deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-26815
Published: 2024-04-10
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check

taprio_parse_tc_entry() is not correctly checking
TCA_TAPRIO_TC_ENTRY_INDEX attribute:

	int tc; // Signed value

	tc = nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]);
	if (tc >= TC_QOPT_MAX_QUEUE) {
		NL_SET_ERR_MSG_MOD(extack, "TC entry index out of range");
		return -ERANGE;
	}

syzbot reported that it could fed arbitary negative values:

UBSAN: shift-out-of-bounds in net/sched/sch_taprio.c:1722:18
shift exponent [PII_REDACTED] is negative
CPU: 0 PID: 5066 Comm: syz-executor367 Not tainted 6.8.0-rc7-syzkaller-00136-gc8a5c731fd12 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
 <TASK>
  __dump_stack lib/dump_stack.c:88 [inline]
  dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
  ubsan_epilogue lib/ubsan.c:217 [inline]
  __ubsan_handle_shift_out_of_bounds+0x3c7/0x420 lib/ubsan.c:386
  taprio_parse_tc_entry net/sched/sch_taprio.c:1722 [inline]
  taprio_parse_tc_entries net/sched/sch_taprio.c:1768 [inline]
  taprio_change+0xb87/0x57d0 net/sched/sch_taprio.c:1877
  taprio_init+0x9da/0xc80 net/sched/sch_taprio.c:2134
  qdisc_create+0x9d4/0x1190 net/sched/sch_api.c:1355
  tc_modify_qdisc+0xa26/0x1e40 net/sched/sch_api.c:1776
  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6617
  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543
  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367
  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908
  sock_sendmsg_nosec net/socket.c:730 [inline]
  __sock_sendmsg+0x221/0x270 net/socket.c:745
  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
  ___sys_sendmsg net/socket.c:2638 [inline]
  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
 do_syscall_64+0xf9/0x240
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f1b2dea3759
Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4de452f8 EFLAGS: 00000246 ORIG_RAX:[PII_REDACTED]00002e
RAX: ffffffffffffffda RBX: 00007f1b2def0390 RCX: 00007f1b2dea3759
RDX: [PII_REDACTED] RSI:[PII_REDACTED]0007c0 RDI: [PII_REDACTED]
RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: [PII_REDACTED]
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: 00007ffd4de45340
R13: 00007ffd4de45310 R14: [PII_REDACTED] R15: 00007ffd4de45340
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/343041b59b7810f9cdca371f445dd43b35c740b1; https://git.kernel.org/stable/c/6915b1b28fe57e92c78e664366dc61c4f15ff03b; https://git.kernel.org/stable/c/860e838fb089d652a446ced52cbdf051285b68e7
CVE: CVE-2024-2243
Published: 2024-04-10
Description: A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.
CVSS Score: 7.6 (HIGH)
CWE: CWE-78
References: https://access.redhat.com/security/cve/CVE-2024-2243; https://bugzilla.redhat.com/show_bug.cgi?id=2267336; https://access.redhat.com/security/cve/CVE-2024-2243
CVE: CVE-2024-20758
Published: 2024-04-10
Description: Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/magento/apsb24-18.html; https://helpx.adobe.com/security/products/magento/apsb24-18.html
CVE: CVE-2024-20759
Published: 2024-04-10
Description: Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality and integrity are considered high due to having admin impact.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb24-18.html; https://helpx.adobe.com/security/products/magento/apsb24-18.html
CVE: CVE-2024-23076
Published: 2024-04-10
Description: JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://jfreechart.com; https://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518; https://github.com/jfree/jfreechart
CVE: CVE-2024-31309
Published: 2024-04-10
Description: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.

Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2024/04/03/16; http://www.openwall.com/lists/oss-security/2024/04/10/7; https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc
CVE: CVE-2024-20766
Published: 2024-04-10
Description: InDesign Desktop versions 18.5.1, 19.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb24-20.html; https://helpx.adobe.com/security/products/indesign/apsb24-20.html
CVE: CVE-2024-20770
Published: 2024-04-10
Description: Photoshop Desktop versions 24.7.2, 25.3.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb24-16.html; https://helpx.adobe.com/security/products/photoshop/apsb24-16.html
CVE: CVE-2024-20772
Published: 2024-04-10
Description: Media Encoder versions 24.2.1, 23.6.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/media-encoder/apsb24-23.html; https://helpx.adobe.com/security/products/media-encoder/apsb24-23.html
CVE: CVE-2024-23080
Published: 2024-04-10
Description: Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-476
References: http://joda.com; https://gist.github.com/LLM4IG/6614bfa658295d7af07a6d37e06db27f; https://github.com/JodaOrg/joda-time
CVE: CVE-2024-31492
Published: 2024-04-10
Description: An external control of file name or path vulnerability [CWE-73] in  FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process.
CVSS Score: 8.2 (HIGH)
CWE: CWE-73
References: https://fortiguard.com/psirt/FG-IR-23-345; https://fortiguard.com/psirt/FG-IR-23-345
CVE: CVE-2024-31924
Published: 2024-04-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in nosilver4u EWWW Image Optimizer ewww-image-optimizer.This issue affects EWWW Image Optimizer: from n/a through <= 7.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ewww-image-optimizer/vulnerability/wordpress-ewww-image-optimizer-plugin-7-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ewww-image-optimizer/wordpress-ewww-image-optimizer-plugin-7-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-23083
Published: 2024-04-10
Description: Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: http://time4j.com; https://gist.github.com/LLM4IG/624598834f6699e3617d47c675227e97; https://github.com/MenoData/Time4J
CVE: CVE-2024-26816
Published: 2024-04-10
Description: In the Linux kernel, the following vulnerability has been resolved:

x86, relocs: Ignore relocations in .notes section

When building with CONFIG_XEN_PV=y, .text symbols are emitted into
the .notes section so that Xen can find the "startup_xen" entry point.
This information is used prior to booting the kernel, so relocations
are not useful. In fact, performing relocations against the .notes
section means that the KASLR base is exposed since /sys/kernel/notes
is world-readable.

To avoid leaking the KASLR base without breaking unprivileged tools that
are expecting to read /sys/kernel/notes, skip performing relocations in
the .notes section. The values readable in .notes are then identical to
those found in System.map.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://git.kernel.org/stable/c/13edb509abc91c72152a11baaf0e7c060a312e03; https://git.kernel.org/stable/c/47635b112a64b7b[PII_REDACTED]71e7e42f110e723; https://git.kernel.org/stable/c/52018aa146e3cf76569a9b1e6e49a2b7c8d4a088
CVE: CVE-2024-2730
Published: 2024-04-10
Description: Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public preview URLs which could expose sensitive data. At the time of publication of the CVE no patch is available 


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://huntr.com/bounties/cd3321a4-9ebc-48fa-8d4c-b5720089c2d9; https://huntr.com/bounties/cd3321a4-9ebc-48fa-8d4c-b5720089c2d9
CVE: CVE-2024-2731
Published: 2024-04-10
Description: Users with low privileges (all permissions deselected in the administrator permissions settings) can view certain pages that expose sensitive information such as company names, users' names and surnames, stage names, and monitoring campaigns and their descriptions. In addition, unprivileged users can see and edit the descriptions of tags. At the time of publication of the CVE no patch is available.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0; https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0
CVE: CVE-2024-3448
Published: 2024-04-10
Description: Users with low privileges can perform certain AJAX actions.  In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0; https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0
CVE: CVE-2024-24809
Published: 2024-04-10
Description: Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
CVSS Score: 8.5 (HIGH)
CWE: CWE-27, CWE-434
References: https://github.com/traccar/traccar/commit/b099b298f90074c825ba68ce73532933c7b9d901; https://github.com/traccar/traccar/security/advisories/GHSA-vhrw-72f6-gwp5; https://github.com/traccar/traccar/commit/b099b298f90074c825ba68ce73532933c7b9d901
CVE: CVE-2024-27474
Published: 2024-04-10
Description: Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://drive.proton.me/urls/67VER05Z84#f0fXnmp8o6Y9; https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Users/Controllers/NewUser.php#L16; https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md
CVE: CVE-2024-27476
Published: 2024-04-10
Description: Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-94
References: https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY; https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20; https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md
CVE: CVE-2024-27477
Published: 2024-04-10
Description: In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.proton.me/urls/35CKB8RV04#sEubCKVOuXqt; https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20; https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md
CVE: CVE-2024-29296
Published: 2024-04-10
Description: A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-286
References: http://portainer.com; https://github.com/ThaySolis/CVE-2024-29296; http://portainer.com
CVE: CVE-2024-3567
Published: 2024-04-10
Description: A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://access.redhat.com/errata/RHSA-2025:4492; https://access.redhat.com/security/cve/CVE-2024-3567; https://bugzilla.redhat.com/show_bug.cgi?id=2274339
CVE: CVE-2023-6916
Published: 2024-04-10
Description: Audit records for OpenAPI requests may include sensitive information.



This could lead to unauthorized accesses and privilege escalation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-201
References: https://security.nozominetworks.com/NN-2023:17-01; https://security.nozominetworks.com/NN-2023:17-01
CVE: CVE-2024-0218
Published: 2024-04-10
Description: A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian, caused by improper input validation in certain fields used in the Radius parsing functionality of our IDS, allows an unauthenticated attacker sending specially crafted malformed network packets to cause the IDS module to stop updating nodes, links, and assets.



Network traffic may not be analyzed until the IDS module is restarted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1286
References: https://security.nozominetworks.com/NN-2024:1-01; https://security.nozominetworks.com/NN-2024:1-01
CVE: CVE-2024-23734
Published: 2024-04-10
Description: Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attackers to replace S/MIME certificate or PGP keys for arbitrary users via crafted link.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-352
References: https://help.savignano.net/snotify-email-encryption/sa-2023-11-28; https://help.savignano.net/snotify-email-encryption/security-advisories; https://help.savignano.net/snotify-email-encryption/sa-2023-11-28
CVE: CVE-2024-23735
Published: 2024-04-10
Description: Cross Site Scripting (XSS) vulnerability in in the S/MIME certificate upload functionality of the User Profile pages in savignano S/Notify before 4.0.0 for Confluence allows attackers to manipulate user data via specially crafted certificate.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://help.savignano.net/snotify-email-encryption/sa-2023-11-02; https://help.savignano.net/snotify-email-encryption/security-advisories; https://help.savignano.net/snotify-email-encryption/sa-2023-11-02
CVE: CVE-2024-31240
Published: 2024-04-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in InfoTheme WP Poll Maker.This issue affects WP Poll Maker: from n/a through 3.1.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/epoll-wp-voting/wordpress-wp-poll-maker-plugin-3-1-subscriber-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/epoll-wp-voting/wordpress-wp-poll-maker-plugin-3-1-subscriber-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-31245
Published: 2024-04-10
Description: Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/convertkit/wordpress-convertkit-plugin-2-4-5-email-disclosure-in-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/convertkit/wordpress-convertkit-plugin-2-4-5-email-disclosure-in-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-31247
Published: 2024-04-10
Description: Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/fg-drupal-to-wp/wordpress-fg-drupal-to-wordpress-plugin-3-70-3-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fg-drupal-to-wp/wordpress-fg-drupal-to-wordpress-plugin-3-70-3-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-31249
Published: 2024-04-10
Description: Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/subscribe-to-comments-reloaded/wordpress-subscribe-to-comments-reloaded-plugin-220725-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/subscribe-to-comments-reloaded/wordpress-subscribe-to-comments-reloaded-plugin-220725-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-31253
Published: 2024-04-10
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.This issue affects OAuth Server: from n/a through 4.3.3.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/oauth2-provider/wordpress-wp-oauth-server-oauth-authentication-plugin-4-3-3-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/oauth2-provider/wordpress-wp-oauth-server-oauth-authentication-plugin-4-3-3-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-31254
Published: 2024-04-10
Description: Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.7.
CVSS Score: 3.7 (LOW)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/wp-migration-duplicator/wordpress-wordpress-backup-migration-plugin-1-4-7-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-migration-duplicator/wordpress-wordpress-backup-migration-plugin-1-4-7-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-31259
Published: 2024-04-10
Description: Insertion of Sensitive Information into Log File vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/searchiq/wordpress-searchiq-plugin-4-5-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/searchiq/wordpress-searchiq-plugin-4-5-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-31278
Published: 2024-04-10
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.22.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-201, CWE-922
References: https://patchstack.com/database/Wordpress/Plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-10-22-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/premium-addons-for-elementor/wordpress-premium-addons-for-elementor-plugin-4-10-22-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-31282
Published: 2024-04-10
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.This issue affects App Builder: from n/a through 3.8.7.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/app-builder/wordpress-app-builder-plugin-3-8-7-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/app-builder/wordpress-app-builder-plugin-3-8-7-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-31287
Published: 2024-04-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/media-library-plus/wordpress-media-library-folders-plugin-8-1-8-directory-traversal-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/media-library-plus/wordpress-media-library-folders-plugin-8-1-8-directory-traversal-vulnerability?_s_id=cve