deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43956
Published: 2024-11-01
Description: Missing Authorization vulnerability in Caseproof, LLC Memberpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberpress: from n/a through 1.11.34.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/memberpress/wordpress-memberpress-plugin-1-11-29-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-43962
Published: 2024-11-01
Description: Missing Authorization vulnerability in LWS LWS Affiliation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LWS Affiliation: from n/a through 2.3.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/lws-affiliation/wordpress-lws-affiliation-plugin-2-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-43968
Published: 2024-11-01
Description: Broken Access Control vulnerability in Automattic Newspack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack: from n/a through 3.8.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/newspack-plugin/wordpress-newspack-plugin-3-8-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-43973
Published: 2024-11-01
Description: Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through <= 2.8.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/invoicing/vulnerability/wordpress-payment-forms-buy-now-buttons-and-invoicing-system-getpaid-plugin-2-8-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-43974
Published: 2024-11-01
Description: Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/revivenews/wordpress-revivenews-theme-1-0-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-43979
Published: 2024-11-01
Description: Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/blockbooster/wordpress-blockbooster-theme-1-0-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-43980
Published: 2024-11-01
Description: Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through 1.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/fotawp/wordpress-fotawp-theme-1-4-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-43981
Published: 2024-11-01
Description: Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/geodirectory/wordpress-geodirectory-plugin-2-3-70-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-43982
Published: 2024-11-01
Description: Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login As Users: from n/a through 1.4.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/login-as-users/wordpress-login-as-users-plugin-1-4-3-broken-access-control-to-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-43998
Published: 2024-11-01
Description: Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/blogpoet/wordpress-blogpoet-theme-1-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-44006
Published: 2024-11-01
Description: Missing Authorization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through <= 5.3.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-multilingual/vulnerability/wordpress-woocommerce-multilingual-multicurrency-plugin-5-3-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-44019
Published: 2024-11-01
Description: Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension contact-form-7-campaign-monitor-extension.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through <= 0.4.67.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-7-campaign-monitor-extension/vulnerability/wordpress-contact-form-7-campaign-monitor-extension-plugin-0-4-67-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-44020
Published: 2024-11-01
Description: Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through <= 1.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-free-ssl/vulnerability/wordpress-wp-free-ssl-plugin-1-2-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-44021
Published: 2024-11-01
Description: Missing Authorization vulnerability in truepushplugin Truepush truepush-free-web-push-notifications.This issue affects Truepush: from n/a through <= 1.0.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/truepush-free-web-push-notifications/vulnerability/wordpress-truepush-plugin-1-0-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-44031
Published: 2024-11-01
Description: Missing Authorization vulnerability in beardev JoomSport joomsport-sports-league-results-management.This issue affects JoomSport: from n/a through <= 5.6.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/joomsport-sports-league-results-management/vulnerability/wordpress-joomsport-plugin-5-6-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-44038
Published: 2024-11-01
Description: Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-2-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-44052
Published: 2024-11-01
Description: Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/helloasso/vulnerability/wordpress-helloasso-plugin-1-1-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47302
Published: 2024-11-01
Description: Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through <= 1.8.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/fluent-support/vulnerability/wordpress-fluent-support-plugin-1-8-0-broken-access-control-on-email-verification-vulnerability?_s_id=cve
CVE: CVE-2024-47308
Published: 2024-11-01
Description: Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through <= 3.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/templately/vulnerability/wordpress-templately-plugin-3-1-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47311
Published: 2024-11-01
Description: Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through <= 1.1.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wheel-of-life/vulnerability/wordpress-wheel-of-life-plugin-1-1-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47314
Published: 2024-11-01
Description: Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-2-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47317
Published: 2024-11-01
Description: Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded.This issue affects Ads by WPQuads: from n/a through <= 2.0.84.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/quick-adsense-reloaded/vulnerability/wordpress-ads-by-wpquads-plugin-2-0-84-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47318
Published: 2024-11-01
Description: Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through <= 1.7.72.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pwa-for-wp/vulnerability/wordpress-pwa-for-wp-amp-plugin-1-7-72-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47321
Published: 2024-11-01
Description: Missing Authorization vulnerability in Fahad Mahmood WP Datepicker wp-datepicker.This issue affects WP Datepicker: from n/a through <= 2.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-datepicker/vulnerability/wordpress-wp-datepicker-plugin-2-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47358
Published: 2024-11-01
Description: Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker.This issue affects Popup Maker: from n/a through <= 1.19.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/popup-maker/vulnerability/wordpress-popup-maker-plugin-1-19-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47359
Published: 2024-11-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in averta Depicter Slider depicter.This issue affects Depicter Slider: from n/a through <= 3.2.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/depicter/vulnerability/wordpress-depicter-plugin-3-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47361
Published: 2024-11-01
Description: Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/addon-elements-for-elementor-page-builder/vulnerability/wordpress-elementor-addon-elements-plugin-1-13-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47362
Published: 2024-11-01
Description: Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/strong-testimonials/vulnerability/wordpress-strong-testimonials-plugin-3-1-16-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-48039
Published: 2024-11-01
Description: Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP: from n/a through <= 1.1.15.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cubewp-framework/vulnerability/wordpress-cubewp-all-in-one-dynamic-content-framework-plugin-1-1-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-48044
Published: 2024-11-01
Description: Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/shortpixel-image-optimiser/vulnerability/wordpress-shortpixel-image-optimizer-plugin-5-6-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-48045
Published: 2024-11-01
Description: Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.12.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/happy-elementor-addons/vulnerability/wordpress-happy-elementor-addons-plugin-3-12-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-48289
Published: 2024-11-01
Description: An issue in the Bluetooth Low Energy implementation of Cypress Bluetooth SDK v3.66 allows attackers to cause a Denial of Service (DoS) via supplying a crafted LL_PAUSE_ENC_REQ packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://community.infineon.com/t5/PSoC-4/BLE-SDK-Integer-Overflow/m-p/888037#M49108
CVE: CVE-2024-49256
Published: 2024-11-01
Description: Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Htaccess File Editor: from n/a through <= 1.0.18.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://patchstack.com/database/Wordpress/Plugin/htaccess-file-editor/vulnerability/wordpress-htaccess-file-editor-plugin-1-0-18-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-10659
Published: 2024-11-01
Description: A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is the function delSystemEncryptPolicy of the file /com/esafenet/servlet/document/CDGAuthoriseTempletService.java. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/eaefcf21-6a72-48f8-bc18-a4889512bfe5?code=G8A6P3; https://vuldb.com/?ctiid.282674; https://vuldb.com/?id.282674
CVE: CVE-2024-10660
Published: 2024-11-01
Description: A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function deleteHook of the file /com/esafenet/servlet/policy/HookService.java. The manipulation of the argument hookId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/9d33a5d8-87b1-482b-8642-a8fcf27585ba?code=G8A6P3; https://vuldb.com/?ctiid.282675; https://vuldb.com/?id.282675
CVE: CVE-2024-10661
Published: 2024-11-01
Description: A vulnerability has been found in Tenda AC15 15.03.05.19 and classified as critical. This vulnerability affects the function SetDlnaCfg of the file /goform/SetDlnaCfg. The manipulation of the argument scanList leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac15_stackflow_formDLNAserver/tenda_ac15_stackflow_formDLNAserver.md; https://vuldb.com/?ctiid.282676; https://vuldb.com/?id.282676
CVE: CVE-2024-10662
Published: 2024-11-01
Description: A vulnerability was found in Tenda AC15 15.03.05.19 and classified as critical. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac15_stackflow_formSetDeviceName/tenda_ac15_stackflow_formSetDeviceName.md; https://vuldb.com/?ctiid.282677; https://vuldb.com/?id.282677
CVE: CVE-2024-22733
Published: 2024-11-01
Description: TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://lenoctambule.dev/post/dos-on-tp-link-web-admin-panel
CVE: CVE-2024-28265
Published: 2024-11-01
Description: IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-459
References: https://gitee.com/ibos/IBOS; https://github.com/A7cc/cve/issues/1
CVE: CVE-2024-40490
Published: 2024-11-01
Description: An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://github.com/sbpp/sourcebans-pp/issues/975
CVE: CVE-2024-51377
Published: 2024-11-01
Description: An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Asadiqbal2/Vulnerabilities-Research/tree/main/CVE-2024-51377; https://github.com/ladybirdweb/faveo-helpdesk/issues/8303
CVE: CVE-2024-51398
Published: 2024-11-01
Description: Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthorized access, data theft, and network attacks, seriously threatening network security.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-521
References: https://github.com/HuhaiOvO/Altai/blob/main/Altai%20IX500%20Indoor%202%C3%972%20802.11ac%20Wave%202%20AP%20wake%20password.docx; https://github.com/HuhaiOvO/Altai/blob/main/Altai_IX500_Weak_Password.yaml
CVE: CVE-2024-51399
Published: 2024-11-01
Description: Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtain sensitive information such as user credentials, system configuration, and database connection strings, which can lead to data breaches and identity theft.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-922
References: https://github.com/HuhaiOvO/Altai/blob/main/Altai%20IX500%20Indoor%202%C3%972%20802.11ac%20Wave%202%20AP%20file%20read.docx
CVE: CVE-2024-51432
Published: 2024-11-01
Description: Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI Clients List not being sanitized
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://en.fiberhome.com/; https://github.com/MatJosephs/CVEs/tree/main/CVE-2024-51432
CVE: CVE-2024-41738
Published: 2024-11-01
Description: IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-598
References: https://www.ibm.com/support/pages/node/7174572
CVE: CVE-2024-41741
Published: 2024-11-01
Description: IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://www.ibm.com/support/pages/node/7174572
CVE: CVE-2024-41744
Published: 2024-11-01
Description: IBM CICS TX Standard 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.ibm.com/support/pages/node/7174576
CVE: CVE-2024-41745
Published: 2024-11-01
Description: IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7174576
CVE: CVE-2024-48217
Published: 2024-11-01
Description: An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://github.com/ajrielrm/CVE-2024-48217
CVE: CVE-2024-48352
Published: 2024-11-01
Description: Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterprise ID.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: http://yealink.com; https://www.yealink.com/en/trust-center/security-advisories/e5c848c55b894231
CVE: CVE-2024-48410
Published: 2024-11-01
Description: Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Youns92/e7cd3f5d18ab089320f72c51fa3977de
CVE: CVE-2024-49770
Published: 2024-11-01
Description: `oak` is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default `oak` does not allow transferring of hidden files with `Context.send` API. However, prior to version 17.1.3, this can be bypassed by encoding `/` as its URL encoded form `%2F`. For an attacker this has potential to read sensitive user data or to gain access to server secrets. Version 17.1.3 fixes the issue.
CWE: CWE-22, CWE-35
References: https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L117-L125; https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L182C10-L182C25; https://github.com/oakserver/oak/commit/4b2f27efd5cba5a45b2c3982e610da3af0869209
CVE: CVE-2024-51244
Published: 2024-11-01
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf