deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-33633
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Reflected XSS.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/piotnet-addons-for-elementor-pro/wordpress-piotnet-addons-for-elementor-pro-plugin-7-1-17-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/piotnet-addons-for-elementor-pro/wordpress-piotnet-addons-for-elementor-pro-plugin-7-1-17-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33640
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LBell Pretty Google Calendar allows Stored XSS.This issue affects Pretty Google Calendar: from n/a through 1.7.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pretty-google-calendar/wordpress-pretty-google-calendar-plugin-1-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pretty-google-calendar/wordpress-pretty-google-calendar-plugin-1-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33643
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey Lampert Advanced Most Recent Posts Mod allows Stored XSS.This issue affects Advanced Most Recent Posts Mod: from n/a through 1.6.5.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-most-recent-posts-mod/wordpress-advanced-most-recent-posts-mod-plugin-1-6-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-most-recent-posts-mod/wordpress-advanced-most-recent-posts-mod-plugin-1-6-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33645
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eftakhairul Islam & Sirajus Salayhin Easy Set Favicon allows Reflected XSS.This issue affects Easy Set Favicon: from n/a through 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-set-favicon/wordpress-easy-set-favicon-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-set-favicon/wordpress-easy-set-favicon-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33646
Published: 2024-04-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Sticky Anything allows Cross-Site Scripting (XSS).This issue affects Sticky Anything: from n/a through 2.1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/toast-stick-anything/wordpress-sticky-anything-plugin-2-1-5-broken-access-control-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/toast-stick-anything/wordpress-sticky-anything-plugin-2-1-5-broken-access-control-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33648
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemory Grubb Recencio Book Reviews recencio-book-reviews allows DOM-Based XSS.This issue affects Recencio Book Reviews: from n/a through <= 1.66.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/recencio-book-reviews/vulnerability/wordpress-recencio-book-reviews-plugin-1-66-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/recencio-book-reviews/wordpress-recencio-book-reviews-plugin-1-66-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33649
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpOpal Opal Widgets For Elementor allows Stored XSS.This issue affects Opal Widgets For Elementor: from n/a through 1.6.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/opal-widgets-for-elementor/wordpress-opal-widgets-for-elementor-plugin-1-6-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/opal-widgets-for-elementor/wordpress-opal-widgets-for-elementor-plugin-1-6-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-52723
Published: 2024-04-29
Description: In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a password value.
CVSS Score: 7.1 (HIGH)
CWE: CWE-798
References: http://www.openwall.com/lists/oss-security/2024/04/30/1; https://invent.kde.org/pim/libksieve/-/commit/6b460ba93ac4ac503ba039d0b788ac7595120db1; https://invent.kde.org/pim/libksieve/-/tags/v23.03.80
CVE: CVE-2024-1905
Published: 2024-04-29
Description: The Smart Forms  WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b9a448d2-4bc2-4933-8743-58c8768a619f/; https://wpscan.com/vulnerability/b9a448d2-4bc2-4933-8743-58c8768a619f/
CVE: CVE-2024-2505
Published: 2024-04-29
Description: The GamiPress  WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend access to lower privileged users, like Subscribers, despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical GamiPress  WordPress plugin before 6.8.9 configurations.
CVSS Score: 8.1 (HIGH)
References: https://wpscan.com/vulnerability/9b3d6148-ecee-4e59-84a4-3b3e9898473b/; https://wpscan.com/vulnerability/9b3d6148-ecee-4e59-84a4-3b3e9898473b/
CVE: CVE-2024-33537
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Horse WP Portfolio allows Stored XSS.This issue affects WP Portfolio: from n/a through 2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-portfolio/wordpress-wp-portfolio-theme-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-portfolio/wordpress-wp-portfolio-theme-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33539
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor (Templates, Widgets) allows Stored XSS.This issue affects WPZOOM Addons for Elementor (Templates, Widgets): from n/a through 1.1.35.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpzoom-elementor-addons/wordpress-wpzoom-addons-for-elementor-plugin-1-1-35-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpzoom-elementor-addons/wordpress-wpzoom-addons-for-elementor-plugin-1-1-35-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33540
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill ColorNews allows Stored XSS.This issue affects ColorNews: from n/a through 1.2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/colornews/wordpress-colornews-theme-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/colornews/wordpress-colornews-theme-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33542
Published: 2024-04-29
Description: Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/crelly-slider/wordpress-crelly-slider-plugin-1-4-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/crelly-slider/wordpress-crelly-slider-plugin-1-4-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-33548
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team WZone allows Reflected XSS.This issue affects WZone: from n/a through 14.0.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33551
Published: 2024-04-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore Core allows SQL Injection.This issue affects XStore Core: from n/a through 5.3.5.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-33554
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core allows Reflected XSS.This issue affects XStore Core: from n/a through 5.3.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33559
Published: 2024-04-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/xstore/wordpress-xstore-theme-9-3-5-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/xstore/wordpress-xstore-theme-9-3-5-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-33562
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore allows Reflected XSS.This issue affects XStore: from n/a through 9.3.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/xstore/wordpress-xstore-theme-9-3-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/xstore/wordpress-xstore-theme-9-3-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33571
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This issue affects VOD Infomaniak: from n/a through <= 1.5.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vod-infomaniak/vulnerability/wordpress-vod-infomaniak-plugin-1-5-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/vod-infomaniak/wordpress-vod-infomaniak-plugin-1-5-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33630
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through 2.4.26.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/piotnet-addons-for-elementor/wordpress-piotnet-addons-for-elementor-plugin-2-4-26-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/piotnet-addons-for-elementor/wordpress-piotnet-addons-for-elementor-plugin-2-4-26-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33631
Published: 2024-04-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Stored XSS.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/piotnet-addons-for-elementor-pro/wordpress-piotnet-addons-for-elementor-pro-plugin-7-1-17-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/piotnet-addons-for-elementor-pro/wordpress-piotnet-addons-for-elementor-pro-plugin-7-1-17-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33632
Published: 2024-04-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/piotnet-addons-for-elementor-pro/wordpress-piotnet-addons-for-elementor-pro-plugin-7-1-17-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/piotnet-addons-for-elementor-pro/wordpress-piotnet-addons-for-elementor-pro-plugin-7-1-17-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33681
Published: 2024-04-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Regenerate post permalink allows Cross-Site Scripting (XSS).This issue affects Regenerate post permalink: from n/a through 1.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/regenerate-post-permalinks/wordpress-regenerate-post-permalink-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/regenerate-post-permalinks/wordpress-regenerate-post-permalink-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33686
Published: 2024-04-29
Description: Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea WP: from n/a through 1.0.13; Elevate WP: from n/a through 1.0.15; Brite: from n/a through 1.0.11; Colibri WP: from n/a through 1.0.94; Vertice: from n/a through 1.0.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/althea-wp/wordpress-althea-wp-theme-1-0-13-broken-access-control-vulnerability; https://patchstack.com/database/vulnerability/brite/wordpress-brite-theme-1-0-11-broken-access-control-vulnerability; https://patchstack.com/database/vulnerability/colibri-wp/wordpress-colibri-wp-theme-1-0-94-broken-access-control-vulnerability
CVE: CVE-2024-33904
Published: 2024-04-29
Description: In plugins/HookSystem.cpp in Hyprland through 0.39.1 (before 28c8561), through a race condition, a local attacker can cause execution of arbitrary assembly code by writing to a predictable temporary file.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://github.com/hyprwm/Hyprland/commit/28c85619243e6320e75d7abcfe8244fa99d054dd; https://github.com/hyprwm/Hyprland/issues/5787; https://www.openwall.com/lists/oss-security/2024/04/28/3
CVE: CVE-2024-33905
Published: 2024-04-29
Description: In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2024/04/30/4; https://github.com/morethanwords/tweb/commit/2153ea[PII_REDACTED]faac8dd5931b7e0b96a9f129/src/components/popups/webApp.ts; https://medium.com/%40pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90
CVE: CVE-2024-4302
Published: 2024-04-29
Description: Super 8 Live Chat online customer service platform fails to properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. When the message recipient views the message, they become susceptible to Cross-site Scripting (XSS) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-7779-35562-1.html; https://www.twcert.org.tw/tw/cp-132-7779-35562-1.html
CVE: CVE-2024-4303
Published: 2024-04-29
Description: ArmorX Android APP's multi-factor authentication (MFA) for the login function is not properly implemented. Remote attackers who obtain user credentials can bypass MFA, allowing them to successfully log into the APP.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://www.twcert.org.tw/tw/cp-132-7781-ef309-1.html; https://www.twcert.org.tw/tw/cp-132-7781-ef309-1.html
CVE: CVE-2024-33544
Published: 2024-04-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZone: from n/a through 14.0.10.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-33546
Published: 2024-04-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZone: from n/a through 14.0.10.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-arbitrary-sql-update-execution-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-arbitrary-sql-update-execution-vulnerability?_s_id=cve
CVE: CVE-2024-3191
Published: 2024-04-29
Description: A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/MailCleaner/MailCleaner/pull/601; https://modzero.com/en/advisories/mz-24-01-mailcleaner/; https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
CVE: CVE-2024-3192
Published: 2024-04-29
Description: A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/MailCleaner/MailCleaner/pull/601; https://modzero.com/en/advisories/mz-24-01-mailcleaner/; https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
CVE: CVE-2024-3193
Published: 2024-04-29
Description: A vulnerability has been found in MailCleaner up to 2023.03.14 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Admin Endpoints. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-262309 was assigned to this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/MailCleaner/MailCleaner/pull/601; https://modzero.com/en/advisories/mz-24-01-mailcleaner/; https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
CVE: CVE-2024-3194
Published: 2024-04-29
Description: A vulnerability was found in MailCleaner up to 2023.03.14 and classified as problematic. Affected by this issue is some unknown functionality of the component Log File Endpoint. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-262310 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/MailCleaner/MailCleaner/pull/601; https://modzero.com/en/advisories/mz-24-01-mailcleaner/; https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
CVE: CVE-2024-3195
Published: 2024-04-29
Description: A vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin Endpoints. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262311.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/MailCleaner/MailCleaner/pull/601; https://modzero.com/en/advisories/mz-24-01-mailcleaner/; https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
CVE: CVE-2024-3196
Published: 2024-04-29
Description: A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat/dumpConfiguration of the component SOAP Service. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262312.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://github.com/MailCleaner/MailCleaner/pull/601; https://modzero.com/en/advisories/mz-24-01-mailcleaner/; https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
CVE: CVE-2024-33538
Published: 2024-04-29
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fastline Media LLC Assistant – Every Day Productivity Apps.This issue affects Assistant – Every Day Productivity Apps: from n/a through 1.4.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/assistant/wordpress-assistant-every-day-productivity-apps-plugin-1-4-9-1-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/assistant/wordpress-assistant-every-day-productivity-apps-plugin-1-4-9-1-sensitive-data-exposure-vulnerability?_s_id=cve