deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-48739
Published: 2025-01-02
Description: Missing Authorization vulnerability in Porto Theme Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 2.12.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/porto-functionality/vulnerability/wordpress-porto-theme-functionality-plugin-2-11-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-48758
Published: 2025-01-02
Description: Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-2-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-49385
Published: 2025-01-02
Description: Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736, Acronis True Image OEM (Windows) before build 42575.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://security-advisory.acronis.com/advisories/SEC-2397
CVE: CVE-2024-55538
Published: 2025-01-02
Description: Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis True Image (Windows) before build 41736, Acronis True Image OEM (macOS) before build 42571, Acronis True Image OEM (Windows) before build 42575.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-306
References: https://security-advisory.acronis.com/advisories/SEC-2209
CVE: CVE-2024-56137
Published: 2025-01-02
Description: MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-76w2-2g72-cg85; https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-76w2-2g72-cg85
CVE: CVE-2025-0171
Published: 2025-01-02
Description: A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0. Affected is an unknown function of the file /admin/deleteuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Sinon2003/cve/blob/main/sql_inject1.md; https://vuldb.com/?ctiid.289938
CVE: CVE-2022-45811
Published: 2025-01-02
Description: Missing Authorization vulnerability in WeyHan Ng Post Teaser.This issue affects Post Teaser: from n/a through 4.1.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/post-teaser/vulnerability/wordpress-post-teaser-plugin-4-1-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-47601
Published: 2025-01-02
Description: Missing Authorization vulnerability in JoomUnited WP Table Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Table Manager: from n/a through 3.5.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/wp-table-manager/vulnerability/wordpress-wp-table-manager-plugin-3-5-2-broken-access-control?_s_id=cve
CVE: CVE-2023-23672
Published: 2025-01-02
Description: Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-2-25-1-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-12907
Published: 2025-01-02
Description: Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of  a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint.
Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this vulnerability.
CWE: CWE-79
References: https://cert.pl/en/posts/2025/01/CVE-2024-12907
CVE: CVE-2024-55540
Published: 2025-01-02
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-2245
CVE: CVE-2024-55541
Published: 2025-01-02
Description: Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39169.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-3647
CVE: CVE-2024-55542
Published: 2025-01-02
Description: Local privilege escalation due to excessive permissions assigned to Tray Monitor service. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169, Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35895.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-266
References: https://security-advisory.acronis.com/advisories/SEC-5342
CVE: CVE-2024-55543
Published: 2025-01-02
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-6418
CVE: CVE-2024-56413
Published: 2025-01-02
Description: Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-613
References: https://security-advisory.acronis.com/advisories/SEC-7612
CVE: CVE-2024-56414
Published: 2025-01-02
Description: Web installer integrity check used weak hash algorithm. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-328
References: https://security-advisory.acronis.com/advisories/SEC-1911
CVE: CVE-2024-9950
Published: 2025-01-02
Description: A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows 

unauthenticated user to modify compliance scripts due to insecure temporary directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-379
References: https://support.forescout.com/
CVE: CVE-2025-0172
Published: 2025-01-02
Description: A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/deleteroom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Sinon2003/cve/blob/main/chatsystem/sql_inject2.md; https://vuldb.com/?ctiid.289939
CVE: CVE-2024-11716
Published: 2025-01-02
Description: While assignment of a user to a team (bracket) in CTFd  should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pick a new one, joining another team while a competition is already ongoing.
This issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by  pull request 2636 https://github.com/CTFd/CTFd/pull/2636  included in 3.7.5 release.
CWE: CWE-837
References: https://blog.ctfd.io/ctfd-3-7-5/; https://cert.pl/en/posts/2025/01/CVE-2024-11716; https://ctfd.io/
CVE: CVE-2024-11717
Published: 2025-01-02
Description: Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to change user's password and take over the account. Moreover, the tokens also include base64 encoded user email.

This issue impacts releases up to 3.7.4 and was addressed by  pull request 2679 https://github.com/CTFd/CTFd/pull/2679  included in 3.7.5 release.
CWE: CWE-837, CWE-1391
References: https://blog.ctfd.io/ctfd-3-7-5/; https://cert.pl/en/posts/2025/01/CVE-2024-11716; https://ctfd.io/
CVE: CVE-2024-56199
Published: 2025-01-02
Description: phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at `http[:]//localhost/admin/index[.]php?action=editentry`, resulting in a complete disruption of the FAQ page's user interface. By injecting malformed HTML elements styled to cover the entire screen, an attacker can render the page unusable. This injection manipulates the page structure by introducing overlapping buttons, images, and iframes, breaking the intended layout and functionality. Exploiting this issue can lead to Denial of Service for legitimate users, damage to the user experience, and potential abuse in phishing or defacement attacks. Version 4.0.2 contains a patch for the vulnerability.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-ww33-jppq-qfrp
CVE: CVE-2025-0173
Published: 2025-01-02
Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /orders/view_order.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/listlonely/cve/blob/main/sql.md; https://vuldb.com/?ctiid.289940; https://vuldb.com/?id.289940
CVE: CVE-2024-48197
Published: 2025-01-02
Description: Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the web interface.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: http://audiocodes.com; http://mp-202b.com; https://github.com/GCatt-AS/CVE-2024-48197
CVE: CVE-2024-8447
Published: 2025-01-02
Description: A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-833
References: https://access.redhat.com/errata/RHSA-2025:3357; https://access.redhat.com/errata/RHSA-2025:3358; https://access.redhat.com/errata/RHSA-2025:7620
CVE: CVE-2024-43077
Published: 2025-01-03
Description: In DevmemValidateFlags of devicemem_server.c , there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2024-12-01
CVE: CVE-2024-43097
Published: 2025-01-03
Description: In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://android.googlesource.com/platform/external/skia/+/8d355fe1d0795fc30b84194b87563f75c6f8f2a7; https://source.android.com/security/bulletin/2024-12-01; https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html
CVE: CVE-2024-43762
Published: 2025-01-03
Description: In multiple locations, there is a possible way to avoid unbinding of a service from the system due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/ae43ac7f3d3d5112b0f54b5315a15b08208acf9c; https://source.android.com/security/bulletin/2024-12-01
CVE: CVE-2024-43764
Published: 2025-01-03
Description: In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/70eb75df7d342429c3ee225feb7c011df727442f; https://source.android.com/security/bulletin/2024-12-01
CVE: CVE-2024-43767
Published: 2025-01-03
Description: In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://android.googlesource.com/platform/external/skia/+/796c2040f641bb287dba66c9823ce45e9f8b5807; https://source.android.com/security/bulletin/2024-12-01
CVE: CVE-2024-43768
Published: 2025-01-03
Description: In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://android.googlesource.com/platform/external/skia/+/b5543cb8c6b[PII_REDACTED][PII_REDACTED]efe73eb93; https://source.android.com/security/bulletin/2024-12-01
CVE: CVE-2024-43769
Published: 2025-01-03
Description: In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://android.googlesource.com/platform/frameworks/base/+/619ffc299bf33566ba6daee8301ee0fc96e015f4; https://source.android.com/security/bulletin/2024-12-01
CVE: CVE-2025-0174
Published: 2025-01-03
Description: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /user/search_result2.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/Masamuneee/ca3f96ac0ec34bb7c1dd4bfd180f11bb; https://vuldb.com/?ctiid.290103
CVE: CVE-2025-0175
Published: 2025-01-03
Description: A vulnerability was found in code-projects Online Shop 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument name/details leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://gist.github.com/th4s1s/fc65dafa7237cc66a18ef6005075c31b; https://vuldb.com/?ctiid.290104
CVE: CVE-2025-0176
Published: 2025-01-03
Description: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /user/add_cart.php. The manipulation of the argument id/qty leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/Masamuneee/9c539b89dad40033a5037b744e394ae0; https://vuldb.com/?ctiid.290105
CVE: CVE-2024-11624
Published: 2025-01-03
Description: there is a possible to add apps to bypass VPN due to Undeclared Permission . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-47032
Published: 2025-01-03
Description: In construct_transaction_from_cmd of lwis_ioctl.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53833
Published: 2025-01-03
Description: In prepare_response_locked of  lwis_transaction.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53834
Published: 2025-01-03
Description: In sms_DisplayHexDumpOfPrivacyBuffer of sms_Utilities.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53835
Published: 2025-01-03
Description: there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53836
Published: 2025-01-03
Description: In wbrc_bt_dev_write of wb_regon_coordinator.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53837
Published: 2025-01-03
Description: In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53838
Published: 2025-01-03
Description: In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53839
Published: 2025-01-03
Description: In GetCellInfoList() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53840
Published: 2025-01-03
Description: there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53841
Published: 2025-01-03
Description: In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2024-53842
Published: 2025-01-03
Description: In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2024-12-01
CVE: CVE-2025-22275
Published: 2025-01-03
Description: iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-532
References: https://gitlab.com/gnachman/iterm2/-/wikis/SSH-Integration-Information-Leak; https://iterm2.com/downloads/stable/iTerm2-3_5_11.changelog; https://news.ycombinator.com/item?id=42579472
CVE: CVE-2024-12132
Published: 2025-01-03
Description: The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create jobs for companies that are unaffiliated with the attacker.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset/3210251/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d19ac6fc-029f-4f19-913e-e082acecc594?source=cve
CVE: CVE-2024-9138
Published: 2025-01-03
Description: Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level access to the system, posing a significant security risk.
CVSS Score: 7.2 (HIGH)
CWE: CWE-656
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241155-privilege-escalation-and-os-command-injection-vulnerabilities-in-cellular-routers,-secure-routers,-and-netwo
CVE: CVE-2024-9140
Published: 2025-01-03
Description: Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS command injection due to improperly restricted commands, potentially enabling attackers to execute arbitrary code. This poses a significant risk to the system’s security and functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241155-privilege-escalation-and-os-command-injection-vulnerabilities-in-cellular-routers,-secure-routers,-and-netwo