attacker could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://www.dell.com/support/kbdoc/en-in/000256645/dsa-2024-453-security-update-for-dell-powerscale-onefs-multiple-security-vulnerabilities
CVE: CVE-2024-49600
Published: 2024-12-09
Description: Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000244438/dsa-2024-439
CVE: CVE-2024-49602
Published: 2024-12-09
Description: Dell PowerScale OneFS Versions 8.2.2.x through 9.8.0.x contain an improper resource unlocking vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-765, CWE-667
References: https://www.dell.com/support/kbdoc/en-in/000256645/dsa-2024-453-security-update-for-dell-powerscale-onefs-multiple-security-vulnerabilities
CVE: CVE-2024-49603
Published: 2024-12-09
Description: Dell PowerScale OneFS Versions 8.2.2.x through 9.9.0.x contain an incorrect specified argument vulnerability. A remote low privileged legitimate user could potentially exploit this vulnerability, leading to information disclosure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-687
References: https://www.dell.com/support/kbdoc/en-in/000256645/dsa-2024-453-security-update-for-dell-powerscale-onefs-multiple-security-vulnerabilities
CVE: CVE-2024-54919
Published: 2024-12-09
Description: A Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary java script via the filename parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/XSS%20by%20File%20Upload%20-%20Update%20Avatar.pdf; https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/XSS%20by%20File%20Upload%20-%20Update%20Avatar.pdf
CVE: CVE-2024-54920
Published: 2024-12-09
Description: A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the firstname, lastname, and class_id parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20Signup%20teacher.pdf
CVE: CVE-2022-38947
Published: 2024-12-09
Description: SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title parameter, allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Cosemz/CVE/blob/main/Flipkart-Clone-PHP/Flipkart-Clone-PHP.md
CVE: CVE-2024-40582
Published: 2024-12-09
Description: Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://curovms.com; http://pentaminds.com; https://medium.com/@vishnuchttrj/exploiting-vms-vulnerabilities-to-access-confidential-data-cve-2024-40582-cve-2024-40583-60d957933b78
CVE: CVE-2024-40583
Published: 2024-12-09
Description: Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-522
References: http://curovms.com; http://pentaminds.com; https://medium.com/@vishnuchttrj/exploiting-vms-vulnerabilities-to-access-confidential-data-cve-2024-40582-cve-2024-40583-60d957933b78
CVE: CVE-2022-38946
Published: 2024-12-09
Description: Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Cosemz/CVE/blob/main/Doctor-Appointment.md
CVE: CVE-2023-43962
Published: 2024-12-09
Description: Cross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker to execute arbitrary code via the project name function in the project settings tab.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cosemz/CVE/blob/main/xunruicms/XunRuiCms%20Stored%20XSS%20%28Authenticated%29.md; https://github.com/Cosemz/CVE/blob/main/xunruicms/XunRuiCms%20Stored%20XSS%20%28Authenticated%29.md
CVE: CVE-2024-45760
Published: 2024-12-09
Description: Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access control vulnerability. A remote low privileged user could potentially exploit this vulnerability via the HTTP GET method leading to unauthorized action with elevated privileges.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.dell.com/support/kbdoc/en-us/000258320/dsa-2024-481-security-update-for-dell-openmanage-server-administrator-omsa-vulnerability
CVE: CVE-2024-45761
Published: 2024-12-09
Description: Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the possibility of altering the behavior of certain apps/OS or Denial of Service.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000258320/dsa-2024-481-security-update-for-dell-openmanage-server-administrator-omsa-vulnerability
CVE: CVE-2024-53450
Published: 2024-12-09
Description: RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/infiniflow/ragflow/blob/cec208051f6f5996fefc8f36b6b71231b1807533/web/src/hooks/document-hooks.ts#L23; https://github.com/thanhtung4102/Unauthentication-in-Ragflow
CVE: CVE-2024-54926
Published: 2024-12-09
Description: A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the school_year parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20search_class.pdf
CVE: CVE-2024-11268
Published: 2024-12-09
Description: A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause a crash or could lead to an arbitrary memory leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0024
CVE: CVE-2024-11454
Published: 2024-12-09
Description: A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0025
CVE: CVE-2024-11608
Published: 2024-12-09
Description: A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0026
CVE: CVE-2024-54922
Published: 2024-12-09
Description: A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, lastname, and username parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20edit_user.pdf
CVE: CVE-2024-54930
Published: 2024-12-09
Description: Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20student.pdf
CVE: CVE-2024-54933
Published: 2024-12-09
Description: Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20content.pdf
CVE: CVE-2024-54935
Published: 2024-12-09
Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message_teacher_to_student.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the my_message parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20student%20message.pdf; https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20student%20message.pdf
CVE: CVE-2022-29974
Published: 2024-12-09
Description: AMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer overflow. This driver is, for example, used in certain ASUS devices.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-120
References: https://dfir.ru/2024/12/09/multiple-vulnerabilities-in-ami-file-system-drivers/; https://www.ami.com
CVE: CVE-2024-12057
Published: 2024-12-09
Description: User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end.
By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application.
CWE: CWE-532
References: https://www.pcvue.com/security/#SB2024-6
CVE: CVE-2024-46547
Published: 2024-12-09
Description: A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive information due to improper access control validation via PHP Info Page. This issue can lead to data leaks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-116
References: https://gist.github.com/omkar170/232236c38b6e795fb73921e555e1a609
CVE: CVE-2024-48956
Published: 2024-12-09
Description: Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint resulting in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1394
References: https://security.serviceware-se.com/CVE-2024-48956/; https://serviceware-se.com/platform/serviceware-processes