deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1821
Published: 2024-02-23
Description: A vulnerability was found in code-projects Crime Reporting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file police_add.php. The manipulation of the argument police_name/police_id/police_spec/password leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-254609 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/jxp98/VulResearch/blob/main/2024/02/2Crime%20Reporting%20System%20-%20SQL%20Injection-police_add.md; https://vuldb.com/?ctiid.254609; https://vuldb.com/?id.254609
CVE: CVE-2024-1822
Published: 2024-02-23
Description: A vulnerability classified as problematic has been found in PHPGurukul Tourism Management System 1.0. Affected is an unknown function of the file user-bookings.php. The manipulation of the argument Full Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-254610 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1ulzFlRqsex39dDUOFU2LbmphrQblSAwn/view?usp=drive_link; https://vuldb.com/?ctiid.254610; https://vuldb.com/?id.254610
CVE: CVE-2024-1823
Published: 2024-02-23
Description: A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file users.php of the component Backend. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254611.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://docs.qq.com/doc/DYll0ZEFKcUdGYlNr; https://vuldb.com/?ctiid.254611; https://vuldb.com/?id.254611
CVE: CVE-2024-1824
Published: 2024-02-23
Description: A vulnerability, which was classified as critical, has been found in CodeAstro House Rental Management System 1.0. Affected by this issue is some unknown functionality of the file signing.php. The manipulation of the argument uname/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254612.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://docs.qq.com/doc/DYk9QcHVFRENObWtj; https://vuldb.com/?ctiid.254612; https://vuldb.com/?id.254612
CVE: CVE-2024-26150
Published: 2024-02-23
Description: `@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. This issue is patched in `@backstage/backend-common` versions 0.21.1, 0.20.2, and 0.19.10.
CVSS Score: 8.7 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/backstage/backstage/commit/1ad2b1b61ebb430051f7d804b0cc7ebfe7922b6f; https://github.com/backstage/backstage/commit/78f892b3a84d63de2ba167928f171154c447b717; https://github.com/backstage/backstage/commit/edf65d7d31e027599c2415f597d085ee84807871
CVE: CVE-2023-51392
Published: 2024-02-23
Description: Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1240, CWE-327
References: https://community.silabs.com/068Vm000001BKm6; https://community.silabs.com/068Vm000001BKm6
CVE: CVE-2024-1825
Published: 2024-02-23
Description: A vulnerability, which was classified as problematic, was found in CodeAstro House Rental Management System 1.0. This affects an unknown part of the component User Registration Page. The manipulation of the argument address with the input <img src="1" onerror="console.log(1)"> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254613 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://docs.qq.com/doc/DYndSY3V4UXh4dHFC; https://vuldb.com/?ctiid.254613; https://vuldb.com/?id.254613
CVE: CVE-2024-1826
Published: 2024-02-23
Description: A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file Source/librarian/user/student/login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-254614 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/jxp98/VulResearch/blob/main/2024/02/3Library%20System%20In%20PHP%20-%20SQL%20Injection-student_login.md; https://vuldb.com/?ctiid.254614; https://vuldb.com/?id.254614
CVE: CVE-2024-23320
Published: 2024-02-23
Description: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.

This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.

This issue affects Apache DolphinScheduler: until 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2024/02/23/3; https://github.com/apache/dolphinscheduler/pull/15487; https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq
CVE: CVE-2024-1827
Published: 2024-02-23
Description: A vulnerability was found in code-projects Library System 1.0 and classified as critical. This issue affects some unknown processing of the file Source/librarian/user/teacher/login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254615.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/jxp98/VulResearch/blob/main/2024/02/3.2Library%20System%20In%20PHP%20-%20SQL%20Injection-teacher_login.md; https://vuldb.com/?ctiid.254615; https://vuldb.com/?id.254615
CVE: CVE-2024-1828
Published: 2024-02-23
Description: A vulnerability was found in code-projects Library System 1.0. It has been classified as critical. Affected is an unknown function of the file Source/librarian/user/teacher/registration.php. The manipulation of the argument email/idno/phone/username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254616.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/jxp98/VulResearch/blob/main/2024/02/3.3Library%20System%20In%20PHP%20-%20SQL%20Injection-teacher_reg.md; https://vuldb.com/?ctiid.254616; https://vuldb.com/?id.254616
CVE: CVE-2024-1829
Published: 2024-02-23
Description: A vulnerability was found in code-projects Library System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file Source/librarian/user/student/registration.php. The manipulation of the argument email/regno/phone/username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254617 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/jxp98/VulResearch/blob/main/2024/02/3.4Library%20System%20In%20PHP%20-%20SQL%20Injection-student_reg.md; https://vuldb.com/?ctiid.254617; https://vuldb.com/?id.254617
CVE: CVE-2024-27318
Published: 2024-02-23
Description: Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/onnx/onnx/commit/66b7fb630903fdcf3e83b6b6d56d82e904264a20; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/
CVE: CVE-2024-27319
Published: 2024-02-23
Description: Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/
CVE: CVE-2022-43842
Published: 2024-02-23
Description: IBM Aspera Console 3.4.0 through 3.4.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.  IBM X-Force ID:  239079.
CVSS Score: 8.6 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239079; https://www.ibm.com/support/pages/node/7122632; https://exchange.xforce.ibmcloud.com/vulnerabilities/239079
CVE: CVE-2024-1830
Published: 2024-02-23
Description: A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file Source/librarian/user/student/lost-password.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254618 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/jxp98/VulResearch/blob/main/2024/02/3.5Library%20System%20In%20PHP%20-%20SQL%20Injection-student_lostpass.md; https://vuldb.com/?ctiid.254618; https://vuldb.com/?id.254618
CVE: CVE-2024-1831
Published: 2024-02-23
Description: A vulnerability, which was classified as critical, was found in SourceCodester Complete File Management System 1.0. Affected is an unknown function of the file users/index.php of the component Login Form. The manipulation of the argument username with the input torada%27+or+%271%27+%3D+%271%27+--+- leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-254622 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://toradah.notion.site/Login-Bypass-via-SQL-injection-b1e45264f6104bc696836ade6e60fb98?pvs=4; https://vuldb.com/?ctiid.254622; https://vuldb.com/?id.254622
CVE: CVE-2023-51393
Published: 2024-02-23
Description: Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (delivered as part of Silicon Labs Gecko SDK v4.4.0) which may enable attackers to trigger a bus fault and crash of the device, requiring a reboot in order to rejoin the network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://community.silabs.com/068Vm000001NaAM; https://community.silabs.com/068Vm000001NaAM
CVE: CVE-2023-51394
Published: 2024-02-23
Description: High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://community.silabs.com/068Vm000001NL4u; https://community.silabs.com/068Vm000001NL4u
CVE: CVE-2024-1832
Published: 2024-02-23
Description: A vulnerability has been found in SourceCodester Complete File Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/ of the component Admin Login Form. The manipulation of the argument username with the input torada%27+or+%271%27+%3D+%271%27+--+- leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254623.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://toradah.notion.site/SQL-Injection-via-Admin-Login-Form[PII_REDACTED]cb4bb996ae2c9effb0266a?pvs=25; https://vuldb.com/?ctiid.254623; https://vuldb.com/?id.254623
CVE: CVE-2024-1833
Published: 2024-02-23
Description: A vulnerability was found in SourceCodester Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Account/login.php. The manipulation of the argument txtusername/txtphone leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/employee-management-system.md#2accountloginphp; https://vuldb.com/?ctiid.254624; https://vuldb.com/?id.254624
CVE: CVE-2024-1834
Published: 2024-02-23
Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as problematic. This affects an unknown part of the file ?page=attendance&class_id=1. The manipulation of the argument class_date with the input 2024-02-23%22%3E%3Cscript%3Ealert(1)%3C/script%3E leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254625 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-Student-Attendance-System.md#2pageattendancexss; https://vuldb.com/?ctiid.254625; https://vuldb.com/?id.254625
CVE: CVE-2021-33072
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33084
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33085
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33099
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33100
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33102
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33109
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33111
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33112
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33116
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33121
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33125
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33127
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33131
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33132
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33133
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33134
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33136
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33138
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33140
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33141
Published: 2024-02-23
Description: Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html
CVE: CVE-2021-33142
Published: 2024-02-23
Description: Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html
CVE: CVE-2021-33143
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33144
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33145
Published: 2024-02-23
Description: Uncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-248
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html
CVE: CVE-2021-33146
Published: 2024-02-23
Description: Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-200
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html
CVE: CVE-2021-33148
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33151
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33152
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33153
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33154
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33156
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33157
Published: 2024-02-23
Description: Insufficient control flow management in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-691
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html
CVE: CVE-2021-33158
Published: 2024-02-23
Description: Improper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-86
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html
CVE: CVE-2021-33160
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33161
Published: 2024-02-23
Description: Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html
CVE: CVE-2021-33162
Published: 2024-02-23
Description: Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html
CVE: CVE-2021-33163
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33165
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-33167
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-37405
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-3885
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41851
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41852
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41853
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41854
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41855
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41856
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41857
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41858
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41859
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-41860
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-43351
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2021-44457
Published: 2024-02-23
Description: Rejected reason: This is unused.
CVE: CVE-2024-21423
Published: 2024-02-23
Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21423; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21423
CVE: CVE-2024-24309
Published: 2024-02-23
Description: In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://security.friendsofpresta.org/modules/2024/02/20/ecomiz_survey_tma.html; https://www.ecomiz.com/; https://security.friendsofpresta.org/modules/2024/02/20/ecomiz_survey_tma.html
CVE: CVE-2024-24310
Published: 2024-02-23
Description: In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation <= 1.2.0 for PrestaShop, a guest can perform SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://addons.prestashop.com/en/preparation-shipping/24123-generate-barcode-on-invoice-delivery-slip.html; https://security.friendsofpresta.org/modules/2024/02/20/ecgeneratebarcode.html; https://addons.prestashop.com/en/preparation-shipping/24123-generate-barcode-on-invoice-delivery-slip.html
CVE: CVE-2024-25730
Published: 2024-02-23
Description: Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insufficient entropy (only about one million possibilities).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-331
References: https://github.com/actuator/cve/blob/main/Hitron/CVE-2024-25730; https://i.ebayimg.com/images/g/I-8AAOSwGE9lsGwI/s-l1600.webp; https://i.ebayimg.com/images/g/MwMAAOSwjTFk3kpd/s-l1600.webp