deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43920
Published: 2024-08-29
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jegstudio Gutenverse allows Stored XSS.This issue affects Gutenverse: from n/a through 1.9.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gutenverse/wordpress-gutenverse-gutenberg-blocks-page-builder-for-site-editor-plugin-1-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43921
Published: 2024-08-29
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Magic Post Thumbnail allows Reflected XSS.This issue affects Magic Post Thumbnail: from n/a through 5.2.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/magic-post-thumbnail/wordpress-generate-images-magic-post-thumbnail-plugin-5-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43947
Published: 2024-08-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-armour-extended/wordpress-wp-armour-extended-plugin-1-26-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-34017
Published: 2024-08-29
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 4569.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-4505
CVE: CVE-2024-34018
Published: 2024-08-29
Description: Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4569.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://security-advisory.acronis.com/advisories/SEC-4196
CVE: CVE-2024-34019
Published: 2024-08-29
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 4569.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-3079
CVE: CVE-2024-41345
Published: 2024-08-29
Description: openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jpatokal/openflights/commit/36733f430b11a78404457a5dfc295ab1182292c0; https://github.com/jpatokal/openflights/issues/1480
CVE: CVE-2024-41346
Published: 2024-08-29
Description: openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jpatokal/openflights/commit/36733f430b11a78404457a5dfc295ab1182292c0; https://github.com/jpatokal/openflights/issues/1479
CVE: CVE-2024-41347
Published: 2024-08-29
Description: openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jpatokal/openflights/commit/36733f430b11a78404457a5dfc295ab1182292c0; https://github.com/jpatokal/openflights/issues/1477
CVE: CVE-2024-41348
Published: 2024-08-29
Description: openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jpatokal/openflights/commit/d815df727a94fe98d3299873f0efddf6a81a56a3; https://github.com/jpatokal/openflights/commit/e7f5d8112d5353cc1ceb6ae92aa5ff2f3c2e35a6; https://github.com/jpatokal/openflights/issues/1478
CVE: CVE-2024-41350
Published: 2024-08-29
Description: bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/baijunyao/thinkphp-bjyadmin; https://github.com/xjzzzxx/vulFound/blob/main/bjyadmin/xss2.md
CVE: CVE-2024-41351
Published: 2024-08-29
Description: bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/baijunyao/thinkphp-bjyadmin; https://github.com/xjzzzxx/vulFound/blob/main/bjyadmin/xss1.md
CVE: CVE-2024-41358
Published: 2024-08-29
Description: phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2024-41358.md; https://github.com/phpipam/phpipam/commit/3986ac1acfbf47ddd4fe05cd158aaf2cacafe36b; https://github.com/phpipam/phpipam/commit/b131fb99c9ada95b38e4cb2749ac599e42fad3d9
CVE: CVE-2024-41361
Published: 2024-08-29
Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2398
CVE: CVE-2024-41364
Published: 2024-08-29
Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2400
CVE: CVE-2024-41366
Published: 2024-08-29
Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2399
CVE: CVE-2024-41367
Published: 2024-08-29
Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2397
CVE: CVE-2024-41368
Published: 2024-08-29
Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2396
CVE: CVE-2024-41369
Published: 2024-08-29
Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2401
CVE: CVE-2024-41370
Published: 2024-08-29
Description: Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/causefx/Organizr; https://github.com/causefx/Organizr/issues/1998
CVE: CVE-2024-41371
Published: 2024-08-29
Description: Organizr v1.90 is vulnerable to Cross Site Scripting (XSS) via api.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/causefx/Organizr; https://github.com/causefx/Organizr/issues/1997
CVE: CVE-2024-41372
Published: 2024-08-29
Description: Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/causefx/Organizr; https://github.com/causefx/Organizr/issues/1999
CVE: CVE-2024-41349
Published: 2024-08-29
Description: unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/cdevroe/unmark/commit/52342dc4a908dc6ac6878f21a5850108ac84a4b8; https://github.com/cdevroe/unmark/issues/290
CVE: CVE-2024-2502
Published: 2024-08-29
Description: An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected.

This is possible because the TAMPERRSTCAUSE register may not be properly updated when a level 4 tamper event (a tamper reset) occurs. This impacts Series 2 HSE-SVH devices, including xG23B, xG24B, xG25B, and xG28B, but does not impact xG21B. To mitigate this issue, upgrade to SE Firmware version 2.2.6 or later.
CVSS Score: 2.0 (LOW)
CWE: CWE-754
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/069Vm00000BYb5HIAT?operationContext=S1
CVE: CVE-2024-45302
Published: 2024-08-29
Description: RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to `RestRequest.AddHeader` (the header value) is vulnerable to CRLF injection. The same applies to `RestRequest.AddOrUpdateHeader` and `RestClient.AddDefaultHeader`. The way HTTP headers are added to a request is via the `HttpHeaders.TryAddWithoutValidation` method which does not check for CRLF characters in the header value. This means that any headers from a `RestSharp.RequestHeaders` object are added to the request in such a way that they are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests. If an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. RestSharp has addressed this issue in version 112.0.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93, CWE-74
References: https://github.com/restsharp/RestSharp/blob/777bf194ec2d14271e7807cc704e73ec18fcaf7e/src/RestSharp/Request/HttpRequestMessageExtensions.cs#L32; https://github.com/restsharp/RestSharp/commit/0fba5e727d241b1867bd71efc912594075c2934b; https://github.com/restsharp/RestSharp/security/advisories/GHSA-4rr6-2v9v-wcpc
CVE: CVE-2024-6670
Published: 2024-08-29
Description: In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024; https://www.progress.com/network-monitoring; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6670
CVE: CVE-2024-6671
Published: 2024-08-29
Description: In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024; https://www.progress.com/network-monitoring
CVE: CVE-2024-6672
Published: 2024-08-29
Description: In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an authenticated low-privileged attacker to achieve privilege escalation by modifying a privileged user's password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024; https://www.progress.com/network-monitoring
CVE: CVE-2024-1543
Published: 2024-08-29
Description: The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a controlled environment such as Intel SGX, an attacker can gain a per instruction sub-cache-line resolution allowing them to break the cache-line-level protection. For details on the attack refer to:  https://doi.org/10.46586/tches.v2024.i1.457-500
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-566-dec-19-2023
CVE: CVE-2024-1545
Published: 2024-08-29
Description: Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-252, CWE-1256, CWE-74
References: https://github.com/wolfSSL/wolfssl/pull/7167; https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.0-stable
CVE: CVE-2024-2881
Published: 2024-08-30
Description: Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the ed25519_key structure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-252, CWE-1256, CWE-74
References: https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.0-stable
CVE: CVE-2024-8234
Published: 2024-08-30
Description: ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() in the Zyxel NWA1100-N firmware version 1.00(AACE.1)C0 could allow an unauthenticated attacker to execute some OS commands to access system files on an affected device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/GroundCTL2MajorTom/pocs/blob/main/zyxel_NWAW1100-N_rce.md; https://webservice.zyxel.com/eol/ArchivedEOLModel.pdf
CVE: CVE-2024-45488
Published: 2024-08-30
Description: One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual appliance installations (VMware or HyperV). The fixed versions are 7.0.5.1 LTS, 7.4.2, and 7.5.2.
CVSS Score: 9.8 (CRITICAL)
References: https://support.oneidentity.com/kb/4376740/safeguard-for-privileged-passwords-security-vulnerability-notification-defect-460620; https://support.oneidentity.com/product-notification/noti-00001628
CVE: CVE-2024-45490
Published: 2024-08-30
Description: An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-190
References: https://github.com/libexpat/libexpat/issues/887; https://github.com/libexpat/libexpat/pull/890; http://seclists.org/fulldisclosure/2024/Dec/10
CVE: CVE-2024-45491
Published: 2024-08-30
Description: An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://github.com/libexpat/libexpat/issues/888; https://github.com/libexpat/libexpat/pull/891; https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html
CVE: CVE-2024-45492
Published: 2024-08-30
Description: An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://github.com/libexpat/libexpat/issues/889; https://github.com/libexpat/libexpat/pull/892; https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html
CVE: CVE-2024-8327
Published: 2024-08-30
Description: Easy test

Online Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-8032-a3d5c-2.html; https://www.twcert.org.tw/tw/cp-132-8028-360e1-1.html
CVE: CVE-2024-8328
Published: 2024-08-30
Description: Easy test Online Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary JavaScript code and perform Reflected Cross-site scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-8033-0a98f-2.html; https://www.twcert.org.tw/tw/cp-132-8028-360e1-1.html
CVE: CVE-2024-8329
Published: 2024-08-30
Description: 6SHR system from Gether Technology does not properly validate the specific page parameter, allowing remote attackers with regular privilege to inject SQL command to read, modify, and delete database contents.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-8034-657b7-2.html; https://www.twcert.org.tw/tw/cp-132-8030-e2eac-1.html
CVE: CVE-2024-8330
Published: 2024-08-30
Description: 6SHR system from Gether Technology does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload web shell scripts and use them to execute arbitrary system commands on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-8035-53926-2.html; https://www.twcert.org.tw/tw/cp-132-8031-a2f21-1.html
CVE: CVE-2024-4401
Published: 2024-08-30
Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ and 'eae_slider_animation' parameters in all versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/animated-text/widgets/animated-text.php#L358; https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/bg-slider/module.php#L284; https://plugins.trac.wordpress.org/changeset/3107074#file6
CVE: CVE-2024-5024
Published: 2024-08-30
Description: The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mepr_screenname' and 'mepr_key' parameter in all versions up to, and including, 1.11.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://memberpress.com/change-log/#1.11.30; https://www.wordfence.com/threat-intel/vulnerabilities/id/718d12fe-31e4-4fa1-ba9a-8626df8ddbfe?source=cve
CVE: CVE-2024-5061
Published: 2024-08-30
Description: The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and 'class' parameters in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/enfold-responsive-multipurpose-theme/4519990; https://www.wordfence.com/threat-intel/vulnerabilities/id/25462492-59d2-44b7-81c3-93ac04a08bcc?source=cve
CVE: CVE-2024-5784
Published: 2024-08-30
Description: The Tutor LMS  Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and tutor_gc_class_action in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with the subscriber-level access and above, to preform an administrative actions on the site, like comments, posts or users deletion, viewing notifications, etc.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://tutorlms.com/releases/id/299/; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5c23ed-7239-40e1-a795-1ae8d4c2d6c8?source=cve
CVE: CVE-2024-2694
Published: 2024-08-30
Description: The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048; https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c31409-c84a-4197-b08c-b70df5e66a80?source=cve
CVE: CVE-2024-3998
Published: 2024-08-30
Description: The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 27.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048; https://www.wordfence.com/threat-intel/vulnerabilities/id/5b655b04-1f2f-4745-8237-7ef3f8e31ace?source=cve
CVE: CVE-2024-5879
Published: 2024-08-30
Description: The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/leadin/tags/11.1.13/public/admin/widgets/class-elementormeeting.php#L108; https://plugins.trac.wordpress.org/changeset/3123662/leadin/trunk/public/admin/widgets/class-elementormeeting.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac004fb0-e178-4e9b-9aa3-b14eab43f22d?source=cve
CVE: CVE-2024-3673
Published: 2024-08-30
Description: The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.
CVSS Score: 9.1 (CRITICAL)
References: https://wpscan.com/vulnerability/0e8930cb-e176-4406-a43f-a6032471debf/
CVE: CVE-2024-34577
Published: 2024-08-30
Description: Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN24885537/; https://www.elecom.co.jp/news/security/20240827-01/