deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45606
Published: 2024-09-17
Description: Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project.  In our review, we have identified no instances where alerts have been muted by unauthorized parties.  A patch was issued to ensure authorization checks are properly scoped on requests to mute alert rules. Authenticated users who do not have the necessary permissions are no longer able to mute alerts.  Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version **24.9.0** or higher. The rule mute feature was generally available as of 23.6.0 but users with early access may have had the feature as of 23.4.0. Affected users are advised to upgrade to version 24.9.0. There are no known workarounds for this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-639
References: https://github.com/getsentry/self-hosted; https://github.com/getsentry/sentry/pull/77016; https://github.com/getsentry/sentry/security/advisories/GHSA-v345-w9f2-mpm5
CVE: CVE-2024-45811
Published: 2024-09-17
Description: Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/vitejs/vite/commit/6820bb3b9a54334f3268fc5ee1e967d2e1c0db34; https://github.com/vitejs/vite/security/advisories/GHSA-9cwx-2883-4wfx
CVE: CVE-2024-45812
Published: 2024-09-17
Description: Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`/`iife`/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. We have identified a DOM Clobbering vulnerability in Vite bundled scripts, particularly when the scripts dynamically import other scripts from the assets folder and the developer sets the build output format to `cjs`, `iife`, or `umd`. In such cases, Vite replaces relative paths starting with `__VITE_ASSET__` using the URL retrieved from `document.currentScript`. However, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server. This vulnerability can result in cross-site scripting (XSS) attacks on websites that include Vite-bundled files (configured with an output format of `cjs`, `iife`, or `umd`) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/vitejs/vite/commit/ade1d89660e17eedfd35652165b0c26905259fad; https://github.com/vitejs/vite/security/advisories/GHSA-64vr-g452-qvp3; https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
CVE: CVE-2024-8951
Published: 2024-09-17
Description: A vulnerability classified as problematic was found in SourceCodester Resort Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_fee.php. The manipulation of the argument toview leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-Resort-Reservation-system-XSS.md; https://vuldb.com/?ctiid.277777; https://vuldb.com/?id.277777
CVE: CVE-2024-8956
Published: 2024-09-17
Description: PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306, CWE-287
References: https://ptzoptics.com/firmware-changelog/; https://vulncheck.com/advisories/ptzoptics-insufficient-auth; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956
CVE: CVE-2024-45815
Published: 2024-09-17
Description: Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend`. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321
References: https://github.com/backstage/backstage/security/advisories/GHSA-3x3f-jcp3-g22j
CVE: CVE-2024-45816
Published: 2024-09-17
Description: Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://github.com/backstage/backstage/security/advisories/GHSA-39v3-f278-vj3g
CVE: CVE-2024-46976
Published: 2024-09-17
Description: Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-693, CWE-79
References: https://github.com/backstage/backstage/security/advisories/GHSA-5j94-f3mf-8685
CVE: CVE-2024-8904
Published: 2024-09-17
Description: Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/365376497
CVE: CVE-2024-8905
Published: 2024-09-17
Description: Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-122
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/359949835
CVE: CVE-2024-8906
Published: 2024-09-17
Description: Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/352681108
CVE: CVE-2024-8907
Published: 2024-09-17
Description: Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (XSS) via a crafted set of UI gestures. (Chromium security severity: Medium)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/360642942
CVE: CVE-2024-8908
Published: 2024-09-17
Description: Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/337222641
CVE: CVE-2024-8909
Published: 2024-09-17
Description: Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/341353783
CVE: CVE-2024-8957
Published: 2024-09-17
Description: PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://ptzoptics.com/firmware-changelog/; https://vulncheck.com/advisories/ptzoptics-command-injection; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957
CVE: CVE-2024-46982
Published: 2024-09-17
Description: Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3; https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda; https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9
CVE: CVE-2024-37985
Published: 2024-09-17
Description: Windows Kernel Information Disclosure Vulnerability
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1037
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37985
CVE: CVE-2024-43938
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.29.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/name-directory/vulnerability/wordpress-name-directory-plugin-1-29-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43969
Published: 2024-09-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.12.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-12-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-43976
Published: 2024-09-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through <= 6.9.7.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-plugin-6-9-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-43977
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-plugin-5-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43978
Published: 2024-09-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through < 6.9.8.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-plugin-6-9-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-43985
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagePeople Team Bus Ticket Booking with Seat Reservation allows Stored XSS.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.3.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bus-ticket-booking-with-seat-reservation/wordpress-bus-ticket-booking-with-seat-reservation-plugin-5-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44004
Published: 2024-09-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wpcargo/vulnerability/wordpress-wpcargo-track-trace-plugin-7-0-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-44007
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Templates – Elementor & Gutenberg templates skt-templates allows Reflected XSS.This issue affects SKT Templates – Elementor & Gutenberg templates: from n/a through <= 6.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/skt-templates/vulnerability/wordpress-skt-templates-elementor-gutenberg-templates-plugin-6-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44008
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Stored XSS.This issue affects  Geo Mashup: from n/a through <= 1.13.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44009
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Reflected XSS.This issue affects WCFM Marketplace: from n/a through <= 3.6.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-3-6-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44047
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through <= 3.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/idx-broker-platinum/vulnerability/wordpress-impress-for-idx-broker-plugin-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44049
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/unlimited-blocks/vulnerability/wordpress-gutenberg-blocks-unlimited-blocks-for-gutenberg-plugin-1-2-7-authenticated-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44050
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Verbosa verbosa allows Stored XSS.This issue affects Verbosa: from n/a through <= 1.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/verbosa/vulnerability/wordpress-verbosa-theme-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44051
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) custom-post-widget allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a through <= 3.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-post-widget/vulnerability/wordpress-content-blocks-custom-post-widget-plugin-3-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44064
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LikeBtn Like Button Rating likebtn-like-button.This issue affects Like Button Rating: from n/a through <= 2.6.53.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/likebtn-like-button/vulnerability/wordpress-like-button-rating-likebtn-plugin-2-6-53-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45451
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Roseta roseta allows Stored XSS.This issue affects Roseta: from n/a through <= 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/roseta/vulnerability/wordpress-roseta-theme-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45452
Published: 2024-09-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Septera septera allows Stored XSS.This issue affects Septera: from n/a through <= 1.5.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/septera/vulnerability/wordpress-septera-theme-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43970
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SureCart allows Reflected XSS.This issue affects SureCart: from n/a through 2.29.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/surecart/wordpress-surecart-plugin-2-29-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43971
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-free-client-photo-galleries-for-photographers-plugin-3-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43972
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pagelayer Team PageLayer allows Stored XSS.This issue affects PageLayer: from n/a through 1.8.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/pagelayer/wordpress-page-builder-pagelayer-drag-and-drop-website-builder-plugin-1-8-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43975
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through <= 6.9.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-plugin-6-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43983
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-4-1-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43987
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wayneconnor Sliding Door allows Stored XSS.This issue affects Sliding Door: from n/a through 3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sliding-door/wordpress-sliding-door-theme-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve