deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-26147
Published: 2024-02-21
Description: Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the `LoadIndexFile` or `DownloadIndexFile` functions in the `repo` package or the `LoadDir` function in the `plugin` package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use `recover` to catch the panic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-457, CWE-908
References: https://github.com/helm/helm/commit/bb4cc9125503a923afb7988f3eb478722a8580af; https://github.com/helm/helm/security/advisories/GHSA-r53h-jv2g-vpx6; https://github.com/helm/helm/commit/bb4cc9125503a923afb7988f3eb478722a8580af
CVE: CVE-2024-26148
Published: 2024-02-21
Description: Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of `javascript:` protocol which can potentially trigger arbitrary client-side execution. The most extreme exploit of this flaw could occur when an admin user unknowingly clicks on a cross-site scripting URL, thereby unintentionally compromising admin role access to the attacker. A patch to rectify this issue has been introduced in Querybook version `3.31.1`. The fix is backward compatible and automatically fixes existing DataDocs. There are no known workarounds for this issue, except for manually checking each URL prior to clicking on them.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pinterest/querybook/commit/bc620dabaaf13ff1dcb30af0b46a490403fb9908; https://github.com/pinterest/querybook/pull/1412; https://github.com/pinterest/querybook/security/advisories/GHSA-fh6g-gvvp-587f
CVE: CVE-2023-6477
Published: 2024-02-22
Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member permission, they may be able to make a group, other members or themselves Owners of that group, which may lead to privilege escalation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-266
References: https://gitlab.com/gitlab-org/gitlab/-/issues/433463; https://hackerone.com/reports/2270898; https://gitlab.com/gitlab-org/gitlab/-/issues/433463
CVE: CVE-2024-0410
Published: 2024-02-22
Description: An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.
CVSS Score: 7.7 (HIGH)
CWE: CWE-841
References: https://gitlab.com/gitlab-org/gitlab/-/issues/437988; https://hackerone.com/reports/2296778; https://gitlab.com/gitlab-org/gitlab/-/issues/437988
CVE: CVE-2024-0446
Published: 2024-02-22
Description: A maliciously crafted STP, CATPART or MODEL file, when parsed in ASMKERN228A.dll and ASMdatax229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-0861
Published: 2024-02-22
Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://gitlab.com/gitlab-org/gitlab/-/issues/439240; https://hackerone.com/reports/2316435; https://gitlab.com/gitlab-org/gitlab/-/issues/439240
CVE: CVE-2024-1451
Published: 2024-02-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload  added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims."
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/441457; https://hackerone.com/reports/2371126; https://gitlab.com/gitlab-org/gitlab/-/issues/441457
CVE: CVE-2024-1525
Published: 2024-02-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password, bypassing LDAP.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-288
References: https://gitlab.com/gitlab-org/gitlab/-/issues/438144; https://gitlab.com/gitlab-org/gitlab/-/issues/438144
CVE: CVE-2024-23120
Published: 2024-02-22
Description: A maliciously crafted STP and STEP file, when parsed in ASMIMPORT228A.dll and ASMIMPORT229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2023-4895
Published: 2024-02-22
Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' settings to access environment details of projects
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/424766; https://hackerone.com/reports/2134787; https://gitlab.com/gitlab-org/gitlab/-/issues/424766
CVE: CVE-2024-25251
Published: 2024-02-22
Description: code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://code-projects.org/agro-school-management-system-in-php-with-source-code/; https://github.com/ASR511-OO7/CVE-2024-25251/blob/main/CVE-17; https://code-projects.org/agro-school-management-system-in-php-with-source-code/
CVE: CVE-2024-25423
Published: 2024-02-22
Description: An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d_base.xdl64 file.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: http://cinema.com; http://maxon.com; https://github.com/DriverUnload/cve-2024-25423
CVE: CVE-2024-23121
Published: 2024-02-22
Description: A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23122
Published: 2024-02-22
Description: A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23123
Published: 2024-02-22
Description: A maliciously crafted CATPART file, when parsed in CC5Dll.dll and ASMBASE228A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23124
Published: 2024-02-22
Description: A maliciously crafted STP file, when parsed in ASMIMPORT228A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
CVE: CVE-2024-23125
Published: 2024-02-22
Description: A maliciously crafted SLDPRT file when parsed ODXSW_DLL.dll through Autodesk applications can be used to cause a Stack-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
CVE: CVE-2024-23126
Published: 2024-02-22
Description: A maliciously crafted CATPART file when parsed CC5Dll.dll through Autodesk applications can be used to cause a Stack-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
CVE: CVE-2024-23127
Published: 2024-02-22
Description: A maliciously crafted MODEL, SLDPRT, or SLDASM file, when parsed in ODXSW_DLL.dll and libodxdll.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23128
Published: 2024-02-22
Description: A maliciously crafted MODEL file, when parsed in libodxdll.dll and ASMDATAX229A.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23129
Published: 2024-02-22
Description: A maliciously crafted MODEL 3DM, STP, or SLDASM file, when in opennurbs.dll parsed through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23130
Published: 2024-02-22
Description: A maliciously crafted SLDASM or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23131
Published: 2024-02-22
Description: A maliciously crafted STP file, when parsed in ASMIMPORT229A.dll, ASMKERN228A.dll, ASMkern229A.dll or ASMDATAX228A.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23132
Published: 2024-02-22
Description: A maliciously crafted STP file in atf_dwg_consumer.dll when parsed through Autodesk applications can lead to a memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
CVE: CVE-2024-23133
Published: 2024-02-22
Description: A maliciously crafted STP file in ASMDATAX228A.dll when parsed through Autodesk applications can lead to a memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
CVE: CVE-2024-23134
Published: 2024-02-22
Description: A maliciously crafted IGS file in tbb.dll when parsed through Autodesk AutoCAD can be used in user-after-free vulnerability. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-23135
Published: 2024-02-22
Description: A maliciously crafted SLDPRT file in ASMkern228A.dll when parsed through Autodesk applications can be used in user-after-free vulnerability. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
CVE: CVE-2024-23136
Published: 2024-02-22
Description: A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
CVE: CVE-2024-23137
Published: 2024-02-22
Description: A maliciously crafted STP or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457, CWE-908
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE: CVE-2024-25801
Published: 2024-02-22
Description: SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name (not the content) of a file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-434
References: https://shrouded-trowel-50c.notion.site/S-Museum-Version-7-02-3-Stored-Cross-Site-Scripting-69ca7b8805cc448ea12cb8f7ed571fa3?pvs=4; https://shrouded-trowel-50c.notion.site/S-Museum-Version-7-02-3-Stored-Cross-Site-Scripting-69ca7b8805cc448ea12cb8f7ed571fa3?pvs=4
CVE: CVE-2024-26481
Published: 2024-02-22
Description: Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/getkirby/kirby/security/advisories/GHSA-57f2-8p89-66x6; https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Self-Cross-Site-Scripting-d877183d20af49f8a8f58554bc06d51c?pvs=4; https://github.com/getkirby/kirby/security/advisories/GHSA-57f2-8p89-66x6
CVE: CVE-2024-26482
Published: 2024-02-22
Description: An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.
CVSS Score: 7.1 (HIGH)
CWE: CWE-80
References: https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-HTML-Injection-19ca19686d0a4533ab4b0c53fc977eef?pvs=4; https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-HTML-Injection-19ca19686d0a4533ab4b0c53fc977eef?pvs=4
CVE: CVE-2024-26483
Published: 2024-02-22
Description: An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/getkirby/kirby/security/advisories/GHSA-xrvh-rvc4-5m43; https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Unrestricted-File-Upload-dc60ce3132f04442b73f2dba2631fae0?pvs=4; https://github.com/getkirby/kirby/security/advisories/GHSA-xrvh-rvc4-5m43
CVE: CVE-2024-26484
Published: 2024-02-22
Description: A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field. NOTE: the vendor's position is that this issue did not affect any version of Kirby CMS. The only effect was on the trykirby.com demo site, which is not customer-controlled.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/getkirby/demokit/commit/d4877a6715cbf6517cb04ff57798851ffbd0cd7e; https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Stored-Cross-Site-Scripting-153b4eb557a2488188ad8167734ca226?pvs=4; https://github.com/getkirby/demokit/commit/d4877a6715cbf6517cb04ff57798851ffbd0cd7e
CVE: CVE-2024-27283
Published: 2024-02-22
Description: A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious files to arbitrary locations on the server on which the application is installed.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.veritas.com/support/en_US/security/VTS23-020; https://www.veritas.com/support/en_US/security/VTS23-020
CVE: CVE-2024-0903
Published: 2024-02-22
Description: The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_submitted' 'link' value in all versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the feedback submission page that will execute when a user clicks the link, while also pressing the command key.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038797%40userfeedback-lite&new=3038797%40userfeedback-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a649fbea-65cf-45c9-b853-2733f27518af?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038797%40userfeedback-lite&new=3038797%40userfeedback-lite&sfp_email=&sfph_mail=
CVE: CVE-2024-1053
Published: 2024-02-22
Description: The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with contributor-level access and above, to email the attendees list to themselves.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3038150/event-tickets/tags/5.8.2/src/Tickets/Commerce/Reports/Attendees.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a7[PII_REDACTED]-4a0d-bfc1-5f80b8433e24?source=cve; https://plugins.trac.wordpress.org/changeset/3038150/event-tickets/tags/5.8.2/src/Tickets/Commerce/Reports/Attendees.php
CVE: CVE-2024-26489
Published: 2024-02-22
Description: A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Social block links' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Profile Name text field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/[PII_REDACTED]/cms/blob/main/3.md; https://github.com/[PII_REDACTED]/cms/blob/main/3.md
CVE: CVE-2024-26490
Published: 2024-02-22
Description: A cross-site scripting (XSS) vulnerability in the Addon JD Simple module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/[PII_REDACTED]/cms/blob/main/2.md; https://github.com/[PII_REDACTED]/cms/blob/main/2.md