deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-31401
Published: 2024-06-11
Description: Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the user who is logging in to the product.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2024/007901.html; https://jvn.jp/en/jp/JVN28869536/; https://cs.cybozu.co.jp/2024/007901.html
CVE: CVE-2024-31403
Published: 2024-06-11
Description: Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://cs.cybozu.co.jp/2024/007901.html; https://jvn.jp/en/jp/JVN28869536/; https://cs.cybozu.co.jp/2024/007901.html
CVE: CVE-2024-31404
Published: 2024-06-11
Description: Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view the data of Scheduler.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://cs.cybozu.co.jp/2024/007901.html; https://jvn.jp/en/jp/JVN28869536/; https://cs.cybozu.co.jp/2024/007901.html
CVE: CVE-2024-35329
Published: 2024-06-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-36360
Published: 2024-06-11
Description: OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/yammerjp/awkblog/issues/1; https://jvn.jp/en/jp/JVN80506242/; https://github.com/yammerjp/awkblog/issues/1
CVE: CVE-2024-5530
Published: 2024-06-11
Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WL: Product Horizontal Filter widget in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/2.8.9/includes/addons/wl_product_horizontal_filter.php#L1091; https://plugins.trac.wordpress.org/changeset/3100260/woolentor-addons/trunk/includes/addons/wl_product_horizontal_filter.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc2c2df-b590-413f-ba07-5aa645d069b8?source=cve
CVE: CVE-2024-31397
Published: 2024-06-11
Description: Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with the administrative privilege may be able to cause a denial-of-service (DoS) condition.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-231
References: https://cs.cybozu.co.jp/2024/007901.html; https://jvn.jp/en/jp/JVN28869536/; https://cs.cybozu.co.jp/2024/007901.html
CVE: CVE-2024-31398
Published: 2024-06-11
Description: Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product may obtain information on the list of users.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2024/007901.html; https://jvn.jp/en/jp/JVN28869536/; https://cs.cybozu.co.jp/2024/007901.html
CVE: CVE-2024-31399
Published: 2024-06-11
Description: Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, processing a crafted mail may cause a denial-of-service (DoS) condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://cs.cybozu.co.jp/2024/007901.html; https://jvn.jp/en/jp/JVN28869536/; https://cs.cybozu.co.jp/2024/007901.html
CVE: CVE-2024-31402
Published: 2024-06-11
Description: Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared To-Dos.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://cs.cybozu.co.jp/2024/007901.html; https://jvn.jp/en/jp/JVN28869536/; https://cs.cybozu.co.jp/2024/007901.html
CVE: CVE-2024-3723
Published: 2024-06-11
Description: The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-922
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106700%40advanced-cf7-db&new=3106700%40advanced-cf7-db&sfp_email=&sfph_mail=; https://wordpress.org/plugins/advanced-cf7-db/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a1f1a1-4f0a-48b5-80c8-525b69006863?source=cve
CVE: CVE-2024-4319
Published: 2024-06-11
Description: The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to download the entry data for submitted forms.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/advanced-cf7-db/trunk/admin/class-advanced-cf7-db-admin.php#L1459; https://plugins.trac.wordpress.org/changeset/3106700/advanced-cf7-db/tags/2.0.3/admin/class-advanced-cf7-db-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/2c66b185-fd4b-452d-890b-0f1850d8a7be?source=cve
CVE: CVE-2024-3549
Published: 2024-06-11
Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/3069574/blog2social/trunk/includes/B2S/Post/Item.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3b472eb8-9808-4a50-b2b4-0b0b3256053f?source=cve; https://plugins.trac.wordpress.org/changeset/3069574/blog2social/trunk/includes/B2S/Post/Item.php
CVE: CVE-2020-11843
Published: 2024-06-11
Description: This allows the information exposure to unauthorized users. This issue affects NetIQ Access Manager using version 4.5 or before
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.netiq.com/documentation/access-manager-44/accessmanager444-hf3-release-notes/data/accessmanager444-hf3-release-notes.html; https://www.netiq.com/documentation/access-manager-45/accessmanager452-hf1-release-notes/data/accessmanager452-hf1-release-notes.html; https://www.netiq.com/documentation/access-manager-44/accessmanager444-hf3-release-notes/data/accessmanager444-hf3-release-notes.html
CVE: CVE-2024-4266
Published: 2024-06-11
Description: The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/action.php#L1019; https://plugins.trac.wordpress.org/changeset/3099977/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8edb72f5-dda3-4c59-ba7a-7a460cb59c03?source=cve
CVE: CVE-2024-5531
Published: 2024-06-11
Description: The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ocean-extra/tags/2.2.8/includes/widgets/flickr.php#L59; https://www.wordfence.com/threat-intel/vulnerabilities/id/b39e17c5-711f-4229-90f4-213ea65a190d?source=cve; https://plugins.trac.wordpress.org/browser/ocean-extra/tags/2.2.8/includes/widgets/flickr.php#L59
CVE: CVE-2023-25799
Published: 2024-06-11
Description: Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8.
CVSS Score: 8.3 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-multiple-student-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-multiple-student-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-28775
Published: 2024-06-11
Description: Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wordpress-seo-premium/wordpress-yoast-seo-premium-plugin-20-4-unauthenticated-zapier-api-key-reset-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress-seo-premium/wordpress-yoast-seo-premium-plugin-20-4-unauthenticated-zapier-api-key-reset-vulnerability?_s_id=cve
CVE: CVE-2023-33922
Published: 2024-06-11
Description: Missing Authorization vulnerability in Elementor Elementor Website Builder.This issue affects Elementor Website Builder: from n/a through 3.13.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-13-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-13-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-52186
Published: 2024-06-11
Description: Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-2-2-unauthenticated-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-2-2-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-52217
Published: 2024-06-11
Description: Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-conversion-tracking/wordpress-woocommerce-conversion-tracking-plugin-2-0-11-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-conversion-tracking/wordpress-woocommerce-conversion-tracking-plugin-2-0-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-24704
Published: 2024-06-11
Description: Missing Authorization vulnerability in AddonMaster Load More Anything.This issue affects Load More Anything: from n/a through 3.3.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ajax-load-more-anything/wordpress-load-more-anything-plugin-3-3-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ajax-load-more-anything/wordpress-load-more-anything-plugin-3-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34824
Published: 2024-06-11
Description: Missing Authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager.This issue affects SportsPress – Sports Club & League Manager: from n/a through 2.7.20.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/sportspress/wordpress-sportspress-sports-club-league-manager-plugin-2-7-20-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sportspress/wordpress-sportspress-sports-club-league-manager-plugin-2-7-20-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35692
Published: 2024-06-11
Description: Missing Authorization vulnerability in Termly Cookie Consent.This issue affects Cookie Consent: from n/a through 3.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/uk-cookie-consent/wordpress-gdpr-ccpa-cookie-consent-banner-plugin-3-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/uk-cookie-consent/wordpress-gdpr-ccpa-cookie-consent-banner-plugin-3-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35716
Published: 2024-06-11
Description: Missing Authorization vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/copymatic/wordpress-copymatic-plugin-1-9-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/copymatic/wordpress-copymatic-plugin-1-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-4155
Published: 2024-06-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-4206
Published: 2024-06-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-4387
Published: 2024-06-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-5398
Published: 2024-06-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-5584
Published: 2024-06-11
Description: The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Color Profile parameter in all versions up to, and including, 23.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with the staff member role and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/23.2/backend/modules/staff/resources/js/staff-list.js#L44; https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad9fcd1-b3a3-4711-ad23-d27c3e2091f4?source=cve; https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/23.2/backend/modules/staff/resources/js/staff-list.js#L44
CVE: CVE-2024-5825
Published: 2024-06-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52179
Published: 2024-06-11
Description: Missing Authorization vulnerability in WebCodingPlace Product Expiry for WooCommerce.This issue affects Product Expiry for WooCommerce: from n/a through 2.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/product-expiry-for-woocommerce/wordpress-product-expiry-for-woocommerce-plugin-2-5-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/product-expiry-for-woocommerce/wordpress-product-expiry-for-woocommerce-plugin-2-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34813
Published: 2024-06-11
Description: Missing Authorization vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.7.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/smart-wishlist-for-more-convert/vulnerability/wordpress-woocommerce-wishlist-plugin-1-7-8-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smart-wishlist-for-more-convert/wordpress-woocommerce-wishlist-plugin-1-7-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35685
Published: 2024-06-11
Description: Missing Authorization vulnerability in Anders Norén Radcliffe 2.This issue affects Radcliffe 2: from n/a through 2.0.17.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/radcliffe-2/wordpress-radcliffe-2-theme-2-0-17-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/radcliffe-2/wordpress-radcliffe-2-theme-2-0-17-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-5829
Published: 2024-06-11
Description: A vulnerability classified as problematic was found in smallweigit Avue up to 3.4.4. Affected by this vulnerability is an unknown functionality of the component avueUeditor. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267895. NOTE: The code maintainer explains, that "rich text is no longer maintained".
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/smallweigit/avue/issues/I9UQ4Q; https://vuldb.com/?ctiid.267895; https://vuldb.com/?id.267895
CVE: CVE-2023-38533
Published: 2024-06-11
Description: A vulnerability has been identified in TIA Administrator (All versions < V3 SP2). The affected component creates temporary download files in a directory with insecure permissions. This could allow any authenticated attacker on Windows to disrupt the update process.
CVSS Score: 3.3 (LOW)
CWE: CWE-379
References: https://cert-portal.siemens.com/productcert/html/ssa-319319.html; https://cert-portal.siemens.com/productcert/html/ssa-319319.html
CVE: CVE-2023-50763
Published: 2024-06-11
Description: A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). The web server of affected products, if configured to allow the import of PKCS12 containers, could end up in an infinite loop when processing incomplete certificate chains.

This could allow an authenticated remote attacker to create a denial of service condition by importing specially crafted PKCS12 containers.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-835
References: https://cert-portal.siemens.com/productcert/html/ssa-139628.html; https://cert-portal.siemens.com/productcert/html/ssa-337522.html; https://cert-portal.siemens.com/productcert/html/ssa-625862.html
CVE: CVE-2024-33500
Published: 2024-06-11
Description: A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-269
References: https://cert-portal.siemens.com/productcert/html/ssa-540640.html; https://cert-portal.siemens.com/productcert/html/ssa-540640.html
CVE: CVE-2024-35206
Published: 2024-06-11
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application does not expire the session. This could allow an attacker to get unauthorized access.
CVSS Score: 7.7 (HIGH)
CWE: CWE-613
References: https://cert-portal.siemens.com/productcert/html/ssa-196737.html; https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE: CVE-2024-35207
Published: 2024-06-11
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The web interface of the affected devices are vulnerable to Cross-Site Request Forgery(CSRF) attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform arbitrary actions on the device on behalf of the victim user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-352
References: https://cert-portal.siemens.com/productcert/html/ssa-196737.html; https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE: CVE-2024-35208
Published: 2024-06-11
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server stored the password in cleartext. This could allow attacker in a privileged position to obtain access passwords.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://cert-portal.siemens.com/productcert/html/ssa-196737.html; https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE: CVE-2024-35209
Published: 2024-06-11
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowing HTTP methods like PUT and Delete. This could allow an attacker to modify unauthorized files.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-749
References: https://cert-portal.siemens.com/productcert/html/ssa-196737.html; https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE: CVE-2024-35210
Published: 2024-06-11
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-319
References: https://cert-portal.siemens.com/productcert/html/ssa-196737.html; https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE: CVE-2024-35211
Published: 2024-06-11
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-614
References: https://cert-portal.siemens.com/productcert/html/ssa-196737.html; https://cert-portal.siemens.com/productcert/html/ssa-196737.html