deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-6007
Published: 2024-06-15
Description: A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268695. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/SecureF1sh/findings/blob/main/ns_sqli.md; https://vuldb.com/?ctiid.268695; https://vuldb.com/?id.268695
CVE: CVE-2024-27275
Published: 2024-06-15
Description: IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administrator privilege can configure a physical file trigger to execute with the privileges of a user socially engineered to access the target file. The correction is to require administrator privilege to configure trigger support.
CVSS Score: 7.4 (HIGH)
CWE: CWE-266, CWE-287
References: https://www.ibm.com/support/pages/node/7157637; https://exchange.xforce.ibmcloud.com/vulnerabilities/285203; https://www.ibm.com/support/pages/node/7157637
CVE: CVE-2024-31870
Published: 2024-06-15
Description: IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related *USRPRF objects.  This can be used by a malicious actor to gather information about users that can be targeted in further attacks.  IBM X-Force ID:  287174.
CVSS Score: 3.3 (LOW)
CWE: CWE-204, CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287174; https://www.ibm.com/support/pages/node/7157638; https://exchange.xforce.ibmcloud.com/vulnerabilities/287174
CVE: CVE-2024-6008
Published: 2024-06-15
Description: A vulnerability, which was classified as critical, was found in itsourcecode Online Book Store up to 1.0. Affected is an unknown function of the file /edit_book.php. The manipulation of the argument image leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-268698 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/1902zdq/cve/issues/1; https://vuldb.com/?ctiid.268698; https://vuldb.com/?id.268698
CVE: CVE-2024-6009
Published: 2024-06-15
Description: A vulnerability has been found in itsourcecode Event Calendar 1.0 and classified as critical. Affected by this vulnerability is the function regConfirm/regDelete of the file process.php. The manipulation of the argument userId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268699.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/AutoZhou1/cve/issues/1; https://vuldb.com/?ctiid.268699; https://vuldb.com/?id.268699
CVE: CVE-2024-6013
Published: 2024-06-15
Description: A vulnerability was found in itsourcecode Online Book Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_delete.php. The manipulation of the argument bookisbn leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268721 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/gabriel202212/cve/issues/1; https://vuldb.com/?ctiid.268721; https://vuldb.com/?id.268721
CVE: CVE-2024-6014
Published: 2024-06-15
Description: A vulnerability classified as critical has been found in itsourcecode Document Management System 1.0. Affected is an unknown function of the file edithis.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-268722 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/gabriel202212/cve/issues/2; https://vuldb.com/?ctiid.268722; https://vuldb.com/?id.268722
CVE: CVE-2024-6015
Published: 2024-06-15
Description: A vulnerability classified as critical was found in itsourcecode Online House Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument month_of leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268723.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/chenwulin-bit/cve/issues/1; https://vuldb.com/?ctiid.268723; https://vuldb.com/?id.268723
CVE: CVE-2024-6016
Published: 2024-06-15
Description: A vulnerability, which was classified as critical, has been found in itsourcecode Online Laundry Management System 1.0. Affected by this issue is some unknown functionality of the file admin_class.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268724.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/chenwulin-bit/cve/issues/2; https://vuldb.com/?ctiid.268724; https://vuldb.com/?id.268724
CVE: CVE-2024-38394
Published: 2024-06-16
Description: Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780; https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780#note_2047914; https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/tags
CVE: CVE-2024-38395
Published: 2024-06-16
Description: In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/06/17/1; https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219; https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
CVE: CVE-2024-38427
Published: 2024-06-16
Description: In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTagXml.cpp results in unconditionally returning false.
CVSS Score: 8.8 (HIGH)
CWE: CWE-252
References: https://github.com/InternationalColorConsortium/DemoIccMAX/pull/66; https://github.com/InternationalColorConsortium/DemoIccMAX/pull/66/commits/85ce74ef19fb0751c7e188b06daed22fe74c332c; https://github.com/InternationalColorConsortium/DemoIccMAX/pull/66
CVE: CVE-2024-38428
Published: 2024-06-16
Description: url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-436, CWE-436
References: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f[PII_REDACTED]b2fd6e06a11e242ace; https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html; https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f[PII_REDACTED]b2fd6e06a11e242ace
CVE: CVE-2024-36397
Published: 2024-06-16
Description: Vantiva - MediaAccess DGA2232 v19.4 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-38439
Published: 2024-06-16
Description: Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19 are also fixed versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c[PII_REDACTED]6/etc/uams/uams_pam.c#L316; https://github.com/Netatalk/netatalk/issues/1096; https://github.com/Netatalk/netatalk/security/advisories/GHSA-8r68-857c-4rqc
CVE: CVE-2024-38440
Published: 2024-06-16
Description: Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BN_bin2bn in etc/uams/uams_dhx_pam.c. The original issue 1097 report stated: 'The latest version of Netatalk (v3.2.0) contains a security vulnerability. This vulnerability arises due to a lack of validation for the length field after parsing user-provided data, leading to an out-of-bounds heap write of one byte (\0). Under specific configurations, this can result in reading metadata of the next heap block, potentially causing a Denial of Service (DoS) under certain heap layouts or with ASAN enabled. ... The vulnerability is located in the FPLoginExt operation of Netatalk, in the BN_bin2bn function found in /etc/uams/uams_dhx_pam.c ... if (!(bn = BN_bin2bn((unsigned char *)ibuf, KEYSIZE, NULL))) ... threads ... [#0] Id 1, Name: "afpd", stopped 0x7ffff4304e58 in ?? (), reason: SIGSEGV ... [#0] 0x7ffff4304e58 mov BYTE PTR [r14+0x8], 0x0 ... mov rdx, QWORD PTR [rsp+0x18] ... afp_login_ext(obj=<optimized out>, ibuf=0x62d000010424 "", ibuflen=0xffffffffffff0015, rbuf=<optimized out>, rbuflen=<optimized out>) ... afp_over_dsi(obj=0x[PII_REDACTED]c0 <obj>).' 2.4.1 and 3.1.19 are also fixed versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-193
References: https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c[PII_REDACTED]6/etc/uams/uams_dhx_pam.c#L199-L200; https://github.com/Netatalk/netatalk/issues/1097; https://github.com/Netatalk/netatalk/security/advisories/GHSA-mxx4-9fhm-r3w5
CVE: CVE-2024-38441
Published: 2024-06-16
Description: Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19 are also fixed versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193
References: https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c[PII_REDACTED]6/etc/afpd/directory.c#L2333; https://github.com/Netatalk/netatalk/issues/1098; https://github.com/Netatalk/netatalk/security/advisories/GHSA-mj6v-cr68-mj9q
CVE: CVE-2024-38443
Published: 2024-06-16
Description: C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, which may affect common use cases such as sorting an array of 50 elements.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-121
References: https://github.com/TheAlgorithms/C/issues/1394; https://github.com/TheAlgorithms/C/issues/1394
CVE: CVE-2024-38448
Published: 2024-06-16
Description: htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://cvs.savannah.gnu.org/viewvc/global/global/htags/htags.c?revision=1.236&view=markup; https://lists.gnu.org/archive/html/bug-global/2024-05/msg00009.html; https://cvs.savannah.gnu.org/viewvc/global/global/htags/htags.c?revision=1.236&view=markup
CVE: CVE-2024-38454
Published: 2024-06-16
Description: ExpressionEngine before 7.4.11 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ExpressionEngine/ExpressionEngine/compare/7.4.10...7.4.11; https://github.com/ExpressionEngine/ExpressionEngine/pull/4279; https://github.com/ExpressionEngine/ExpressionEngine/compare/7.4.10...7.4.11
CVE: CVE-2024-38457
Published: 2024-06-16
Description: Xenforo before 2.2.16 allows CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://seclists.org/fulldisclosure/2024/Jul/11; https://xenforo.com/community/threads/xenforo-2-1-15-patch-1-2-2-16-patch-2-and-xenforo-media-gallery-2-1-9-2-2-6-released-includes-security-fixes.222133/; http://seclists.org/fulldisclosure/2024/Jul/11
CVE: CVE-2024-38458
Published: 2024-06-16
Description: Xenforo before 2.2.16 allows code injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://seclists.org/fulldisclosure/2024/Jul/12; https://xenforo.com/community/threads/xenforo-2-1-15-patch-1-2-2-16-patch-2-and-xenforo-media-gallery-2-1-9-2-2-6-released-includes-security-fixes.222133/; http://seclists.org/fulldisclosure/2024/Jul/12
CVE: CVE-2024-38459
Published: 2024-06-16
Description: langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/langchain-ai/langchain/commit/ce0b0f22a175139df8f41cdcfb4d2af411112009; https://github.com/langchain-ai/langchain/compare/langchain-experimental==0.0.60...langchain-experimental==0.0.61; https://github.com/langchain-ai/langchain/pull/22860
CVE: CVE-2024-38460
Published: 2024-06-16
Description: In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187; https://sonarsource.atlassian.net/browse/SONAR-21559; https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187
CVE: CVE-2024-38461
Published: 2024-06-16
Description: irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://github.com/irods/irods/issues/7652; https://github.com/irods/irods/releases/tag/4.3.2; https://irods.org/2024/05/irods-4-3-2-is-released
CVE: CVE-2024-38462
Published: 2024-06-16
Description: iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-426
References: https://github.com/irods/irods/blob/97eb33f130349db5e01a4b85e89dd1da81460345/server/re/src/mailMS.cpp#L94-L106; https://github.com/irods/irods/issues/7562; https://github.com/irods/irods/issues/7651
CVE: CVE-2024-38465
Published: 2024-06-16
Description: Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus error.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf; https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf
CVE: CVE-2024-38466
Published: 2024-06-16
Description: Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf; https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf
CVE: CVE-2024-38467
Published: 2024-06-16
Description: Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf; https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf
CVE: CVE-2024-38468
Published: 2024-06-16
Description: Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640, CWE-640
References: https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf; https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf
CVE: CVE-2023-27636
Published: 2024-06-16
Description: Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://aldisaw.id/security/2024/06/03/CVE-2023-27636.html; https://www.exploit-db.com/exploits/52035; https://aldisaw.id/security/2024/06/03/CVE-2023-27636.html
CVE: CVE-2024-38396
Published: 2024-06-16
Description: An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/06/17/1; https://gitlab.com/gnachman/iterm2/-/commit/fc60236a914d63fb70a5c632e211203a4f1bd4dd; https://iterm2.com/downloads.html
CVE: CVE-2024-34451
Published: 2024-06-16
Description: Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1390
References: https://docs.google.com/document/d/1iy0X4Vc9xXYoBxFrcW6ATo8GKPV6ivuLVzn6GgEpwqE; https://ghost.org/docs/faq/proxying-https-infinite-loops/; https://github.com/TryGhost/Ghost/releases
CVE: CVE-2024-6039
Published: 2024-06-16
Description: A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipulation of the argument dim leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268752.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://msecureltd.blogspot.com/2024/05/friday-fun-pentest-series-6.html; https://seclists.org/fulldisclosure/2024/Jun/2; https://vuldb.com/?ctiid.268752
CVE: CVE-2024-6041
Published: 2024-06-16
Description: A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268765 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/ssiicckk/cve/issues/1; https://vuldb.com/?ctiid.268765; https://vuldb.com/?id.268765
CVE: CVE-2024-6042
Published: 2024-06-17
Description: A vulnerability was found in itsourcecode Real Estate Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file property-detail.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-268766 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/Cormac315/cve/issues/1; https://vuldb.com/?ctiid.268766; https://vuldb.com/?id.268766
CVE: CVE-2024-6043
Published: 2024-06-17
Description: A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects the function login of the file admin_class.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268767.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/yezzzo/y3/blob/main/SourceCodester%20Best%20house%20rental%20management%20system%20project%20in%20php%201.0%20SQL%20Injection.md; https://vuldb.com/?ctiid.268767; https://vuldb.com/?id.268767
CVE: CVE-2024-5163
Published: 2024-06-17
Description: Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732, CWE-280
References: https://security.tecno.com/SRC/blogdetail/267?lang=en_US; https://security.tecno.com/SRC/securityUpdates?type=SA; https://security.tecno.com/SRC/blogdetail/267?lang=en_US
CVE: CVE-2024-6044
Published: 2024-06-17
Description: Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398; https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html; https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html
CVE: CVE-2024-6045
Published: 2024-06-17
Description: Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by using the administrator credentials obtained from analyzing the firmware.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-912
References: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398; https://www.twcert.org.tw/en/cp-139-7880-629f5-2.html; https://www.twcert.org.tw/tw/cp-132-7879-da630-1.html
CVE: CVE-2024-6046
Published: 2024-06-17
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-3236
Published: 2024-06-17
Description: The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a6c2da28-dc03-4bcc-a6c3-ee55a73861db/; https://wpscan.com/vulnerability/a6c2da28-dc03-4bcc-a6c3-ee55a73861db/
CVE: CVE-2024-4305
Published: 2024-06-17
Description: The Post Grid Gutenberg Blocks and WordPress Blog Plugin  WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/635be98d-4c17-4e75-871f-9794d85a2eb1/; https://wpscan.com/vulnerability/635be98d-4c17-4e75-871f-9794d85a2eb1/
CVE: CVE-2024-6047
Published: 2024-06-17
Description: Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html; https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html; https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html