deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-33966
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following  'xtsearch' in '/admin/mod_reports/index.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33967
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following  'view' in 'Attendance' and 'YearLevel' in '/AttendanceMonitoring/report/attendance_print.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33968
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following  'Attendance' and 'YearLevel' in '/AttendanceMonitoring/report/index.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33969
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following  'id' in '/AttendanceMonitoring/department/index.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33970
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following  'studid' in '/candidate/controller.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33971
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following   'username' in '/login.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33972
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following    'events' in '/report/event_print.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33973
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following    'Attendance' and 'YearLevel' in '/report/attendance_print.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33974
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'Users in '/report/printlogs.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33982
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'StudentID' parameter in '/AttendanceMonitoring/student/controller.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33983
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the  'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/attendance_print.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33984
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the  'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33985
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the  'View' parameter in '/course/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33986
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the  'View' parameter in '/department/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33987
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the  'Attendance', 'attenddate', 'YearLevel', 'eventdate', 'events', 'Users' and 'YearLevel' parameters in '/report/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33988
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the  'Attendance', 'attenddate' and 'YearLevel' parameters in '/report/attendance_print.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33989
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'eventdate' and 'events' parameters in 'port/event_print.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33990
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'id' and 'view' parameters in '/user/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33991
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/eventwinner/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33992
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/student/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33993
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in /candidate/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33994
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in '/event/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-43114
Published: 2024-08-06
Description: In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions
CVSS Score: 7.5 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-6357
Published: 2024-08-06
Description: Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://portal.microfocus.com/s/article/KM000032593
CVE: CVE-2024-6358
Published: 2024-08-06
Description: Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://portal.microfocus.com/s/article/KM000032595
CVE: CVE-2024-6359
Published: 2024-08-06
Description: Privilege escalation vulnerability identified in OpenText ArcSight Intelligence.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-269
References: https://portal.microfocus.com/s/article/KM000032594
CVE: CVE-2024-7518
Published: 2024-08-06
Description: Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1875354; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-35/
CVE: CVE-2024-7519
Published: 2024-08-06
Description: Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1902307; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-34/
CVE: CVE-2024-7520
Published: 2024-08-06
Description: A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-94
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1903041; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-35/
CVE: CVE-2024-7521
Published: 2024-08-06
Description: Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
CVSS Score: 8.8 (HIGH)
CWE: CWE-755, CWE-755
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1904644; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-34/
CVE: CVE-2024-7522
Published: 2024-08-06
Description: Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1906727; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-34/
CVE: CVE-2024-7523
Published: 2024-08-06
Description: A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. 
*This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1908344; https://www.mozilla.org/security/advisories/mfsa2024-33/
CVE: CVE-2024-7524
Published: 2024-08-06
Description: Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection.  On a site protected by Content Security Policy in "strict-dynamic" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1909241; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-34/
CVE: CVE-2024-7525
Published: 2024-08-06
Description: It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
CVSS Score: 8.1 (HIGH)
CWE: CWE-276, CWE-284
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1909298; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-34/
CVE: CVE-2024-7526
Published: 2024-08-06
Description: ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1910306; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-34/
CVE: CVE-2024-7527
Published: 2024-08-06
Description: Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1871303; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-34/
CVE: CVE-2024-7528
Published: 2024-08-06
Description: Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1895951; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-35/
CVE: CVE-2024-7529
Published: 2024-08-06
Description: The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1903187; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-34/
CVE: CVE-2024-7530
Published: 2024-08-06
Description: Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1904011; https://www.mozilla.org/security/advisories/mfsa2024-33/
CVE: CVE-2024-7531
Published: 2024-08-06
Description: Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-367
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1905691; https://www.mozilla.org/security/advisories/mfsa2024-33/; https://www.mozilla.org/security/advisories/mfsa2024-34/
CVE: CVE-2024-7551
Published: 2024-08-06
Description: A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as problematic. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273696. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: https://github.com/DeepMountains/Mirage/blob/main/CVE9-1.md; https://vuldb.com/?ctiid.273696; https://vuldb.com/?id.273696
CVE: CVE-2023-40819
Published: 2024-08-06
Description: ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-233
References: https://miguelsantareno.github.io/id4Portais.txt; https://www.id4software.com/
CVE: CVE-2024-30170
Published: 2024-08-06
Description: PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-400
References: https://info.ssh.com/improper-input-validation-faq; https://privx.docs.ssh.com/docs/security
CVE: CVE-2024-33897
Published: 2024-08-06
Description: A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-425, CWE-425
References: https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/; https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf; https://www.ewon.biz/products/cosy/ewon-cosy-wifi
CVE: CVE-2024-40101
Published: 2024-08-06
Description: A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://microweber.com; https://github.com/microweber/microweber/commit/0dede6886c6df3d1f31c4f4e3ba1ab4a336fbf79; https://seclists.org/fulldisclosure/2024/Aug/1
CVE: CVE-2024-41226
Published: 2024-08-06
Description: A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. The payload is being injected in the http Response from the client-side, so the owner of the Response and payload is the end user in this case. They contend that the server's security controls have no impact or role to play in this situation and therefore this is not a valid vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://medium.com/%40aksalsalimi/cve-2024-41226-response-manipulation-led-to-csv-injection-9ae3182dcc02; https://www.automationanywhere.com/products/automation-360
CVE: CVE-2024-41910
Published: 2024-08-06
Description: A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices.  The firmware contained multiple XSS vulnerabilities in the version of JavaScript used.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.hp.com/us-en/document/ish_1[PII_REDACTED]7005-16/hpsbpy03960
CVE: CVE-2024-41911
Published: 2024-08-06
Description: A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.hp.com/us-en/document/ish_1[PII_REDACTED]6795-16/hpsbpy03959