deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8521
Published: 2024-09-07
Description: A vulnerability, which was classified as problematic, was found in Wavelog up to 1.8.0. Affected is the function index of the file /qso of the component Live QSO. The manipulation of the argument manual leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.1 is able to address this issue. The patch is identified as b31002cec6b71ab5f738881806bb546430ec692e. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/GithubUser843205/CVEs/tree/main/CVE-2024-8521; https://github.com/wavelog/wavelog/commit/b31002cec6b71ab5f738881806bb546430ec692e; https://github.com/wavelog/wavelog/pull/744
CVE: CVE-2024-6849
Published: 2024-09-07
Description: The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/preloader-plus/tags/2.2.1/inc/preloader-plus.php#L351; https://wordpress.org/plugins/preloader-plus/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/85e0e1c5-211f-434c-8cc8-1ca676a8c7c2?source=cve
CVE: CVE-2024-8523
Published: 2024-09-07
Description: A vulnerability was found in lmxcms up to 1.4 and classified as critical. Affected by this issue is the function formatData of the file /admin.php?m=Acquisi&a=testcj&lid=1 of the component SQL Command Execution Module. The manipulation of the argument data leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-94
References: https://github.com/gaorenyusi/gaorenyusi/blob/main/lmx.md; https://vuldb.com/?ctiid.276728; https://vuldb.com/?id.276728
CVE: CVE-2024-8538
Published: 2024-09-07
Description: The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This makes it possible for authenticated attackers, with author-level access and above, to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-22
References: https://github.com/uglyrobot/big-file-uploads/blob/master/tuxedo_big_file_uploads.php#L601; https://plugins.trac.wordpress.org/changeset/3147755/tuxedo-big-file-uploads/trunk/tuxedo_big_file_uploads.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd308a4-7157-4bc6-a55b-c6a4a62510a9?source=cve
CVE: CVE-2024-1596
Published: 2024-09-07
Description: The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://ninjaforms.com/extensions/file-uploads/; https://ninjaforms.com/extensions/file-uploads/?changelog=1/; https://www.wordfence.com/threat-intel/vulnerabilities/id/499a1892-12b7-49d5-b65f-4f53a968a23a?source=cve
CVE: CVE-2024-6010
Published: 2024-09-07
Description: The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-472
References: https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version; https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/order.js; https://plugins.trac.wordpress.org/changeset/3172590/
CVE: CVE-2024-7112
Published: 2024-09-07
Description: The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up to, and including, 2.9.9.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/booking-system/trunk/includes/calendars/class-backend-calendar-schedule.php#L441; https://plugins.trac.wordpress.org/browser/booking-system/trunk/includes/calendars/class-backend-calendar-schedule.php#L529; https://plugins.trac.wordpress.org/changeset/3147739/
CVE: CVE-2024-7620
Published: 2024-09-07
Description: The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/3144365/customizer-export-import; https://www.wordfence.com/threat-intel/vulnerabilities/id/7600e7df-725d-4877-b0bf-5329f814723f?source=cve
CVE: CVE-2024-37068
Published: 2024-09-07
Description: IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/292799; https://www.ibm.com/support/pages/node/7167725
CVE: CVE-2024-40680
Published: 2024-09-07
Description: IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-789, CWE-770
References: https://www.ibm.com/support/pages/node/7167732
CVE: CVE-2024-8554
Published: 2024-09-07
Description: A vulnerability was found in SourceCodester Clinics Patient Management System 2.0 and classified as problematic. This issue affects some unknown processing of the file /users.php. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-Clinic's-Patient-Management-System-Reflected-XSS.md; https://vuldb.com/?ctiid.276773; https://vuldb.com/?id.276773
CVE: CVE-2024-40681
Published: 2024-09-07
Description: IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.
CVSS Score: 7.5 (HIGH)
CWE: CWE-266
References: https://www.ibm.com/support/pages/node/7167732
CVE: CVE-2024-8555
Published: 2024-09-07
Description: A vulnerability was found in SourceCodester Clinics Patient Management System 2.0. It has been classified as problematic. Affected is an unknown function of the file congratulations.php. The manipulation of the argument goto_page leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-Clinic's-Patient-Management-System-Open-Redirect.md; https://vuldb.com/?ctiid.276774; https://vuldb.com/?id.276774
CVE: CVE-2024-8557
Published: 2024-09-07
Description: A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. This affects an unknown part of the file /foms/routers/cancel-order.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/tldjgggg/cve/blob/main/sql2.md; https://vuldb.com/?ctiid.276777; https://vuldb.com/?id.276777
CVE: CVE-2023-30582
Published: 2024-09-07
Description: A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-30583
Published: 2024-09-07
Description: fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This flaw arises from a missing check in the `fs.openAsBlob()` API.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-30584
Published: 2024-09-07
Description: A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-30587
Published: 2024-09-07
Description: A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector).

By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl. This vulnerability exclusively affects Node.js users employing the permission model mechanism.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-39333
Published: 2024-09-07
Description: Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-94
References: https://nodejs.org/en/blog/vulnerability/october-2023-security-releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-46809
Published: 2024-09-07
Description: Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
CVSS Score: 7.4 (HIGH)
CWE: CWE-385
References: https://nodejs.org/en/blog/vulnerability/february-2024-security-releases; https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html; https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html
CVE: CVE-2024-36137
Published: 2024-09-07
Description: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.

Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
CVSS Score: 3.3 (LOW)
References: https://nodejs.org/en/blog/vulnerability/july-2024-security-releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-36138
Published: 2024-09-07
Description: Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://nodejs.org/en/blog/vulnerability/july-2024-security-releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-8558
Published: 2024-09-07
Description: A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknown code of the file /foms/routers/place-order.php of the component Price Handler. The manipulation of the argument total leads to improper validation of specified quantity in input. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1284
References: https://github.com/Niu-zida/cve/blob/main/Payment%20loopholes.md; https://vuldb.com/?ctiid.276778; https://vuldb.com/?id.276778
CVE: CVE-2024-38650
Published: 2024-09-07
Description: An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-200
References: https://www.veeam.com/kb4649
CVE: CVE-2024-38651
Published: 2024-09-07
Description: A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: https://www.veeam.com/kb4649
CVE: CVE-2024-39714
Published: 2024-09-07
Description: A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://www.veeam.com/kb4649
CVE: CVE-2024-39715
Published: 2024-09-07
Description: A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: https://www.veeam.com/kb4649
CVE: CVE-2024-39718
Published: 2024-09-07
Description: An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account.
CVSS Score: 8.1 (HIGH)
References: https://www.veeam.com/kb4649
CVE: CVE-2024-40709
Published: 2024-09-07
Description: A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://www.veeam.com/kb4649
CVE: CVE-2024-40710
Published: 2024-09-07
Description: A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role within Veeam Backup & Replication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://www.veeam.com/kb4649
CVE: CVE-2024-40711
Published: 2024-09-07
Description: A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.veeam.com/kb4649; https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40711
CVE: CVE-2024-40712
Published: 2024-09-07
Description: A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://www.veeam.com/kb4649
CVE: CVE-2024-40713
Published: 2024-09-07
Description: A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://www.veeam.com/kb4649
CVE: CVE-2024-40714
Published: 2024-09-07
Description: An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.
CVSS Score: 8.3 (HIGH)
CWE: CWE-295
References: https://www.veeam.com/kb4649
CVE: CVE-2024-40718
Published: 2024-09-07
Description: A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://www.veeam.com/kb4649
CVE: CVE-2024-42019
Published: 2024-09-07
Description: A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data collected from Veeam Backup & Replication.
CVSS Score: 8.0 (HIGH)
CWE: CWE-200
References: https://www.veeam.com/kb4649
CVE: CVE-2024-42020
Published: 2024-09-07
Description: A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.veeam.com/kb4649
CVE: CVE-2024-42021
Published: 2024-09-07
Description: An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.veeam.com/kb4649
CVE: CVE-2024-42022
Published: 2024-09-07
Description: An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://www.veeam.com/kb4649
CVE: CVE-2024-42023
Published: 2024-09-07
Description: An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://www.veeam.com/kb4649
CVE: CVE-2024-42024
Published: 2024-09-07
Description: A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250
References: https://www.veeam.com/kb4649
CVE: CVE-2024-8559
Published: 2024-09-07
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Food Menu 1.0. This issue affects some unknown processing of the file /endpoint/delete-menu.php. The manipulation of the argument menu leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.276779; https://vuldb.com/?id.276779; https://vuldb.com/?submit.403497
CVE: CVE-2024-8560
Published: 2024-09-07
Description: A vulnerability, which was classified as critical, was found in SourceCodester Simple Invoice Generator System 1.0. Affected is an unknown function of the file /save_invoice.php. The manipulation of the argument invoice_code/customer/cashier/total_amount/discount_percentage/discount_amount/tendered_amount leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.276780; https://vuldb.com/?id.276780; https://vuldb.com/?submit.403629
CVE: CVE-2024-8561
Published: 2024-09-07
Description: A vulnerability has been found in SourceCodester PHP CRUD 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete.php of the component Delete Person Handler. The manipulation of the argument person leads to sql injection. The attack can be launched remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.276781; https://vuldb.com/?id.276781; https://vuldb.com/?submit.403651
CVE: CVE-2024-8562
Published: 2024-09-07
Description: A vulnerability was found in SourceCodester PHP CRUD 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /endpoint/Add.php. The manipulation of the argument first_name/middle_name/last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.276782; https://vuldb.com/?id.276782; https://www.sourcecodester.com/
CVE: CVE-2024-8563
Published: 2024-09-07
Description: A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/update.php. The manipulation of the argument first_name/middle_name/last_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.276783; https://vuldb.com/?id.276783; https://vuldb.com/?submit.403661
CVE: CVE-2024-8564
Published: 2024-09-07
Description: A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/update.php. The manipulation of the argument tbl_person_id/first_name/middle_name/last_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.276784; https://vuldb.com/?id.276784; https://vuldb.com/?submit.403662