deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3081
Published: 2024-03-29
Description: A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. The attack can be launched remotely. Upgrading to version 4.8.10 is able to address this issue. The identifier of the patch is 127436e4c3f56276d548070f99e61b7234200a11. It is recommended to upgrade the affected component. The identifier VDB-258613 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/EasyCorp/EasyAdminBundle/commit/127436e4c3f56276d548070f99e61b7234200a11; https://github.com/EasyCorp/EasyAdminBundle/pull/5971; https://github.com/EasyCorp/EasyAdminBundle/pull/6067
CVE: CVE-2023-49231
Published: 2024-03-29
Description: An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294
References: http://seclists.org/fulldisclosure/2024/Apr/1; https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-003.txt; https://www.schutzwerk.com/blog/schutzwerk-sa-2023-003/
CVE: CVE-2024-29686
Published: 2024-03-29
Description: Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be entered by a trusted user, such as the owner of the server that hosts Winter CMS, or a developer working for them.
CVSS Score: 7.2 (HIGH)
CWE: CWE-97
References: https://forum.ksec.co.uk/t/webapps-winter-cms-1-2-3-server-side-template-injection-ssti-authenticated/2779; https://wintercms.com/docs/v1.2/docs/cms/themes#template-structure; https://www.exploit-db.com/exploits/51893
CVE: CVE-2024-29900
Published: 2024-03-29
Description: Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-402
References: https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee; https://github.com/electron/packager/security/advisories/GHSA-34h3-8mw4-qw57; https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee
CVE: CVE-2024-29901
Published: 2024-03-29
Description: The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.
A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-294, CWE-294
References: https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de[PII_REDACTED]ff3b244a01; https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2; https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v
CVE: CVE-2024-29904
Published: 2024-03-29
Description: CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later. 

CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-674
References: https://github.com/codeigniter4/CodeIgniter4/commit/fa851acbae7ae4c5a97f8f38ae87aa0822a334c0; https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-39fp-mqmm-gxj6; https://github.com/codeigniter4/CodeIgniter4/commit/fa851acbae7ae4c5a97f8f38ae87aa0822a334c0
CVE: CVE-2024-30246
Published: 2024-03-29
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which information is deleted. Information from theDate, File, Float, Int, List, OpenList, Text, and Permissions on artifact (this one can lead to the disclosure of restricted information) fields can be impacted.  This vulnerability is fixed in Tuleap Community Edition version 15.7.99.6 and Tuleap Enterprise Edition 15.7-2, 15.6-5, 15.5-6, 15.4-8, 15.3-6, 15.2-5, 15.1-9, 15.0-9, and 14.12-6.
CVSS Score: 7.6 (HIGH)
CWE: CWE-440, CWE-670
References: https://github.com/Enalean/tuleap/commit/a0ba0ae82a29eb8bfacef286778e5e49954f5316; https://github.com/Enalean/tuleap/security/advisories/GHSA-jc7g-4pcv-8jcj; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a0ba0ae82a29eb8bfacef286778e5e49954f5316
CVE: CVE-2024-30247
Published: 2024-03-29
Description: NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards. A command injection vulnerability in NextCloudPi allows command execution as the root user via the NextCloudPi web-panel. Due to a security misconfiguration this can be used by anyone with access to NextCloudPi web-panel, no authentication is required. It is recommended that the NextCloudPi is upgraded to 1.53.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/nextcloud/nextcloudpi/security/advisories/GHSA-m597-72v7-j982; https://github.com/nextcloud/nextcloudpi/security/advisories/GHSA-m597-72v7-j982
CVE: CVE-2024-30469
Published: 2024-03-29
Description: Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-wholesale-pricing/wordpress-wholesale-for-woocommerce-plugin-2-3-0-unauthenticated-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-wholesale-pricing/wordpress-wholesale-for-woocommerce-plugin-2-3-0-unauthenticated-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-30477
Published: 2024-03-29
Description: Missing Authorization vulnerability in Klarna Klarna Payments for WooCommerce.This issue affects Klarna Payments for WooCommerce: from n/a through 3.2.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/klarna-payments-for-woocommerce/wordpress-klarna-payments-for-woocommerce-plugin-3-2-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/klarna-payments-for-woocommerce/wordpress-klarna-payments-for-woocommerce-plugin-3-2-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30482
Published: 2024-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Brice CAPOBIANCO Simple Revisions Delete.This issue affects Simple Revisions Delete: from n/a through 1.5.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/simple-revisions-delete/wordpress-simple-revisions-delete-plugin-1-5-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-revisions-delete/wordpress-simple-revisions-delete-plugin-1-5-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30492
Published: 2024-03-29
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/users-customers-import-export-for-wp-woocommerce/wordpress-export-and-import-users-and-customers-plugin-2-5-2-path-traversal-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/users-customers-import-export-for-wp-woocommerce/wordpress-export-and-import-users-and-customers-plugin-2-5-2-path-traversal-vulnerability?_s_id=cve
CVE: CVE-2024-30511
Published: 2024-03-29
Description: Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.45.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/fg-prestashop-to-woocommerce/wordpress-fg-prestashop-to-woocommerce-plugin-4-45-1-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fg-prestashop-to-woocommerce/wordpress-fg-prestashop-to-woocommerce-plugin-4-45-1-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-30513
Published: 2024-03-29
Description: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-30514
Published: 2024-03-29
Description: Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On.This issue affects Paid Memberships Pro – Payfast Gateway Add On: from n/a through 1.4.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/pmpro-payfast/wordpress-paid-memberships-pro-payfast-gateway-add-on-plugin-1-4-1-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pmpro-payfast/wordpress-paid-memberships-pro-payfast-gateway-add-on-plugin-1-4-1-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-30518
Published: 2024-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/add-fields-to-checkout-page-woocommerce/wordpress-custom-woocommerce-checkout-fields-editor-plugin-1-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/add-fields-to-checkout-page-woocommerce/wordpress-custom-woocommerce-checkout-fields-editor-plugin-1-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30521
Published: 2024-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Landingi Landingi Landing Pages.This issue affects Landingi Landing Pages: from n/a through 3.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/landingi-landing-pages/wordpress-landingi-landing-pages-plugin-3-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/landingi-landing-pages/wordpress-landingi-landing-pages-plugin-3-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30645
Published: 2024-03-29
Description: Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/setUsbUnload.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/setUsbUnload.md
CVE: CVE-2023-49232
Published: 2024-03-29
Description: An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of administrative users.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://seclists.org/fulldisclosure/2024/Apr/2; https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-004.txt; https://www.schutzwerk.com/blog/schutzwerk-sa-2023-004/
CVE: CVE-2023-49234
Published: 2024-03-29
Description: An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-611
References: http://seclists.org/fulldisclosure/2024/Apr/3; https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-006.txt; https://www.schutzwerk.com/blog/schutzwerk-sa-2023-006/
CVE: CVE-2024-25944
Published: 2024-03-29
Description: Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, to gain unauthorized access to the files stored on the server filesystem, with the privileges of the running web application.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000223623/dsa-2024-100-security-update-for-dell-openmanage-enterprise-path-traversal-sensitive-data-disclosure-vulnerability; https://www.dell.com/support/kbdoc/en-us/000223623/dsa-2024-100-security-update-for-dell-openmanage-enterprise-path-traversal-sensitive-data-disclosure-vulnerability
CVE: CVE-2024-29640
Published: 2024-03-29
Description: An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://aliyundrive-webdav.com; https://github.com/lakemoon602/vuln/blob/main/detail.md; https://github.com/messense/aliyundrive-webdav
CVE: CVE-2024-30444
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zionbuilder.Io WordPress Page Builder – Zion Builder allows Stored XSS.This issue affects WordPress Page Builder – Zion Builder: from n/a through 3.6.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/zionbuilder/wordpress-wordpress-page-builder-zion-builder-plugin-3-6-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zionbuilder/wordpress-wordpress-page-builder-zion-builder-plugin-3-6-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30445
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab, Inc. Web Icons allows Stored XSS.This issue affects Web Icons: from n/a through 1.0.0.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/icon/wordpress-web-icons-plugin-1-0-0-10-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/icon/wordpress-web-icons-plugin-1-0-0-10-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-30446
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms allows Stored XSS.This issue affects CRM Perks Forms: from n/a through 1.1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30447
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Solutions Creative Image Slider – Responsive Slider Plugin allows Reflected XSS.This issue affects Creative Image Slider – Responsive Slider Plugin: from n/a through 2.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/creative-image-slider/wordpress-creative-image-slider-plugin-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/creative-image-slider/wordpress-creative-image-slider-plugin-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30448
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic Slider by Supsystic allows Stored XSS.This issue affects Slider by Supsystic: from n/a through 1.8.10.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/slider-by-supsystic/wordpress-slider-by-supsystic-plugin-1-8-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slider-by-supsystic/wordpress-slider-by-supsystic-plugin-1-8-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30449
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Activities Team Booking Activities allows Reflected XSS.This issue affects Booking Activities: from n/a through 1.15.19.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/booking-activities/wordpress-booking-activities-plugin-1-15-19-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/booking-activities/wordpress-booking-activities-plugin-1-15-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30450
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Step-Byte-Service GmbH OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) allows Stored XSS.This issue affects OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer): from n/a through 1.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/stepbyteservice-openstreetmap/wordpress-openstreetmap-for-gutenberg-and-wpbakery-page-builder-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stepbyteservice-openstreetmap/wordpress-openstreetmap-for-gutenberg-and-wpbakery-page-builder-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30451
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INFINITUM FORM Geo Controller allows Stored XSS.This issue affects Geo Controller: from n/a through 8.6.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cf-geoplugin/wordpress-geo-controller-plugin-8-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cf-geoplugin/wordpress-geo-controller-plugin-8-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30452
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Stored XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/page-builder-add/wordpress-landing-page-builder-plugin-1-5-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/page-builder-add/wordpress-landing-page-builder-plugin-1-5-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30453
Published: 2024-03-29
Description: Server-Side Request Forgery (SSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.6.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/brave-popup-builder/wordpress-brave-plugin-0-6-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/brave-popup-builder/wordpress-brave-plugin-0-6-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-30454
Published: 2024-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.6.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30455
Published: 2024-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 6.8.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/gamipress/wordpress-gamipress-plugin-6-8-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gamipress/wordpress-gamipress-plugin-6-8-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30460
Published: 2024-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tumult Inc Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through 1.9.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/tumult-hype-animations/wordpress-tumult-hype-animations-plugin-1-9-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tumult-hype-animations/wordpress-tumult-hype-animations-plugin-1-9-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30462
Published: 2024-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-products-filter/wordpress-husky-plugin-1-3-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-products-filter/wordpress-husky-plugin-1-3-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30463
Published: 2024-03-29
Description: Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woo-bulk-editor/wordpress-bear-plugin-1-1-4-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-bulk-editor/wordpress-bear-plugin-1-1-4-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30468
Published: 2024-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/all-in-one-wp-security-and-firewall/wordpress-all-in-one-security-aios-security-and-firewall-plugin-5-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/all-in-one-wp-security-and-firewall/wordpress-all-in-one-security-aios-security-and-firewall-plugin-5-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve