deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-10511
Published: 2024-12-11
Description: CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface
when someone on the local network repeatedly requests the /accessdenied URL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-345-01.pdf
CVE: CVE-2024-12004
Published: 2024-12-11
Description: The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the ajax_update_order_note() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/woo-order-notes/trunk/wpc-order-notes.php#L416; https://plugins.trac.wordpress.org/changeset/3205072/; https://wordpress.org/plugins/woo-order-notes/#developers
CVE: CVE-2024-12283
Published: 2024-12-11
Description: The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3204551/; https://wordpress.org/plugins/wp-pipes/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa56fc7-8d48-4149-afa7-8f9885de0674?source=cve
CVE: CVE-2024-11401
Published: 2024-12-11
Description: Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform's User Interface). This vulnerability has been fixed as of November 13th 2024.
CWE: CWE-862
References: https://cwe.mitre.org/data/definitions/862.html
CVE: CVE-2024-11737
Published: 2024-12-11
Description: CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of
confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-345-03.pdf
CVE: CVE-2024-12363
Published: 2024-12-11
Description: Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1008/
CVE: CVE-2024-54269
Published: 2024-12-11
Description: Missing Authorization vulnerability in Ninja Team Notibar notibar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notibar: from n/a through <= 2.1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/notibar/vulnerability/wordpress-notibar-plugin-2-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-11008
Published: 2024-12-11
Description: The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3199682/members; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6ad375-da04-4b56-8077-e26c148e7527?source=cve
CVE: CVE-2024-11840
Published: 2024-12-11
Description: The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3202982/unusedcss; https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8ff4ec-9b40-4d59-b3b0-382f91042a4a?source=cve
CVE: CVE-2024-12294
Published: 2024-12-11
Description: The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the 'get_legacy_cookies' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and permalinks of private, password-protected, pending, and draft posts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/last-viewed-posts/trunk/inc/namespace.php#L131; https://plugins.trac.wordpress.org/changeset/3205041/; https://www.wordfence.com/threat-intel/vulnerabilities/id/db838a3f-6afa-4686-8e6a-01edab2dcc96?source=cve
CVE: CVE-2024-12325
Published: 2024-12-11
Description: The Waymark plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/waymark/trunk/inc/Admin/Waymark_Settings.php#L1457; https://plugins.trac.wordpress.org/browser/waymark/trunk/inc/Admin/Waymark_Settings.php#L1458; https://plugins.trac.wordpress.org/browser/waymark/trunk/inc/Admin/Waymark_Settings.php#L1531
CVE: CVE-2023-23472
Published: 2024-12-11
Description: IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system.
CVSS Score: 3.1 (LOW)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/6988167
CVE: CVE-2024-11351
Published: 2024-12-11
Description: The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.8 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3201494/restricted-content; https://www.wordfence.com/threat-intel/vulnerabilities/id/de982653-26b4-4a7b-a391-373362bcb834?source=cve
CVE: CVE-2024-51460
Published: 2024-12-11
Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7177698
CVE: CVE-2024-50585
Published: 2024-12-11
Description: Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the context of the "Numerix License Server Administration System Login" (nlslogin.jsp) page. The vulnerability can be triggered by sending a specially crafted HTTP POST request. 



The vendor was unresponsive during multiple attempts to contact them via various channels, hence there is no solution available. In case you are using this software, be sure to restrict access and monitor logs. Try to reach out to your contact person for this vendor and request a patch.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://r.sec-consult.com/numerix; http://seclists.org/fulldisclosure/2024/Dec/4
CVE: CVE-2024-28139
Published: 2024-12-11
Description: The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the privileges can be escalated to the root user. The risk has been accepted by the vendor and won't be fixed in the near future.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250
References: https://r.sec-consult.com/imageaccess; http://seclists.org/fulldisclosure/2024/Dec/2
CVE: CVE-2024-28140
Published: 2024-12-11
Description: The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-250
References: https://r.sec-consult.com/imageaccess; https://www.imageaccess.de/?page=SupportPortal&lang=en; http://seclists.org/fulldisclosure/2024/Dec/2
CVE: CVE-2024-28141
Published: 2024-12-11
Description: The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the admin password or create new users.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://r.sec-consult.com/imageaccess; https://www.imageaccess.de/?page=SupportPortal&lang=en; http://seclists.org/fulldisclosure/2024/Dec/2
CVE: CVE-2024-47758
Published: 2024-12-11
Description: GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/glpi-project/glpi/releases/tag/10.0.17; https://github.com/glpi-project/glpi/security/advisories/GHSA-3r4x-6pmx-phwr
CVE: CVE-2024-53677
Published: 2024-12-11
Description: File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new  file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://cwiki.apache.org/confluence/display/WW/S2-067; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-10251
Published: 2024-12-11
Description: Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker to achieve local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Security-Controls-iSec-CVE-2024-10251
CVE: CVE-2024-11597
Published: 2024-12-11
Description: Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authenticated attacker to achieve local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Performance-Manager-CVE-2024-11597
CVE: CVE-2024-11598
Published: 2024-12-11
Description: Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authenticated attacker to achieve local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Application-Control-CVE-2024-11598
CVE: CVE-2024-47760
Published: 2024-12-11
Description: GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/glpi-project/glpi/releases/tag/10.0.17; https://github.com/glpi-project/glpi/security/advisories/GHSA-r3mx-fr5f-gwgp
CVE: CVE-2024-47761
Published: 2024-12-11
Description: GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: https://github.com/glpi-project/glpi/releases/tag/10.0.17; https://github.com/glpi-project/glpi/security/advisories/GHSA-x794-564w-vgxx
CVE: CVE-2024-48912
Published: 2024-12-11
Description: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/glpi-project/glpi/releases/tag/10.0.17; https://github.com/glpi-project/glpi/security/advisories/GHSA-vjmw-j32j-ph4f
CVE: CVE-2024-8496
Published: 2024-12-11
Description: Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Workspace-Control-IWC-CVE-2024-8496
CVE: CVE-2024-9845
Published: 2024-12-11
Description: Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Automation-CVE-2024-9845
CVE: CVE-2024-11872
Published: 2024-12-12
Description: Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Epic Games Launcher. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The product applies incorrect default permissions to a sensitive folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-24329.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://trello.com/c/tcS6Jcfy/578-epic-games-launcher-1720; https://www.zerodayinitiative.com/advisories/ZDI-24-1646/
CVE: CVE-2024-11947
Published: 2024-12-12
Description: GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability.

The specific flaw exists within the Core Service, which listens on TCP port 8017 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24029.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1670/
CVE: CVE-2024-11948
Published: 2024-12-12
Description: GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from the use of a vulnerable version of Telerik Web UI. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-24041.
CVSS Score: 9.8 (CRITICAL)
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1671/
CVE: CVE-2024-11949
Published: 2024-12-12
Description: GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability.

The specific flaw exists within the Store Service, which listens on TCP port 8018 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24331.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1672/
CVE: CVE-2024-11950
Published: 2024-12-12
Description: XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of XnSoft XnView Classic. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.


The specific flaw exists within the parsing of RWZ files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22913.
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1640/
CVE: CVE-2024-12381
Published: 2024-12-12
Description: Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html; https://issues.chromium.org/issues/381696874
CVE: CVE-2024-12382
Published: 2024-12-12
Description: Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html; https://issues.chromium.org/issues/379516109
CVE: CVE-2024-12479
Published: 2024-12-12
Description: A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2 and classified as critical. This issue affects the function searchTopicByKeyword of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\TopicDao.java. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hadagaga/vuln/blob/master/wetech-cms/sql-1/SQL_injection_vulnerability.md; https://vuldb.com/?ctiid.287861; https://vuldb.com/?id.287861
CVE: CVE-2024-12480
Published: 2024-12-12
Description: A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been classified as critical. Affected is the function searchTopic of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\TopicDao.java. The manipulation of the argument con leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hadagaga/vuln/blob/master/wetech-cms/sql-2/SQL_injection_vulnerability.md; https://vuldb.com/?ctiid.287862; https://vuldb.com/?id.287862
CVE: CVE-2024-12481
Published: 2024-12-12
Description: A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been declared as critical. Affected by this vulnerability is the function findUser of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\UserDao.java. The manipulation of the argument searchValue/gId/rId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hadagaga/vuln/blob/master/wetech-cms/sql-3/SQL_injection_vulnerability.md; https://vuldb.com/?ctiid.287863; https://vuldb.com/?id.287863
CVE: CVE-2024-12482
Published: 2024-12-12
Description: A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been rated as problematic. Affected by this issue is the function backup of the file wetech-cms-master\wetech-basic-common\src\main\java\tech\wetech\basic\util\BackupFileUtil.java of the component Database Backup Handler. The manipulation of the argument name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-23, CWE-24, CWE-22
References: https://github.com/hadagaga/vuln/blob/master/wetech-cms/Catalog_penetration/Catalog_penetration.md; https://vuldb.com/?ctiid.287864; https://vuldb.com/?id.287864
CVE: CVE-2024-12483
Published: 2024-12-12
Description: A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.7 (LOW)
CWE: CWE-285, CWE-639, CWE-639
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/IDOR-UsernameEnumeration.md; https://vuldb.com/?ctiid.287865; https://vuldb.com/?id.287865