deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-49271
Published: 2024-10-16
Description: Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.121.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-82, CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-1-5-121-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2023-32189
Published: 2024-10-16
Description: Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-639
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32189
CVE: CVE-2024-22029
Published: 2024-10-16
Description: Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22029
CVE: CVE-2024-22030
Published: 2024-10-16
Description: A vulnerability has been identified within Rancher that can be exploited
 in narrow circumstances through a man-in-the-middle (MITM) attack. An 
attacker would need to have control of an expired domain or execute a 
DNS spoofing/hijacking attack against the domain to exploit this 
vulnerability. The targeted domain is the one used as the Rancher URL.
CVSS Score: 8.0 (HIGH)
CWE: CWE-295
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22030; https://github.com/rancher/rancher/security/advisories/GHSA-h4h5-9833-v2p4
CVE: CVE-2024-22032
Published: 2024-10-16
Description: A vulnerability has been identified in which an RKE1 cluster keeps 
constantly reconciling when secrets encryption configuration is enabled.
 When reconciling, the Kube API secret values are written in plaintext 
on the AppliedSpec. Cluster owners, Cluster members, and Project members
 (for projects within the cluster), all have RBAC permissions to view 
the cluster object from the apiserver.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22032; https://github.com/rancher/rancher/security/advisories/GHSA-q6c7-56cq-g2wm
CVE: CVE-2024-22033
Published: 2024-10-16
Description: The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22033
CVE: CVE-2024-22034
Published: 2024-10-16
Description: Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim
CVSS Score: 5.5 (MEDIUM)
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22034
CVE: CVE-2024-47351
Published: 2024-10-16
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.This issue affects MaxSlider: from n/a through <= 1.2.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/maxslider/vulnerability/wordpress-maxslider-plugin-1-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-47637
Published: 2024-10-16
Description: Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-6-4-1-path-traversal-vulnerability?_s_id=cve
CVE: CVE-2024-47645
Published: 2024-10-16
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows PHP Local File Inclusion.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/wpoptin/vulnerability/wordpress-wpoptin-plugin-2-0-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-47649
Published: 2024-10-16
Description: Unrestricted Upload of File with Dangerous Type vulnerability in THATplugin Iconize iconize.This issue affects Iconize: from n/a through <= 1.2.4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/iconize/vulnerability/wordpress-iconize-plugin-1-2-4-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-48026
Published: 2024-10-16
Description: Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through <= 1.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/disc-golf-manager/vulnerability/wordpress-disc-golf-manager-plugin-1-0-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-48027
Published: 2024-10-16
Description: Unrestricted Upload of File with Dangerous Type vulnerability in xaraartech External featured image from bing external-featured-image-from-bing allows Upload a Web Shell to a Web Server.This issue affects External featured image from bing: from n/a through <= 1.0.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/external-featured-image-from-bing/vulnerability/wordpress-external-featured-image-from-bing-plugin-1-0-2-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-48028
Published: 2024-10-16
Description: Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 ip-loc8 allows Object Injection.This issue affects IP Loc8: from n/a through <= 1.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/ip-loc8/vulnerability/wordpress-ip-loc8-plugin-1-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-48029
Published: 2024-10-16
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget sb-random-posts-widget allows PHP Local File Inclusion.This issue affects SB Random Posts Widget: from n/a through <= 1.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/sb-random-posts-widget/vulnerability/wordpress-sb-random-posts-widget-plugin-1-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-48030
Published: 2024-10-16
Description: Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through <= 2.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/telecash-ricaricaweb/vulnerability/wordpress-telecash-ricaricaweb-plugin-2-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-48034
Published: 2024-10-16
Description: Unrestricted Upload of File with Dangerous Type vulnerability in fliperrr Creates 3D Flipbook, PDF Flipbook create-flipbook-from-pdf allows Upload a Web Shell to a Web Server.This issue affects Creates 3D Flipbook, PDF Flipbook: from n/a through <= 1.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/create-flipbook-from-pdf/vulnerability/wordpress-creates-3d-flipbook-pdf-flipbook-plugin-1-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-48035
Published: 2024-10-16
Description: Unrestricted Upload of File with Dangerous Type vulnerability in takayukii ACF Images Search And Insert acf-images-search-and-insert allows Upload a Web Shell to a Web Server.This issue affects ACF Images Search And Insert: from n/a through <= 1.1.4.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/acf-images-search-and-insert/vulnerability/wordpress-acf-images-search-and-insert-plugin-1-1-4-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49216
Published: 2024-10-16
Description: Unrestricted Upload of File with Dangerous Type vulnerability in jclay06 Feed Comments Number feed-comments-number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through <= 0.2.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/feed-comments-number/vulnerability/wordpress-feed-comments-number-plugin-0-2-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49218
Published: 2024-10-16
Description: Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through <= 1.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/recently-viewed-most-viewed-and-sold-products-for-woocommerce/vulnerability/wordpress-recently-plugin-1-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49226
Published: 2024-10-16
Description: Deserialization of Untrusted Data vulnerability in taketin TAKETIN To WP Membership taketin-to-wp-membership allows Object Injection.This issue affects TAKETIN To WP Membership: from n/a through <= 2.8.17.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/taketin-to-wp-membership/vulnerability/wordpress-taketin-to-wp-membership-plugin-2-8-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49227
Published: 2024-10-16
Description: Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through <= 1.5.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/free-stock-photos-foter/vulnerability/wordpress-free-stock-photos-foter-plugin-1-5-4-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49242
Published: 2024-10-16
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery digital-lottery allows Upload a Web Shell to a Web Server.This issue affects Digital Lottery: from n/a through <= 3.0.5.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/digital-lottery/vulnerability/wordpress-digital-lottery-plugin-3-0-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49245
Published: 2024-10-16
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through <= 1.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/ahime-image-printer/vulnerability/wordpress-ahime-image-printer-plugin-1-0-0-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2024-49251
Published: 2024-10-16
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acnoo Maan Addons For Elementor maan-elementor-addons allows Local Code Inclusion.This issue affects Maan Addons For Elementor: from n/a through <= 1.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/maan-elementor-addons/vulnerability/wordpress-maan-addons-for-elementor-plugin-1-0-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-49252
Published: 2024-10-16
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in VaultDweller Leyka leyka.This issue affects Leyka: from n/a through <= 3.31.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/leyka/vulnerability/wordpress-leyka-plugin-3-31-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-49253
Published: 2024-10-16
Description: Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through <= 0.5.
CVSS Score: 8.6 (HIGH)
CWE: CWE-23
References: https://patchstack.com/database/Wordpress/Plugin/analyse-uploads/vulnerability/wordpress-analyse-uploads-plugin-0-5-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-49254
Published: 2024-10-16
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-extend: from n/a through <= 1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/ajax-extend/vulnerability/wordpress-ajax-extend-plugin-1-0-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-49258
Published: 2024-10-16
Description: Path Traversal: '.../...//' vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through <= 1.5.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/limb-gallery/vulnerability/wordpress-limb-gallery-plugin-1-5-7-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2024-49260
Published: 2024-10-16
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery allows Code Injection.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through <= 1.5.7.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/limb-gallery/vulnerability/wordpress-limb-gallery-plugin-1-5-7-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49270
Published: 2024-10-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.This issue affects Smart Blocks: from n/a through <= 2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smart-blocks/vulnerability/wordpress-smart-blocks-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-9893
Published: 2024-10-16
Description: The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://nextendweb.com/social-login/; https://wordpress.org/plugins/nextend-facebook-connect/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4588d1-f21e-48ba-a8cb-d18c421f000a?source=cve
CVE: CVE-2024-45844
Published: 2024-10-16
Description: BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.2 (HIGH)
CWE: CWE-306
References: https://my.f5.com/manage/s/article/K000140061; https://offsec.almond.consulting/privilege-escalation-f5-CVE-2024-45844.html
CVE: CVE-2024-47139
Published: 2024-10-16
Description: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administrator role to run JavaScript in the context of the currently logged-in user.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-80
References: https://my.f5.com/manage/s/article/K000141080
CVE: CVE-2024-48744
Published: 2024-10-16
Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows remote attackers to execute arbitrary code via "searchinput" POST request parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/Teachers%20Record/Reflected%20XSS.pdf
CVE: CVE-2024-49266
Published: 2024-10-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thimo Grauerholz WP-Spreadplugin wp-spreadplugin allows Cross-Site Scripting (XSS).This issue affects WP-Spreadplugin: from n/a through <= 4.8.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-spreadplugin/vulnerability/wordpress-wp-spreadplugin-plugin-4-8-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49267
Published: 2024-10-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Unlimited Addon For Elementor unlimited-addon-for-elementor allows Stored XSS.This issue affects Unlimited Addon For Elementor: from n/a through <= 2.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/unlimited-addon-for-elementor/vulnerability/wordpress-unlimited-addon-for-elementor-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49268
Published: 2024-10-16
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sunburntkamel disconnected allows Reflected XSS.This issue affects disconnected: from n/a through 1.3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/disconnected/wordpress-disconnected-theme-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-9348
Published: 2024-10-16
Description: Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view.
CWE: CWE-20, CWE-116
References: https://docs.docker.com/desktop/release-notes/#4343
CVE: CVE-2024-29155
Published: 2024-10-16
Description: On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is 
received, the device becomes incapable of completing the pairing 
process. A third party can inject a second PairReqNoInputNoOutput request 
just after a real one, causing the pair request to be blocked.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-239
References: https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/SoftwareLibraries/Firmware/RN4870-71-Firmware-1.44.zip; https://www.microchip.com/en-us/product/rn4870
CVE: CVE-2024-49265
Published: 2024-10-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SPBooking.com Booking.com Banner Creator bookingcom-banner-creator.This issue affects Booking.com Banner Creator: from n/a through <= 1.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bookingcom-banner-creator/vulnerability/wordpress-booking-com-banner-creator-plugin-1-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32266
Published: 2024-10-16
Description: Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation.  

This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.
CWE: CWE-426
References: https://portal.microfocus.com/s/article/KM000024386?language=en_US
CVE: CVE-2024-10033
Published: 2024-10-16
Description: A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHSA-2024:8534; https://access.redhat.com/security/cve/CVE-2024-10033; https://bugzilla.redhat.com/show_bug.cgi?id=2319162
CVE: CVE-2024-20280
Published: 2024-10-16
Description: A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files.

This vulnerability is due to a weakness in the encryption method that is used for the backup function. An attacker could exploit this vulnerability by accessing a backup file and leveraging a static key that is used for the backup configuration feature. A successful exploit could allow an attacker with access to a backup file to learn sensitive information that is stored in full state backup files and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and the device SSL server certificate and key.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsc-bkpsky-TgJ5f73J
CVE: CVE-2024-20420
Published: 2024-10-16
Description: A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with low privileges to run commands as an Admin user. 

This vulnerability is due to incorrect authorization verification by the HTTP server. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to run commands as the Admin user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-250, CWE-863
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy
CVE: CVE-2024-20421
Published: 2024-10-16
Description: A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.

This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352, CWE-352, CWE-352
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy
CVE: CVE-2024-20458
Published: 2024-10-16
Description: A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to view or delete the configuration or change the firmware on an affected device.

This vulnerability is due to a lack of authentication on specific HTTP endpoints. An attacker could exploit this vulnerability by browsing to a specific URL. A successful exploit could allow the attacker to view or delete the configuration or change the firmware.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy