deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45802
Published: 2024-10-28
Description: Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted server against all clients using the proxy. This bug is fixed in the default build configuration of Squid version 6.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/squid-cache/squid/security/advisories/GHSA-f975-v7qw-q7hj; https://lists.debian.org/debian-lts-announce/2025/03/msg00009.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-48291
Published: 2024-10-28
Description: dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/Gxxxxxxxxxxxxxxxxxx/cms/tree/main/4/readme.md
CVE: CVE-2024-49761
Published: 2024-10-28
Description: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f; https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m; https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
CVE: CVE-2024-10469
Published: 2024-10-28
Description: VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://github.com/CERTCC/VINCE/
CVE: CVE-2024-42028
Published: 2024-10-28
Description: A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://community.ui.com/releases/Security-Advisory-Bulletin-043-043/28e45c75-314e-4f07-a4f3-d17f67bd53f7
CVE: CVE-2024-47827
Published: 2024-10-28
Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-362, CWE-1108
References: https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75; https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a; https://github.com/argoproj/argo-workflows/pull/13641
CVE: CVE-2024-49771
Published: 2024-10-28
Description: MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/joniles/mpxj/commit/[PII_REDACTED]dfdc8bc74259f37e053e15b827eea0; https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6
CVE: CVE-2024-6245
Published: 2024-10-28
Description: Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market.

This issue affects SmartPlay: 66T0.05.50.
CVSS Score: 7.4 (HIGH)
CWE: CWE-1392
References: https://www.global-infotainment-system.com/en/top.html; https://www.marutisuzuki.com/corporate/technology/smartplay-systems
CVE: CVE-2024-50438
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Reflected XSS.This issue affects Church Admin: from n/a through < 5.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50439
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through <= 1.2.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/astra-widgets/vulnerability/wordpress-astra-widgets-plugin-1-2-14-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50440
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Coyier CodePen Embedded Pens Shortcode codepen-embedded-pen-shortcode allows Stored XSS.This issue affects CodePen Embedded Pens Shortcode: from n/a through <= 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/codepen-embedded-pen-shortcode/vulnerability/wordpress-codepen-embedded-pens-shortcode-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50441
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cozy-addons/vulnerability/wordpress-cozy-blocks-plugin-2-0-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50445
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Selection Lite selection-lite allows Stored XSS.This issue affects Selection Lite: from n/a through <= 1.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/selection-lite/vulnerability/wordpress-selection-lite-plugin-1-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50446
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra.This issue affects Futurio Extra: from n/a through <= 2.0.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/futurio-extra/vulnerability/wordpress-futurio-extra-plugin-2-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50447
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce envo-elementor-for-woocommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a through <= 1.4.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/envo-elementor-for-woocommerce/vulnerability/wordpress-envo-s-elementor-templates-widgets-for-woocommerce-plugin-1-4-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50448
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.14.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/yith-woocommerce-product-add-ons/vulnerability/wordpress-yith-woocommerce-product-add-ons-plugin-4-14-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50449
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Stored XSS.This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through <= 1.7.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pdf-generator-addon-for-elementor-page-builder/vulnerability/wordpress-pdf-generator-addon-for-elementor-page-builder-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50451
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.This issue affects MDTF: from n/a through <= 1.3.3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-meta-data-and-taxonomies-filter-plugin-1-3-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50458
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored XSS.This issue affects Advanced Sermons: from n/a through <= 3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advanced-sermons/vulnerability/wordpress-advanced-sermons-plugin-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50460
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through <= 2.3.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-fancybox/vulnerability/wordpress-firelight-lightbox-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50461
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper EmbedPress embedpress allows Stored XSS.This issue affects EmbedPress: from n/a through <= 4.0.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/embedpress/vulnerability/wordpress-embedpress-plugin-4-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50462
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in html5maps Interactive World Map interactive-world-map allows Stored XSS.This issue affects Interactive World Map: from n/a through <= 3.4.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/interactive-world-map/vulnerability/wordpress-interactive-world-map-plugin-3-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50464
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes kodex-posts-likes.This issue affects Kodex Posts likes: from n/a through <= 2.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kodex-posts-likes/vulnerability/wordpress-kodex-posts-likes-plugin-2-5-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-50467
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in siteengineai Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin scrollbar-by-webxapp allows Stored XSS.This issue affects Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin: from n/a through <= 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/scrollbar-by-webxapp/vulnerability/wordpress-scrollbar-by-webxapp-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50468
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faceleg Raptor Editor wp-raptor allows DOM-Based XSS.This issue affects Raptor Editor: from n/a through <= 1.0.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-raptor/vulnerability/wordpress-raptor-editor-plugin-1-0-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50469
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brightvesseldev Textboxes textboxes allows DOM-Based XSS.This issue affects Textboxes: from n/a through <= 0.1.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/textboxes/vulnerability/wordpress-textboxes-plugin-0-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-9629
Published: 2024-10-28
Description: The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wpcf7_Telegram::ajax' function in versions up to, and including, 0.8.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve, pause and refuse subscriptions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/cf7-telegram/tags/0.8.4/classes/wpcf7telegram.php#L537; https://plugins.trac.wordpress.org/changeset/3176353/cf7-telegram#file21; https://www.wordfence.com/threat-intel/vulnerabilities/id/f330fa5a-b471-45ee-a2a6-3ae8f3941bfe?source=cve
CVE: CVE-2024-50429
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlockArt Magazine Blocks magazine-blocks allows DOM-Based XSS.This issue affects Magazine Blocks: from n/a through <= 1.3.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/magazine-blocks/vulnerability/wordpress-magazine-blocks-plugin-1-3-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50431
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze allows Stored XSS.This issue affects Breeze: from n/a through <= 2.1.14.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/breeze/vulnerability/wordpress-breeze-plugin-2-1-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50432
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Cross-Site Scripting (XSS).This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.2.93.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-grid/vulnerability/wordpress-post-grid-and-gutenberg-blocks-plugin-2-2-93-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50433
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons allows Cross-Site Scripting (XSS).This issue affects Sky Addons for Elementor: from n/a through <= 2.5.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sky-elementor-addons/vulnerability/wordpress-sky-addons-for-elementor-free-templates-library-live-copy-animations-post-grid-post-carousel-particles-sliders-chart-blogs-plugin-2-5-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50437
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.80.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-3-80-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-5532
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Operations Agent. 

The XSS vulnerability could allow an attacker with local admin permissions to manipulate the content of the internal status page of the Agent on the local system. 

This issue affects Operations Agent: 12.20, 12.21, 12.22, 12.23, 12.24, 12.25, 12.26.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://portal.microfocus.com/s/article/KM000035731?language=en_US
CVE: CVE-2024-9825
Published: 2024-10-28
Description: The Chef Habitat builder-api on-prem-builder package  with any version lower than habitat/builder-api/10315/[PII_REDACTED]2802 is vulnerable to indirect object reference (IDOR) by un-authorized deletion of personal token.  Habitat builder consumes builder-api habitat package as a dependency and the vulnerability was specifically due to builder-api habitat package.

The fix was made available in habitat/builder-api/10315/[PII_REDACTED]2802 and all the subsequent versions after that. We would recommend user to always use on-prem stable channel.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://community.progress.com/s/article/Chef-Habitat-Builder-Product-Alert; https://docs.chef.io/habitat/builder_overview/
CVE: CVE-2024-39205
Published: 2024-10-28
Description: An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/Marven11/CVE-2024-39205-Pyload-RCE/tree/main; https://github.com/pyload/pyload; https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r
CVE: CVE-2024-42930
Published: 2024-10-28
Description: PbootCMS 3.2.8 is vulnerable to URL Redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/cyb3res3c/CVE-2024-42930/blob/main/CVE-2024-42930.md; https://www.pbootcms.com/
CVE: CVE-2024-48178
Published: 2024-10-28
Description: newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://github.com/dabaizhizhu/123/issues/10
CVE: CVE-2024-48195
Published: 2024-10-28
Description: Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cyb3res3c/CVE-2024-48195/blob/main/CVE-2024-48195.md
CVE: CVE-2024-48196
Published: 2024-10-28
Description: An issue in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter.
CVSS Score: 7.5 (HIGH)
References: https://github.com/cyb3res3c/CVE-2024-49186/blob/main/CVE-2024-48196.md
CVE: CVE-2024-48357
Published: 2024-10-28
Description: LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Jingyi-u/LyLme_Spage_2/blob/main/README.md
CVE: CVE-2024-48465
Published: 2024-10-28
Description: The MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameter
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/4459gif/zo/blob/main/index.html; https://mrbs.sourceforge.io/
CVE: CVE-2024-48825
Published: 2024-10-28
Description: Tenda AC7 v.15.03.06.44 ate_ifconfig_set has pre-authentication command injection allowing remote attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/ixout/iotVuls/blob/main/Tenda/ac7_005/report.md
CVE: CVE-2024-48826
Published: 2024-10-28
Description: Tenda AC7 v.15.03.06.44 ate_iwpriv_set has pre-authentication command injection allowing remote attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/ixout/iotVuls/blob/main/Tenda/ac7_006/report.md
CVE: CVE-2024-49755
Published: 2024-10-28
Description: Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens. Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication. This vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs.
CVSS Score: 3.1 (LOW)
CWE: CWE-287
References: https://github.com/DuendeSoftware/IdentityServer/commit/f28cac921c1f545afe65af71a[PII_REDACTED]b6dac; https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-v9xq-2mvm-x8xc
CVE: CVE-2024-50434
Published: 2024-10-28
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse NewsCard newscard.This issue affects NewsCard: from n/a through <= 1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/newscard/vulnerability/wordpress-newscard-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-50435
Published: 2024-10-28
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Meta News meta-news.This issue affects Meta News: from n/a through <= 1.1.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/meta-news/vulnerability/wordpress-meta-news-theme-1-1-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-50436
Published: 2024-10-28
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Clean Retina clean-retina.This issue affects Clean Retina: from n/a through <= 3.0.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/clean-retina/vulnerability/wordpress-clean-retina-theme-3-0-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-50453
Published: 2024-10-28
Description: Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elementor addons: from n/a through <= 2.0.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/the-pack-addon/vulnerability/wordpress-the-pack-elementor-addons-plugin-2-0-9-local-file-inclusion-vulnerability?_s_id=cve