deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1719
Published: 2024-02-28
Description: The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_completion' function. This makes it possible for unauthenticated attackers to modify the plugins settings and chance the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040958%40contact-form-7-paypal-add-on&new=3040958%40contact-form-7-paypal-add-on&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040962%40wp-ecommerce-paypal&new=3040962%40wp-ecommerce-paypal&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a5276227-9bd4-4ad8-a6b7-ac7d05e8b056?source=cve
CVE: CVE-2024-1860
Published: 2024-02-28
Description: The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_add_whitelist() function in all versions up to, and including, 4.51. This makes it possible for unauthenticated attackers to add their IP Address to the whitelist circumventing protection
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040434%40antihacker&new=3040434%40antihacker&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3d365284-73ac-4730-a83d-9202677cf161?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040434%40antihacker&new=3040434%40antihacker&sfp_email=&sfph_mail=
CVE: CVE-2024-1861
Published: 2024-02-28
Description: The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_truncate_scan_table() function in all versions up to, and including, 4.52. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate the scan table.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040447%40antihacker&new=3040447%40antihacker&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b80c8888-e8d6-4458-ae93-8e[PII_REDACTED]?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040447%40antihacker&new=3040447%40antihacker&sfp_email=&sfph_mail=
CVE: CVE-2024-27315
Published: 2024-02-28
Description: An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data.


This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://lists.apache.org/thread/qcwbx7q2s3ynsd405895bx3wcwq32j7z; http://www.openwall.com/lists/oss-security/2024/02/28/3; https://lists.apache.org/thread/qcwbx7q2s3ynsd405895bx3wcwq32j7z
CVE: CVE-2024-1632
Published: 2024-02-28
Description: Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024; https://www.progress.com/sitefinity-cms; https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024
CVE: CVE-2024-1636
Published: 2024-02-28
Description: Potential Cross-Site Scripting (XSS) in the page editing area.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024; https://www.progress.com/sitefinity-cms; https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024
CVE: CVE-2024-24772
Published: 2024-02-28
Description: A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.


Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://lists.apache.org/thread/gfl3ckwy6y9tpz9jmpv62orh2q346sn5; http://www.openwall.com/lists/oss-security/2024/02/28/5; https://lists.apache.org/thread/gfl3ckwy6y9tpz9jmpv62orh2q346sn5
CVE: CVE-2024-24773
Published: 2024-02-28
Description: Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope.
This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1, which fixes the issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863, CWE-863
References: http://www.openwall.com/lists/oss-security/2024/02/28/4; https://lists.apache.org/thread/h66fy6nj41cfx07zh7l552w6dmtjh501; http://www.openwall.com/lists/oss-security/2024/02/28/4
CVE: CVE-2024-24779
Published: 2024-02-28
Description: Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data.
This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2024/02/28/6; https://lists.apache.org/thread/xzhz1m5bb9zxhyqgoy4q2d689b3zp4pq; http://www.openwall.com/lists/oss-security/2024/02/28/6
CVE: CVE-2024-26016
Published: 2024-02-28
Description: A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges.

This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2024/02/28/7; https://lists.apache.org/thread/76v1jjcylgk4p3m0258qr359ook3vl8s; http://www.openwall.com/lists/oss-security/2024/02/28/7
CVE: CVE-2024-1808
Published: 2024-02-28
Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3041647/shortcodes-ultimate; https://www.wordfence.com/threat-intel/vulnerabilities/id/96769a0e-d4a9-4196-8ded-b600046c0943?source=cve; https://plugins.trac.wordpress.org/changeset/3041647/shortcodes-ultimate
CVE: CVE-2024-1965
Published: 2024-02-28
Description: Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products; https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products
CVE: CVE-2024-21885
Published: 2024-02-28
Description: A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://access.redhat.com/errata/RHSA-2024:0320; https://access.redhat.com/errata/RHSA-2024:0557; https://access.redhat.com/errata/RHSA-2024:0558
CVE: CVE-2024-21886
Published: 2024-02-28
Description: A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://access.redhat.com/errata/RHSA-2024:0320; https://access.redhat.com/errata/RHSA-2024:0557; https://access.redhat.com/errata/RHSA-2024:0558
CVE: CVE-2024-24868
Published: 2024-02-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-69-contributor-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-69-contributor-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-25902
Published: 2024-02-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Scanner: from n/a through 4.7.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/miniorange-malware-protection/wordpress-malware-scanner-plugin-4-7-2-admin-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/miniorange-malware-protection/wordpress-malware-scanner-plugin-4-7-2-admin-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-25910
Published: 2024-02-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/moveto/wordpress-moveto-plugin-6-2-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/moveto/wordpress-moveto-plugin-6-2-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-25927
Published: 2024-02-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Joel Starnes postMash – custom post order.This issue affects postMash – custom post order: from n/a through 1.2.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/postmash/wordpress-postmash-custom-post-order-plugin-1-2-0-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/postmash/wordpress-postmash-custom-post-order-plugin-1-2-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-27515
Published: 2024-02-28
Description: Osclass 5.1.2 is vulnerable to SQL Injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/mindstellar/Osclass/issues/495; https://github.com/mindstellar/Osclass/issues/495
CVE: CVE-2023-6917
Published: 2024-02-28
Description: A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-367
References: https://access.redhat.com/errata/RHSA-2024:2213; https://access.redhat.com/security/cve/CVE-2023-6917; https://bugzilla.redhat.com/show_bug.cgi?id=2254983
CVE: CVE-2024-24702
Published: 2024-02-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/pagerestrict/wordpress-page-restrict-plugin-2-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pagerestrict/wordpress-page-restrict-plugin-2-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-24705
Published: 2024-02-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Octa Code Accessibility.This issue affects Accessibility: from n/a through 1.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/accessibility/wordpress-accessibility-plugin-1-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/accessibility/wordpress-accessibility-plugin-1-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-51681
Published: 2024-02-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Duplicator Duplicator – WordPress Migration & Backup Plugin.This issue affects Duplicator – WordPress Migration & Backup Plugin: from n/a through 1.5.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://https://patchstack.com/database/vulnerability/duplicator/wordpress-duplicator-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://https://patchstack.com/database/vulnerability/duplicator/wordpress-duplicator-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-51683
Published: 2024-02-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-ecommerce-paypal/wordpress-easy-paypal-stripe-buy-now-button-plugin-1-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-ecommerce-paypal/wordpress-easy-paypal-stripe-buy-now-button-plugin-1-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-52223
Published: 2024-02-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-mailerlite/wordpress-mailerlite-woocommerce-integration-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-mailerlite/wordpress-mailerlite-woocommerce-integration-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-52226
Published: 2024-02-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/advanced-flamingo/wordpress-advanced-flamingo-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-flamingo/wordpress-advanced-flamingo-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-0560
Published: 2024-02-28
Description: A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-280
References: https://access.redhat.com/security/cve/CVE-2024-0560; https://bugzilla.redhat.com/show_bug.cgi?id=2258456; https://github.com/3scale/APIcast/pull/1438
CVE: CVE-2024-21749
Published: 2024-02-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au 1 click disable all.This issue affects 1 click disable all: from n/a through 1.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/first-graders-toolbox/wordpress-1-click-disable-all-plugin-1-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/first-graders-toolbox/wordpress-1-click-disable-all-plugin-1-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-1847
Published: 2024-02-28
Description: Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted CATPART, IPT, JT, SAT, STL, STP, X_B or X_T file. NOTE: CVE-2024-3298 and CVE-2024-3299 were SPLIT from this ID.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-125, CWE-416, CWE-457, CWE-787
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-26342
Published: 2024-02-28
Description: A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via network packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/Nicholas-wei/bug-discovery/blob/main/asus/2/ASUS_ac68u.md; https://github.com/Nicholas-wei/bug-discovery/blob/main/asus/2/ASUS_ac68u.md
CVE: CVE-2024-27103
Published: 2024-02-28
Description: Querybook is a Big Data Querying UI. When a user searches for their queries, datadocs, tables and lists, the search result is marked and highlighted, and this feature uses dangerouslySetInnerHTML which means that if the highlighted result has an XSS payload it will trigger. While the input to dangerouslySetInnerHTML is not sanitized for the data inside of queries which leads to an XSS vulnerability. During the "query auto-suggestion" the name of the suggested tables are set with innerHTML which leads to the XSS vulnerability. A patch to rectify this issue has been introduced in Querybook version 3.31.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pinterest/querybook/commit/449bdc9e7d679e042c3718b7ed07d2ffa3c46a8f; https://github.com/pinterest/querybook/security/advisories/GHSA-3hjm-9277-5c88; https://github.com/pinterest/querybook/commit/449bdc9e7d679e042c3718b7ed07d2ffa3c46a8f
CVE: CVE-2023-51533
Published: 2024-02-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a through 6.12.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ecwid-shopping-cart/wordpress-ecwid-ecommerce-shopping-cart-plugin-6-12-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ecwid-shopping-cart/wordpress-ecwid-ecommerce-shopping-cart-plugin-6-12-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-51692
Published: 2024-02-28
Description: Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.This issue affects Customer Reviews for WooCommerce: from n/a through 5.38.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/customer-reviews-woocommerce/wordpress-customer-reviews-for-woocommerce-plugin-5-38-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/customer-reviews-woocommerce/wordpress-customer-reviews-for-woocommerce-plugin-5-38-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-27948
Published: 2024-02-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in bytesforall Atahualpa.This issue affects Atahualpa: from n/a through 3.7.24.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/atahualpa/wordpress-atahualpa-theme-3-7-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/atahualpa/wordpress-atahualpa-theme-3-7-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-52047
Published: 2024-02-28
Description: Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/chongfujun/test/blob/main/2023-52047.docx; https://github.com/chongfujun/test/blob/main/2023-52047.docx
CVE: CVE-2023-52048
Published: 2024-02-28
Description: RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/chongfujun/test/blob/main/2023-52048.docx; https://github.com/chongfujun/test/blob/main/2023-52048.docx
CVE: CVE-2024-24148
Published: 2024-02-28
Description: A memory leak issue discovered in parseSWF_FREECHARACTER in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/libming/libming/issues/308; https://github.com/libming/libming/issues/308
CVE: CVE-2024-25169
Published: 2024-02-28
Description: An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/shenhav12/CVE-2024-25169-Mezzanine-v6.0.0; https://ibb.co/JKh4hmD; https://ibb.co/Pt9qd8t
CVE: CVE-2024-25170
Published: 2024-02-28
Description: An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://github.com/shenhav12/CVE-2024-25170-Mezzanine-v6.0.0; https://ibb.co/DpxHpz9; https://ibb.co/T0fhLwR