deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9248
Published: 2024-11-22
Description: Foxit PDF Reader PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24300.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1302/
CVE: CVE-2024-9249
Published: 2024-11-22
Description: Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24301.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1301/
CVE: CVE-2024-9250
Published: 2024-11-22
Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24489.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1303/
CVE: CVE-2024-9251
Published: 2024-11-22
Description: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24490.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1306/
CVE: CVE-2024-9252
Published: 2024-11-22
Description: Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24491.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1304/
CVE: CVE-2024-9253
Published: 2024-11-22
Description: Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24492.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1305/
CVE: CVE-2024-9254
Published: 2024-11-22
Description: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25173.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1307/
CVE: CVE-2024-9255
Published: 2024-11-22
Description: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25174.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1308/
CVE: CVE-2024-9256
Published: 2024-11-22
Description: Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25267.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-24-1309/
CVE: CVE-2024-9258
Published: 2024-11-22
Description: IrfanView SID File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SID files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23276.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1370/
CVE: CVE-2024-9259
Published: 2024-11-22
Description: IrfanView SID File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SID files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23278.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1372/
CVE: CVE-2024-9260
Published: 2024-11-22
Description: IrfanView SID File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SID files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23280.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1373/
CVE: CVE-2024-9261
Published: 2024-11-22
Description: IrfanView SID File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SID files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23283.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1374/
CVE: CVE-2024-9767
Published: 2024-11-22
Description: IrfanView SID File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SID files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23277.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1371/
CVE: CVE-2024-11296
Published: 2024-11-22
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-11298
Published: 2024-11-22
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-45369
Published: 2024-11-22
Description: The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07
CVE: CVE-2024-47138
Published: 2024-11-22
Description: The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07
CVE: CVE-2024-47407
Published: 2024-11-22
Description: A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07
CVE: CVE-2024-50054
Published: 2024-11-22
Description: The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and retrieve arbitrary files from the file system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-35
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07
CVE: CVE-2024-52034
Published: 2024-11-22
Description: An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07
CVE: CVE-2024-0122
Published: 2024-11-23
Description: NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5570
CVE: CVE-2024-0138
Published: 2024-11-23
Description: NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5595
CVE: CVE-2024-11586
Published: 2024-11-23
Description: Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-404
References: https://bugs.launchpad.net/ubuntu/+source/pulseaudio/+bug/2078822; https://www.cve.org/CVERecord?id=CVE-2024-11586
CVE: CVE-2024-41761
Published: 2024-11-23
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789, CWE-770
References: https://www.ibm.com/support/pages/node/7175947
CVE: CVE-2024-10116
Published: 2024-11-23
Description: The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/twitter-follow/trunk/twitter-follow.php#L34; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3194573%40twitter-follow%2Ftrunk&old=1852833%40twitter-follow%2Ftrunk; https://wordpress.org/plugins/twitter-follow/#developers
CVE: CVE-2024-10216
Published: 2024-11-23
Description: The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_sidebar' and 'remove_sidebar' functions in all versions up to, and including, 2.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add or remove a Carbon Fields custom sidebar if the Carbon Fields (carbon-fields) plugin is installed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-user-manager/trunk/vendor-dist/htmlburger/carbon-fields/core/Libraries/Sidebar_Manager/Sidebar_Manager.php#L102; https://plugins.trac.wordpress.org/browser/wp-user-manager/trunk/vendor-dist/htmlburger/carbon-fields/core/Libraries/Sidebar_Manager/Sidebar_Manager.php#L79; https://plugins.trac.wordpress.org/changeset/3194404/wp-user-manager/trunk/includes/class-wp-user-manager.php
CVE: CVE-2024-10537
Published: 2024-11-23
Description: The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the validate_user_meta_key() function in all versions up to, and including, 2.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate user meta keys.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3194404/wp-user-manager/trunk/includes/actions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9a5b7e-db74-4c66-a659-85b2509fded4?source=cve
CVE: CVE-2024-10813
Published: 2024-11-23
Description: The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1 via the var_dump_table parameter. This makes it possible for unauthenticated attackers var data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/woo-product-table/trunk/inc/shortcode-base.php; https://plugins.trac.wordpress.org/changeset/3195719/woo-product-table/trunk/inc/shortcode-base.php?contextall=1; https://www.wordfence.com/threat-intel/vulnerabilities/id/e67f680a-8942-45fa-8458-a27c78045aa1?source=cve
CVE: CVE-2024-10868
Published: 2024-11-23
Description: The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.9 via the Advanced Tabs widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3195822%40enteraddons%2Ftrunk&old=3148550%40enteraddons%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/enteraddons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ff8e8889-ec02-4b8d-9509-2c6335fdd9a4?source=cve
CVE: CVE-2024-10869
Published: 2024-11-23
Description: The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/guardgiant/tags/2.2.6/includes/class-guardgiant-table-login-activity-log.php#L483; https://plugins.trac.wordpress.org/browser/guardgiant/tags/2.2.6/includes/class-guardgiant-table-login-activity-log.php#L491; https://www.wordfence.com/threat-intel/vulnerabilities/id/0cca8b75-c4f5-47ef-90a1-c1270e2f37c1?source=cve
CVE: CVE-2024-10874
Published: 2024-11-23
Description: The Quotes llama plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quotes-llama' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/quotes-llama/tags/3.0.0/includes/classes/class-quotesllama-search.php#L131; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3201980%40quotes-llama%2Ftrunk&old=3200076%40quotes-llama%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5e2f3abd-0a15-4bc1-966a-22d606f3e333?source=cve
CVE: CVE-2024-10886
Published: 2024-11-23
Description: The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tribute_testimonials_slider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/tribute-testimonial-gridslider/tags/1.0.4/includes/class-tribute-shortcode-generator.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e461095-8dce-4502-8bbf-8c985105cf24?source=cve
CVE: CVE-2024-10961
Published: 2024-11-23
Description: The Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.9.0. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/changeset/3201046/; https://wordpress.org/plugins/oa-social-login/; https://www.wordfence.com/threat-intel/vulnerabilities/id/43a64074-ca64-4c34-b467-06d1ad8c5aa0?source=cve
CVE: CVE-2024-11362
Published: 2024-11-23
Description: The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.112.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.107.0/core/modules/field-editor/admin/settings-field-editor.php#L242; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193722%40peachpay-for-woocommerce&new=3193722%40peachpay-for-woocommerce&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcd44c3-75e6-453f-a9e7-3a547eba55e1?source=cve