deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-20131
Published: 2024-12-02
Description: In Modem, there is a possible escalation of privilege due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01395886; Issue ID: MSV-1873.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2024
CVE: CVE-2024-20132
Published: 2024-12-02
Description: In Modem, there is a possible out of bonds write due to a mission bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00957388; Issue ID: MSV-1872.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2024
CVE: CVE-2024-20133
Published: 2024-12-02
Description: In Modem, there is a possible escalation of privilege due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01395886; Issue ID: MSV-1871.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2024
CVE: CVE-2024-20134
Published: 2024-12-02
Description: In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09154589; Issue ID: MSV-1866.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2024
CVE: CVE-2024-20135
Published: 2024-12-02
Description: In soundtrigger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09142526; Issue ID: MSV-1841.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2024
CVE: CVE-2024-20136
Published: 2024-12-02
Description: In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09121847; Issue ID: MSV-1821.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2024
CVE: CVE-2024-20137
Published: 2024-12-02
Description: In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00384543; Issue ID: MSV-1727.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://corp.mediatek.com/product-security-bulletin/December-2024
CVE: CVE-2024-20138
Published: 2024-12-02
Description: In wlan driver, there is a possible out of bound read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998291; Issue ID: MSV-1604.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2024
CVE: CVE-2024-20139
Published: 2024-12-02
Description: In Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09001270; Issue ID: MSV-1600.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://corp.mediatek.com/product-security-bulletin/December-2024
CVE: CVE-2024-53103
Published: 2024-12-02
Description: In the Linux kernel, the following vulnerability has been resolved:

hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer

When hvs is released, there is a possibility that vsk->trans may not
be initialized to NULL, which could lead to a dangling pointer.
This issue is resolved by initializing vsk->trans to NULL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/285266ef92f7b4bf7d26e1e95e215ce6a6badb4a; https://git.kernel.org/stable/c/414476c4fb11be070c09ab8f3e75c9ee324a108a; https://git.kernel.org/stable/c/4bdc5a62c6e50600d8a1c3e18fd6dce0c27c9497
CVE: CVE-2024-53104
Published: 2024-12-02
Description: In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://git.kernel.org/stable/c/1ee9d9122801eb688783acd07791f2906b87cb4f; https://git.kernel.org/stable/c/467d84dc78c9abf6b217ada22b3fdba336262e29; https://git.kernel.org/stable/c/575a562f7a3ec2d54ff77ab6810e3fbceef2a91d
CVE: CVE-2024-10490
Published: 2024-12-02
Description: An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.
B&R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.
CWE: CWE-288
References: https://www.br-automation.com/fileadmin/SA22P014-90c4aa35.pdf
CVE: CVE-2024-33036
Published: 2024-12-02
Description: Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-823
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-33037
Published: 2024-12-02
Description: Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-33039
Published: 2024-12-02
Description: Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-822
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-33040
Published: 2024-12-02
Description: Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-33044
Published: 2024-12-02
Description: Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
CVSS Score: 8.4 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-33053
Published: 2024-12-02
Description: Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-33056
Published: 2024-12-02
Description: Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
CVSS Score: 8.4 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-33063
Published: 2024-12-02
Description: Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-43048
Published: 2024-12-02
Description: Memory corruption when invalid input is passed to invoke GPU Headroom API call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-43049
Published: 2024-12-02
Description: Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-43050
Published: 2024-12-02
Description: Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-43052
Published: 2024-12-02
Description: Memory corruption while processing API calls to NPU with invalid input.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-43053
Published: 2024-12-02
Description: Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.html
CVE: CVE-2024-12015
Published: 2024-12-02
Description: The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89
References: https://www.tenable.com/security/research/tra-2024-47
CVE: CVE-2024-51900
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in James Hunt What Would Seth Godin Do what-would-seth-godin-do allows Stored XSS.This issue affects What Would Seth Godin Do: from n/a through <= 2.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/what-would-seth-godin-do/vulnerability/wordpress-what-would-seth-godin-do-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52452
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eduNEXT Open edX LMS allows Reflected XSS.This issue affects Open edX LMS: from n/a through 2.6.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/edunext-openedx-integrator/vulnerability/wordpress-open-edx-lms-plugin-2-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52453
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves library-bookshelves allows Reflected XSS.This issue affects Library Bookshelves: from n/a through <= 5.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/library-bookshelves/vulnerability/wordpress-library-bookshelves-plugin-5-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52454
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goqsystem GoQMieruca goqmieruca allows Reflected XSS.This issue affects GoQMieruca: from n/a through <= 1.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/goqmieruca/vulnerability/wordpress-goqmieruca-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52455
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goqsystem GoQSmile goqsmile allows Reflected XSS.This issue affects GoQSmile: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/goqsmile/vulnerability/wordpress-goqsmile-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52456
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpoets Awesome Studio awesome-studio allows Reflected XSS.This issue affects Awesome Studio: from n/a through <= 2.4.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/awesome-studio/vulnerability/wordpress-awesome-studio-plugin-2-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52457
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in youneeq Youneeq Recommendations youneeq-panel allows Reflected XSS.This issue affects Youneeq Recommendations: from n/a through <= 3.0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/youneeq-panel/vulnerability/wordpress-youneeq-recommendations-plugin-3-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52458
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zaymund TM Islamic Helper tm-islamic-helper allows Reflected XSS.This issue affects TM Islamic Helper: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tm-islamic-helper/vulnerability/wordpress-tm-islamic-helper-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52459
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chameleoni Chameleoni Jobs chameleon-jobs allows Reflected XSS.This issue affects Chameleoni Jobs: from n/a through <= 2.5.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/chameleon-jobs/vulnerability/wordpress-chameleoni-jobs-plugin-2-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://plugins.svn.wordpress.org/chameleon-jobs/tags/2.5.6/readme.txt
CVE: CVE-2024-52460
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in atarapay AtaraPay WooCommerce Payment Gateway atarapay-woocommerce allows Reflected XSS.This issue affects AtaraPay WooCommerce Payment Gateway: from n/a through <= 2.0.13.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/atarapay-woocommerce/vulnerability/wordpress-atarapay-woocommerce-payment-gateway-plugin-2-0-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52461
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kinsta Infinite Slider infinite-slider allows Reflected XSS.This issue affects Infinite Slider: from n/a through <= 2.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/infinite-slider/vulnerability/wordpress-infinite-slider-plugin-2-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52462
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Reflected XSS.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-e-commerce-style-email/vulnerability/wordpress-wp-e-commerce-style-email-plugin-0-6-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52463
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Westwood Post By Email post-by-email allows Reflected XSS.This issue affects Post By Email: from n/a through <= 1.0.4b.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-by-email/vulnerability/wordpress-post-by-email-plugin-1-0-4b-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52464
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anmari amr shortcodes amr-shortcodes allows Reflected XSS.This issue affects amr shortcodes: from n/a through <= 1.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/amr-shortcodes/vulnerability/wordpress-amr-shortcodes-plugin-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52465
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. LGPD Framework lgpd-framework allows Reflected XSS.This issue affects LGPD Framework: from n/a through <= 2.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lgpd-framework/vulnerability/wordpress-lgpd-framework-plugin-2-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52466
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Explara Explara Events explara-events allows Reflected XSS.This issue affects Explara Events: from n/a through <= 0.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/explara-events/vulnerability/wordpress-explara-events-plugin-0-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52467
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Reflected XSS.This issue affects AI Responsive Gallery Album: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ai-responsive-gallery-album/vulnerability/wordpress-ai-responsive-gallery-album-plugin-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52468
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadBoxer LeadBoxer leadboxer allows Reflected XSS.This issue affects LeadBoxer: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/leadboxer/vulnerability/wordpress-leadboxer-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52469
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dhrubok Infotech Services Ltd. WooCommerce Price Alert price-alert-woocommerce allows Reflected XSS.This issue affects WooCommerce Price Alert: from n/a through <= 1.0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/price-alert-woocommerce/vulnerability/wordpress-woocommerce-price-alert-plugin-1-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52476
Published: 2024-12-02
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Stefan Bohacek Fediverse Embeds fediverse-embeds allows Upload a Web Shell to a Web Server.This issue affects Fediverse Embeds: from n/a through <= 1.5.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/fediverse-embeds/vulnerability/wordpress-fediverse-embeds-plugin-1-5-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-52477
Published: 2024-12-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in docxpresso Document & Data Automation document-data-automation allows Stored XSS.This issue affects Document & Data Automation: from n/a through <= 1.6.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/document-data-automation/vulnerability/wordpress-document-data-automation-plugin-1-6-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52478
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Stored XSS.This issue affects Jobify: from n/a through < 4.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/jobify/vulnerability/wordpress-jobify-theme-4-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52479
Published: 2024-12-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Jobify jobify allows Cross Site Request Forgery.This issue affects Jobify: from n/a through < 4.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Theme/jobify/vulnerability/wordpress-jobify-plugin-4-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-52482
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafalautopilot Ortto autopilot allows Reflected XSS.This issue affects Ortto: from n/a through <= 1.0.19.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/autopilot/vulnerability/wordpress-ortto-plugin-1-0-19-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52483
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Benic LeanPress leanpress allows Reflected XSS.This issue affects LeanPress: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/leanpress/vulnerability/wordpress-leanpress-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52484
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deepintowp Wc Recently viewed products wc-recently-viewed-products allows Reflected XSS.This issue affects Wc Recently viewed products: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wc-recently-viewed-products/vulnerability/wordpress-wc-recently-viewed-products-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52486
Published: 2024-12-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SolverWp Elementor Portfolio Builder portfolio-builder-elementor allows DOM-Based XSS.This issue affects Elementor Portfolio Builder: from n/a through <= 1.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/portfolio-builder-elementor/vulnerability/wordpress-elementor-portfolio-builder-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve