deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56073
Published: 2024-12-15
Description: An issue was discovered in FastNetMon Community Edition through 1.2.7. Zero-length templates for Netflow v9 allow remote attackers to cause a denial of service (divide-by-zero error and application crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: https://cwe.mitre.org/data/definitions/369.html; https://github.com/pavel-odintsov/fastnetmon/commit/a36718525e08ad0f2a809363001bf105efc5fe1c
CVE: CVE-2024-55969
Published: 2024-12-15
Description: DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aka I640714.
CVSS Score: 9.1 (CRITICAL)
References: https://ej2.syncfusion.com/aspnetmvc/documentation/release-notes/27.1.55?type=all
CVE: CVE-2024-56074
Published: 2024-12-15
Description: gitingest before 9996a06 mishandles symbolic links that point outside of the base directory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://github.com/cyclotruc/gitingest/blob/9996a06a94450497c1abb35997f5e6cbc9b571ff/src/ingest.py#L22-L30; https://github.com/cyclotruc/gitingest/blob/9996a06a94450497c1abb35997f5e6cbc9b571ff/src/ingest.py#L99-L100; https://github.com/cyclotruc/gitingest/commit/9996a06a94450497c1abb35997f5e6cbc9b571ff
CVE: CVE-2024-56082
Published: 2024-12-15
Description: ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/andrewnguonly/Lumos/issues/193; https://github.com/andrewnguonly/Lumos/releases/tag/1.0.17; https://github.com/quantizor/markdown-to-jsx/blob/4fa87d89ad87f97b2d9e56cb969d12f9a838f3ac/README.md?plain=1#L535-L537
CVE: CVE-2024-7701
Published: 2024-12-15
Description: Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-toolkit: 3.6.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: https://github.com/percona/percona-toolkit/blob/aa1ac0e6889168fddf73c3a72d447e9ea0c0c63b/src/go/pt-secure-collect/encrypt.go#L17
CVE: CVE-2024-11858
Published: 2024-12-15
Description: A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing​
CVSS Score: 8.6 (HIGH)
CWE: CWE-78
References: https://bugzilla.redhat.com/show_bug.cgi?id=2329102
CVE: CVE-2024-8798
Published: 2024-12-16
Description: No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787, CWE-787
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r7pm-f93f-f7fp
CVE: CVE-2024-56083
Published: 2024-12-16
Description: Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly_generated_string.devinapps.com URL (aka the VSCode live share URL) for a specific "Use Devin's Machine" session. For example, this URL may be discovered if a customer posts a screenshot of a Devin session to social media, or publicly streams their Devin session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://news.ycombinator.com/item?id=42420423; https://trust.cognition.ai; https://www.youtube.com/watch?v=927W6zzvV-c
CVE: CVE-2024-53376
Published: 2024-12-16
Description: CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/ThottySploity/CVE-2024-53376; https://github.com/ThottySploity/CVE-2024-53376/blob/aa306187323bd1127d56803cb34cac8820b61484/cyberpanel.py#L70; https://thottysploity.github.io/posts/cve-2024-53376
CVE: CVE-2024-8116
Published: 2024-12-16
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/480509; https://hackerone.com/reports/2666216
CVE: CVE-2024-8650
Published: 2024-12-16
Description: An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-member users to view unresolved threads marked as internal notes in public projects merge requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/486300; https://hackerone.com/reports/2705909
CVE: CVE-2024-11841
Published: 2024-12-16
Description: The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e344c722-c9b3-4527-a50d-50cdf07ebace/
CVE: CVE-2024-56084
Published: 2024-12-16
Description: An issue was discovered in Logpoint UniversalNormalizer before 5.7.0. Authenticated users can inject payloads while creating Universal Normalizer. These are executed, leading to Remote Code Execution.
CVSS Score: 7.1 (HIGH)
CWE: CWE-77, CWE-77
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]8845-Remote-Code-Execution-while-creating-Universal-Normalizer
CVE: CVE-2024-56085
Published: 2024-12-16
Description: An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading to Server-Side Template Injection.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-77
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]3757-Server-Side-Template-Injection-SSTI-in-Search-Template-Dashboard
CVE: CVE-2024-56086
Published: 2024-12-16
Description: An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads in Report Templates. These are executed when the backup process is initiated, leading to Remote Code Execution.
CVSS Score: 7.1 (HIGH)
CWE: CWE-77
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]1277-Remote-Code-Execution-while-creating-Report-Templates
CVE: CVE-2024-56087
Published: 2024-12-16
Description: An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Template Dashboard. These are executed, leading to Server-Side Template Injection.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-77
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]1885-Server-Side-Template-Injection-SSTI-in-Search-Template-Dashboard-Queries
CVE: CVE-2024-56112
Published: 2024-12-16
Description: CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cyberpanel.net/; https://github.com/usmannasir/cyberpanel/commit/f0cf648c7851c96c36bb0c390d13e60931f45900
CVE: CVE-2024-5333
Published: 2024-12-16
Description: The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/764b5a23-8b51-4882-b899-beb54f684984/
CVE: CVE-2024-12641
Published: 2024-12-16
Description: TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use specific APIs through phishing to execute arbitrary JavaScript code in the user’s browser. Since the web server set by the application supports Node.Js features, attackers can further leverage this to run OS commands.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-8299-42168-2.html; https://www.twcert.org.tw/tw/cp-132-8292-4fd98-1.html
CVE: CVE-2024-12642
Published: 2024-12-16
Description: TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to write arbitrary files to any path on the user's system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-23, CWE-352
References: https://www.twcert.org.tw/en/cp-139-8300-2eaa1-2.html; https://www.twcert.org.tw/tw/cp-132-8294-44d13-1.html
CVE: CVE-2024-12643
Published: 2024-12-16
Description: The tbm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-36, CWE-352
References: https://www.twcert.org.tw/en/cp-139-8301-c2f4b-2.html; https://www.twcert.org.tw/tw/cp-132-8295-bfa3b-1.html
CVE: CVE-2024-12644
Published: 2024-12-16
Description: The tbm-client from Chunghwa Telecom has an Arbitrary File vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability. Attackers can copy arbitrary files on the user's system and paste them into any path, which poses a potential risk of information leakage or could consume hard drive space by copying files in large volumes.
CVSS Score: 7.1 (HIGH)
CWE: CWE-36, CWE-352
References: https://www.twcert.org.tw/en/cp-139-8302-86814-2.html; https://www.twcert.org.tw/tw/cp-132-8296-0f020-1.html
CVE: CVE-2024-12645
Published: 2024-12-16
Description: The topm-client from Chunghwa Telecom has an Arbitrary File Read vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to read arbitrary files on the user's system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-352
References: https://www.twcert.org.tw/en/cp-139-8303-3220b-2.html; https://www.twcert.org.tw/tw/cp-132-8297-13670-1.html
CVE: CVE-2024-12646
Published: 2024-12-16
Description: The topm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-36, CWE-352
References: https://www.twcert.org.tw/en/cp-139-8304-b83f8-2.html; https://www.twcert.org.tw/tw/cp-132-8298-10b36-1.html
CVE: CVE-2024-9678
Published: 2024-12-16
Description: An SQL Injection vulnerability existed in DLP Extension 11.11.1.3.  The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading to command execution.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://thrive.trellix.com/s/article/000013964
CVE: CVE-2024-9679
Published: 2024-12-16
Description: A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user credentials.
CVSS Score: 5.3 (MEDIUM)
References: https://thrive.trellix.com/s/article/000013964
CVE: CVE-2024-48872
Published: 2024-12-16
Description: Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being blocked via simultaneously sending multiple login requests
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-362
References: https://mattermost.com/security-updates
CVE: CVE-2024-54083
Published: 2024-12-16
Description: Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side (webapp and mobile) DoS to users of particular channels, by sending a specially crafted post.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2024-54682
Published: 2024-12-16
Description: Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-409
References: https://mattermost.com/security-updates
CVE: CVE-2024-12362
Published: 2024-12-16
Description: A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The manipulation of the argument invoice leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/InvoicePlane/InvoicePlane/pull/1127; https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.2-beta-1; https://vuldb.com/?ctiid.288537
CVE: CVE-2024-12478
Published: 2024-12-16
Description: A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index.php/upload/upload_file/1/1. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/InvoicePlane/InvoicePlane/pull/1141; https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.2-beta-1; https://vuldb.com/?ctiid.288538
CVE: CVE-2024-10972
Published: 2024-12-16
Description: Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being performed at the beginning of the routine allowing the userspace to change page permissions half way through the routine.  A valid workaround is a rule to detect unauthorized loading of winpmem outside incident response operations.
CVSS Score: 7.3 (HIGH)
CWE: CWE-367
References: https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1
CVE: CVE-2024-12089
Published: 2024-12-16
Description: A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-12090
Published: 2024-12-16
Description: A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-12091
Published: 2024-12-16
Description: A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-12092
Published: 2024-12-16
Description: A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-12668
Published: 2024-12-16
Description: Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the  g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1
CVE: CVE-2024-37251
Published: 2024-12-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/advanced-custom-fields-pro/vulnerability/wordpress-advanced-custom-fields-pro-plugin-6-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-49775
Published: 2024-12-16
Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Quality (All versions < V2512), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions if operated in conjunction with UMC < V2.15), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component.
This could allow an unauthenticated remote attacker to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://cert-portal.siemens.com/productcert/html/ssa-928984.html
CVE: CVE-2024-54331
Published: 2024-12-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Micha I Plant A Tree i-plant-a-tree allows Stored XSS.This issue affects I Plant A Tree: from n/a through <= 1.7.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/i-plant-a-tree/vulnerability/wordpress-i-plant-a-tree-plugin-1-7-3-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE: CVE-2024-54332
Published: 2024-12-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPFactory WP Currency Exchange Rates wp-currency-exchange-rates allows Stored XSS.This issue affects WP Currency Exchange Rates: from n/a through <= 1.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-currency-exchange-rates/vulnerability/wordpress-wp-currency-exchange-rates-plugin-1-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54352
Published: 2024-12-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sabri Sogrid sogrid allows Privilege Escalation.This issue affects Sogrid: from n/a through <= 1.5.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sogrid/vulnerability/wordpress-sogrid-plugin-1-5-2-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-54353
Published: 2024-12-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpgear Hack-Info hack-info allows Stored XSS.This issue affects Hack-Info: from n/a through <= 3.17.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/hack-info/vulnerability/wordpress-hack-info-plugin-3-17-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54354
Published: 2024-12-16
Description: Missing Authorization vulnerability in beat.k Termin-Kalender termin-kalender allows Stored XSS.This issue affects Termin-Kalender: from n/a through <= 0.99.47.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/termin-kalender/vulnerability/wordpress-termin-kalender-plugin-0-99-47-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54355
Published: 2024-12-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in brandtoss WP Mailster wp-mailster allows Cross Site Request Forgery.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-8-17-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-54356
Published: 2024-12-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-54358
Published: 2024-12-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-profile allows Reflected XSS.This issue affects 3D Avatar User Profile: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/3d-avatar-user-profile/vulnerability/wordpress-3d-avatar-user-profile-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54359
Published: 2024-12-16
Description: Missing Authorization vulnerability in Saul Morales Pacheco Banner System banner-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Banner System: from n/a through <= 1.0.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/banner-system/vulnerability/wordpress-banner-system-plugin-1-0-0-broken-access-control-vulnerability?_s_id=cve