deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39331
Published: 2024-06-23
Description: In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29; https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8; https://list.orgmode.org/87sex5gdqc.fsf%40localhost/
CVE: CVE-2024-6273
Published: 2024-06-23
Description: A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as problematic. Affected by this vulnerability is the function save_patient of the file patient_side.php. The manipulation of the argument Full Name/Contact/Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269485 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://docs.google.com/document/d/14ExrgXqPQlgvjw2poqNzYzAOi-C5tda-XBJF513yzag/edit?usp=sharing; https://github.com/sgr-xd/CVEs/blob/main/CVE-2024-6273.md; https://vuldb.com/?ctiid.269485
CVE: CVE-2024-39334
Published: 2024-06-23
Description: MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. When a victim opens the details of this transaction in the client, files can be written to the computer on which the client process is running. (The server process is not affected.)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502
References: https://mendelson-e-c.com/node/27845; https://mendelson-e-c.com/node/27845
CVE: CVE-2024-39337
Published: 2024-06-24
Description: Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://www.clickstudios.com.au/passwordstate-changelog.aspx; https://www.clickstudios.com.au/security/advisories/; https://www.clickstudios.com.au/passwordstate-changelog.aspx
CVE: CVE-2024-3121
Published: 2024-06-24
Description: A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.
CVSS Score: 3.3 (LOW)
CWE: CWE-94, CWE-78
References: https://huntr.com/bounties/db57c343-9b80-4c1c-9ab0-9eef92c9b27b; https://huntr.com/bounties/db57c343-9b80-4c1c-9ab0-9eef92c9b27b
CVE: CVE-2024-6274
Published: 2024-06-24
Description: A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1. This affects an unknown part of the file /attendancelist.php of the component Attendance Report Page. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269487.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://powerful-bulb-c36.notion.site/sql-injection-1-6b3c[PII_REDACTED]5ea764561a47239907; https://vuldb.com/?ctiid.269487; https://vuldb.com/?id.269487
CVE: CVE-2024-6275
Published: 2024-06-24
Description: A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. This vulnerability affects unknown code of the file parent.php of the component Parent Page. The manipulation of the argument update leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269488.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://powerful-bulb-c36.notion.site/sql-injection-2-bd75eb9250214c2e95e57965d9ea392a; https://vuldb.com/?ctiid.269488; https://vuldb.com/?id.269488
CVE: CVE-2024-6276
Published: 2024-06-24
Description: A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. This issue affects some unknown processing of the file teacher.php of the component Teacher Page. The manipulation of the argument update leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269489 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://powerful-bulb-c36.notion.site/sql-injection-3-52ce387faca74869b441eb1bf4cec27a; https://vuldb.com/?ctiid.269489; https://vuldb.com/?id.269489
CVE: CVE-2024-4499
Published: 2024-06-24
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65a; https://huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65a
CVE: CVE-2024-6277
Published: 2024-06-24
Description: A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1. Affected is an unknown function of the file student.php of the component Student Page. The manipulation of the argument update leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269490 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://powerful-bulb-c36.notion.site/sql-injection-4-a2545288ad9244009ff1097df19ee635; https://vuldb.com/?ctiid.269490; https://vuldb.com/?id.269490
CVE: CVE-2024-6278
Published: 2024-06-24
Description: A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file subject.php of the component Subject Page. The manipulation of the argument update leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269491.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://powerful-bulb-c36.notion.site/sql-injection-5-f0e968979e3c47049ed5965ca3a7ed7e; https://vuldb.com/?ctiid.269491; https://vuldb.com/?id.269491
CVE: CVE-2024-6279
Published: 2024-06-24
Description: A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file examresults-par.php of the component Exam Results Page. The manipulation of the argument sid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269492.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://powerful-bulb-c36.notion.site/sql-injection-6-cb069f55445545e19212a7b1ae489a72; https://vuldb.com/?ctiid.269492; https://vuldb.com/?id.269492
CVE: CVE-2024-6280
Published: 2024-06-24
Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269493 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/Isfulou/cve/blob/main/upload.md; https://vuldb.com/?ctiid.269493; https://vuldb.com/?id.269493
CVE: CVE-2024-4899
Published: 2024-06-24
Description: The SEOPress  WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/15346ae9-9a29-4968-a6a9-81d1116ac448/; https://wpscan.com/vulnerability/15346ae9-9a29-4968-a6a9-81d1116ac448/
CVE: CVE-2024-4900
Published: 2024-06-24
Description: The SEOPress  WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://wpscan.com/vulnerability/a56ad272-e2ed-4064-9b5d-114a834dd8b3/; https://wpscan.com/vulnerability/a56ad272-e2ed-4064-9b5d-114a834dd8b3/
CVE: CVE-2024-24550
Published: 2024-06-24
Description: A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77, CWE-434, CWE-502
References: https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/; https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE: CVE-2024-24551
Published: 2024-06-24
Description: A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-434, CWE-502
References: https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/; https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE: CVE-2024-24552
Published: 2024-06-24
Description: A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/; https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE: CVE-2024-24553
Published: 2024-06-24
Description: Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-cryptographically secure function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/; https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE: CVE-2024-4460
Published: 2024-06-24
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-24554
Published: 2024-06-24
Description: Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287, CWE-338
References: https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/; https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE: CVE-2024-27136
Published: 2024-06-24
Description: XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.  Apache JSPWiki users should upgrade to 2.12.2 or later. 
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136; https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5; http://www.openwall.com/lists/oss-security/2024/06/23/3
CVE: CVE-2024-36495
Published: 2024-06-24
Description: The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file:



C:\ProgramData\WINSelect\WINSelect.wsd

The path for the affected WINSelect Enterprise configuration file is:

C:\ProgramData\Faronics\StorageSpace\WS\WINSelect.wsd
CVSS Score: 7.7 (HIGH)
CWE: CWE-276
References: http://seclists.org/fulldisclosure/2024/Jun/12; https://r.sec-consult.com/winselect; https://www.faronics.com/en-uk/document-library/document/winselect-standard-release-notes
CVE: CVE-2024-36496
Published: 2024-06-24
Description: The configuration file is encrypted with a static key derived from a 
static five-character password which allows an attacker to decrypt this 
file. The application hashes this five-character password with 
the outdated and broken MD5 algorithm (no salt) and uses the first five 
bytes as the key for RC4. The configuration file is then encrypted with 
these parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://seclists.org/fulldisclosure/2024/Jun/12; https://r.sec-consult.com/winselect; https://www.faronics.com/en-uk/document-library/document/winselect-standard-release-notes
CVE: CVE-2024-36497
Published: 2024-06-24
Description: The decrypted configuration file contains the password in cleartext 
which is used to configure WINSelect. It can be used to remove the 
existing restrictions and disable WINSelect entirely.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-312
References: http://seclists.org/fulldisclosure/2024/Jun/12; https://r.sec-consult.com/winselect; https://www.faronics.com/en-uk/document-library/document/winselect-standard-release-notes
CVE: CVE-2024-4754
Published: 2024-06-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Stored XSS.This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-0739; https://www.usom.gov.tr/bildirim/tr-24-0739
CVE: CVE-2024-5683
Published: 2024-06-24
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code Inclusion.This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.usom.gov.tr/bildirim/tr-24-0739; https://www.usom.gov.tr/bildirim/tr-24-0739
CVE: CVE-2024-29868
Published: 2024-06-24
Description: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism.
This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account.
This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0.

Users are recommended to upgrade to version 0.95.0, which fixes the issue.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-338
References: https://lists.apache.org/thread/g7t7zctvq2fysrw1x17flnc12592nhx7; http://www.openwall.com/lists/oss-security/2024/06/22/1; https://lists.apache.org/thread/g7t7zctvq2fysrw1x17flnc12592nhx7
CVE: CVE-2024-6160
Published: 2024-06-24
Description: SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1.
CWE: CWE-89
References: https://cert.pl/en/posts/2024/06/CVE-2024-6160/; https://cert.pl/posts/2024/06/CVE-2024-6160/; https://megabip.pl/
CVE: CVE-2024-36038
Published: 2024-06-24
Description: Zoho ManageEngine ITOM products versions from 128234 to 128248 are affected by the stored cross-site scripting vulnerability in the proxy server option.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/itom/advisory/cve-2024-36038.html; https://www.manageengine.com/itom/advisory/cve-2024-36038.html
CVE: CVE-2024-37089
Published: 2024-06-24
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-37091
Published: 2024-06-24
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixThemes Masterstudy Elementor Widgets allows OS Command Injection.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0; Masterstudy Elementor Widgets: from n/a through 1.2.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-remote-code-execution-rce-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/masterstudy-elementor-widgets/wordpress-masterstudy-elementor-widgets-plugin-1-2-2-remote-code-execution-rce-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-37092
Published: 2024-06-24
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-37107
Published: 2024-06-24
Description: Improper Privilege Management vulnerability in Membership Software WishList Member X allows Privilege Escalation.This issue affects WishList Member X: from n/a before 3.26.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-authenticated-privilege-escalation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-authenticated-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-37109
Published: 2024-06-24
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows Code Injection.This issue affects WishList Member X: from n/a before 3.26.7.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-authenticated-arbitrary-php-code-execution-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-authenticated-arbitrary-php-code-execution-vulnerability?_s_id=cve
CVE: CVE-2024-37111
Published: 2024-06-24
Description: Missing Authorization vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-denial-of-service-attack-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-denial-of-service-attack-vulnerability?_s_id=cve
CVE: CVE-2024-37228
Published: 2024-06-24
Description: Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.38.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-0-38-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/instawp-connect/wordpress-instawp-connect-plugin-0-1-0-38-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-37231
Published: 2024-06-24
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulation.This issue affects Salon booking system: from n/a through 9.9.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/salon-booking-system/wordpress-salon-booking-system-plugin-9-9-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/salon-booking-system/wordpress-salon-booking-system-plugin-9-9-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-37233
Published: 2024-06-24
Description: Improper Authentication vulnerability in Play.Ht allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Play.Ht: from n/a through 3.6.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://patchstack.com/database/vulnerability/play-ht/wordpress-play-ht-plugin-3-6-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/play-ht/wordpress-play-ht-plugin-3-6-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-3264
Published: 2024-06-24
Description: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validation.This issue affects Mia-Med Health Aplication: before 1.0.14.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://www.usom.gov.tr/bildirim/tr-24-0765; https://www.usom.gov.tr/bildirim/tr-24-0765
CVE: CVE-2024-4839
Published: 2024-06-24
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The affected functions include Elastic search Service (under construction), XTTS service, Petals service, vLLM service, and Motion Ctrl service, which lack CSRF protection. This vulnerability allows attackers to deceive users into unwittingly installing the XTTS service among other packages by submitting a malicious installation request. Successful exploitation results in attackers tricking users into performing actions without their consent.
CVSS Score: 3.3 (LOW)
CWE: CWE-352
References: https://huntr.com/bounties/dcfc5a07-0427-42b5-a623-8d943873d7ff; https://huntr.com/bounties/dcfc5a07-0427-42b5-a623-8d943873d7ff
CVE: CVE-2024-5862
Published: 2024-06-24
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Interface Manipulation.This issue affects Mia-Med Health Aplication: before 1.0.14.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://www.usom.gov.tr/bildirim/tr-24-0765; https://www.usom.gov.tr/bildirim/tr-24-0765