deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-23906
Published: 2024-09-11
Description: Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnostic webpage allows an attacker to modify Controller configuration during an authenticated Operator's session.

 



This issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-23906
CVE: CVE-2024-24972
Published: 2024-09-11
Description: Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated operator to reboot the Controller, causing a Denial of Service. Gallagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support. This interface is intended only for diagnostic purposes.

This issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-24972
CVE: CVE-2024-39808
Published: 2024-09-11
Description: Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Controller wiring to instigate a reboot leading to a denial of service. 



This issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-131
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-39808
CVE: CVE-2024-8253
Published: 2024-09-11
Description: The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not properly restricting what user meta values can be updated and ensuring a form is active. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta to become an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L3032; https://plugins.trac.wordpress.org/changeset/3130155/post-grid/tags/2.2.87/includes/blocks/form-wrap/functions.php; https://plugins.trac.wordpress.org/changeset/3146752/post-grid/tags/2.2.91/includes/blocks/form-wrap/functions.php
CVE: CVE-2024-1656
Published: 2024-09-11
Description: Affected versions of Octopus Server had a weak content security policy.
CVSS Score: 2.6 (LOW)
References: https://advisories.octopus.com/post/2024/sa2024-08/
CVE: CVE-2024-21529
Published: 2024-09-11
Description: Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the program.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1321
References: https://github.com/lukeed/dset/commit/16d6154e085bef01e99f01330e5a421a7f098afa; https://security.snyk.io/vuln/SNYK-JS-DSET-7116691
CVE: CVE-2024-43690
Published: 2024-09-11
Description: Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).

This issue affects: Command Centre Server and Command Centre Workstations 9.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior.
CVSS Score: 8.0 (HIGH)
CWE: CWE-829
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43690
CVE: CVE-2024-7721
Published: 2024-09-11
Description: The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to, and including, 2.5.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set any options that are not explicitly checked as false to an array, including enabling user registration if it has been disabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/Ajax.php#L79; https://plugins.trac.wordpress.org/changeset/3148088/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc3f308-d1e1-430b-bccd-168c0972fe7c?source=cve
CVE: CVE-2024-7727
Published: 2024-09-11
Description: The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/Ajax.php#L5; https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/ImportData.php#L4; https://plugins.trac.wordpress.org/changeset/3139559/
CVE: CVE-2024-3899
Published: 2024-09-11
Description: The Gallery Plugin for WordPress  WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e3afadda-4d9a-4a51-b744-10de7d8d8578/
CVE: CVE-2024-7716
Published: 2024-09-11
Description: The Logo Slider  WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cfa67c43-6f09-43f5-9fbe-32a98a82f548/
CVE: CVE-2024-8440
Published: 2024-09-11
Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Fancy_Text.php#L114; https://plugins.trac.wordpress.org/changeset/3148624/; https://wordpress.org/plugins/essential-addons-for-elementor-lite/#developers
CVE: CVE-2024-7626
Published: 2024-09-11
Description: The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.6.7/src/dashboard/class-delicious-recipes-form-handler.php#L260; https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.6.7/src/dashboard/class-delicious-recipes-form-handler.php#L355; https://plugins.trac.wordpress.org/changeset/3148996/delicious-recipes/trunk/src/dashboard/class-delicious-recipes-form-handler.php
CVE: CVE-2024-8045
Published: 2024-09-11
Description: The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/advanced-backgrounds/trunk/assets/admin/gutenberg/block.json#L69; https://plugins.trac.wordpress.org/browser/advanced-backgrounds/trunk/assets/admin/gutenberg/index.min.js; https://plugins.trac.wordpress.org/browser/advanced-backgrounds/trunk/classes/class-gutenberg.php#L146
CVE: CVE-2019-25212
Published: 2024-09-11
Description: The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset?old_path=/wp-responsive-video-gallery-with-lightbox/tags/1.0.6&new_path=/wp-responsive-video-gallery-with-lightbox/tags/1.0.7&sfp_email=&sfph_mail=#file41; https://wordpress.org/plugins/wp-responsive-video-gallery-with-lightbox; https://www.wordfence.com/threat-intel/vulnerabilities/id/85e70be3-3ed7-4ce1-a20c-046fb7c4ec31?source=cve
CVE: CVE-2024-8277
Published: 2024-09-11
Description: The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login() function and not properly verifying the user's identity. This makes it possible for unauthenticated attackers to log in as user that has dismissed an admin notice in the past 30 days, which is often an administrator. Alternatively, a user can log in as any user with any transient that has a valid user_id as the value, though it would be more difficult to exploit this successfully.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://codecanyon.net/item/woocommerce-photo-reviews/21245349; https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e2d370-a716-4d6b-8e23-74db2fbd0760?source=cve
CVE: CVE-2024-45327
Published: 2024-09-11
Description: An improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-048
CVE: CVE-2024-8096
Published: 2024-09-11
Description: When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://curl.se/docs/CVE-2024-8096.html; https://curl.se/docs/CVE-2024-8096.json; https://hackerone.com/reports/2669852
CVE: CVE-2024-45786
Published: 2024-09-11
Description: This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to gain unauthorized access to sensitive information belonging to other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0291
CVE: CVE-2024-45787
Published: 2024-09-11
Description: This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL and intercepting response of the API request leading to exposure of sensitive information belonging to other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-359
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0291
CVE: CVE-2024-45788
Published: 2024-09-11
Description: This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/flooding on the targeted system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-799
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0291
CVE: CVE-2024-45789
Published: 2024-09-11
Description: This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper validation of the ‘mode’ parameter in the API endpoint used during the registration process. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body on the vulnerable application.

Successful exploitation of this vulnerability could allow the attacker to bypass certain constraints in the registration process leading to creation of multiple accounts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-354
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0291
CVE: CVE-2024-5416
Published: 2024-09-11
Description: The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in Elementor Editor pages. This was partially patched in version 3.23.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/elementor/tags/3.21.8/includes/widgets/image.php#L820; https://plugins.trac.wordpress.org/browser/elementor/tags/3.21.8/includes/widgets/social-icons.php#L659; https://plugins.trac.wordpress.org/browser/elementor/tags/3.21.8/includes/widgets/testimonial.php#L608
CVE: CVE-2024-7609
Published: 2024-09-11
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vidco Software VOC TESTER allows Path Traversal.This issue affects VOC TESTER: before 12.34.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.usom.gov.tr/bildirim/tr-24-1447; https://github.com/advisories/GHSA-6mh6-642h-83x7
CVE: CVE-2024-45790
Published: 2024-09-11
Description: This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to gain unauthorized access and compromise other user accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0291
CVE: CVE-2024-6091
Published: 2024-09-11
Description: A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/significant-gravitas/autogpt/commit/ef691359b774a1f9f80cf4f5ace9821967b718ed; https://huntr.com/bounties/8a742c13-bb5e-4bc9-8b86-049d8a386050
CVE: CVE-2024-27112
Published: 2024-09-11
Description: A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database. The vulnerability has been remediated in version 1.52.02.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://csirt.divd.nl/CVE-2024-27112
CVE: CVE-2024-27113
Published: 2024-09-11
Description: An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability has been remediated in version 1.52.02.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-639
References: https://csirt.divd.nl/CVE-2024-27113
CVE: CVE-2024-27114
Published: 2024-09-11
Description: A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is removed, leading to execution of code on the underlying system. The vulnerability has been remediated in version 1.52.02.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-367, CWE-367
References: https://csirt.divd.nl/CVE-2024-27114
CVE: CVE-2024-27115
Published: 2024-09-11
Description: A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://csirt.divd.nl/CVE-2024-27115
CVE: CVE-2024-7805
Published: 2024-09-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-8636
Published: 2024-09-11
Description: Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787, CWE-416
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html; https://issues.chromium.org/issues/361461526
CVE: CVE-2024-8637
Published: 2024-09-11
Description: Use after free in Media Router in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html; https://issues.chromium.org/issues/361784548
CVE: CVE-2024-8638
Published: 2024-09-11
Description: Type Confusion in V8 in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843, CWE-416
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html; https://issues.chromium.org/issues/362539773
CVE: CVE-2024-8639
Published: 2024-09-11
Description: Use after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html; https://issues.chromium.org/issues/362658609
CVE: CVE-2024-8642
Published: 2024-09-11
Description: In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.
CVSS Score: 8.1 (HIGH)
CWE: CWE-303, CWE-305, CWE-287
References: https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6; https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0; https://gitlab.eclipse.org/security/cve-assignement/-/issues/28
CVE: CVE-2024-8646
Published: 2024-09-11
Description: In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed.
This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish.
This vulnerability only affects applications that are explicitly deployed to the root context ('/').
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/eclipse-ee4j/glassfish/pull/24655; https://gitlab.eclipse.org/security/cve-assignement/-/issues/34; https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/163
CVE: CVE-2024-43793
Published: 2024-09-11
Description: Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. This vulnerability is fixed in 2.19.0.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/halo-dev/halo/security/advisories/GHSA-28x9-hppj-m537