deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-20255
Published: 2024-02-07
Description: A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.
 This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352, CWE-352
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3
CVE: CVE-2024-20290
Published: 2024-02-07
Description: A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
 This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources.
 For a description of this vulnerability, see the ClamAV blog .
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6MUDUPAHAAV6FPB2C2QIQCFJ4SHYBOTY/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t
CVE: CVE-2024-23806
Published: 2024-02-07
Description: Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02; https://www.hidglobal.com/support; https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02
CVE: CVE-2024-24563
Published: 2024-02-07
Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an `int` as an index for an array. The typechecker allows the usage of signed integers to be used as indexes to arrays. The vulnerability is present in different forms in all versions, including `0.3.10`. For ints, the 2's complement representation is used. Because the array was declared very large, the bounds checking will pass Negative values will simply be represented as very large numbers. As of time of publication, a fixed version does not exist.

There are three potential vulnerability classes: unpredictable behavior, accessing inaccessible elements and denial of service. Class 1: If it is possible to index an array with a negative integer without reverting, this is most likely not anticipated by the developer and such accesses can cause unpredictable behavior for the contract. Class 2: If a contract has an invariant in the form `assert index < x`, the developer will suppose that no elements on indexes `y | y >= x` are accessible. However, by using negative indexes, this can be bypassed. Class 3: If the index is dependent on the state of the contract, this poses a risk of denial of service. If the state of the contract can be manipulated in such way that the index will be forced to be negative, the array access can always revert (because most likely the array won't be declared extremely large). However, all these the scenarios are highly unlikely. Most likely behavior is a revert on the bounds check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://github.com/vyperlang/vyper/blob/a1fd228cb9936c3e4bbca6f3ee3fb4426ef45490/vyper/codegen/core.py#L534-L541; https://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/semantics/types/subscriptable.py#L127-L137; https://github.com/vyperlang/vyper/security/advisories/GHSA-52xq-j7v9-v4v2
CVE: CVE-2024-24706
Published: 2024-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Forum One WP-CFM wp-cfm.This issue affects WP-CFM: from n/a through 1.7.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/forumone/wp-cfm/security/advisories/GHSA-2449-jmfc-gc7f; https://patchstack.com/database/vulnerability/wp-cfm/wordpress-wp-cfm-plugin-1-7-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://github.com/forumone/wp-cfm/security/advisories/GHSA-2449-jmfc-gc7f
CVE: CVE-2024-24816
Published: 2024-02-07
Description: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://ckeditor.com/cke4/addon/preview; https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb; https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-mw2c-vx6j-mg76
CVE: CVE-2024-24822
Published: 2024-02-07
Description: Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/pimcore/admin-ui-classic-bundle/commit/24660b6d5ad9cbcb037a48d4309a6024e9adf251; https://github.com/pimcore/admin-ui-classic-bundle/pull/412; https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-3rfr-mpfj-2jwq
CVE: CVE-2024-24823
Published: 2024-02-07
Description: Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session could be used to gain elevated access to an existing Graylog login session, provided the malicious user could successfully inject their session cookie into someone else's browser. The complexity of such an attack is high, because it requires presenting a spoofed login screen and injection of a session cookie into an existing browser, potentially through a cross-site scripting attack. No such attack has been discovered. Graylog 5.1.11 and 5.2.4, and any versions of the 6.0 development branch, contain patches to not re-use sessions under any circumstances. Some workarounds are available. Using short session expiration and explicit log outs of unused sessions can help limiting the attack vector. Unpatched this vulnerability exists, but is relatively hard to exploit. A proxy could be leveraged to clear the `authentication` cookie for the Graylog server URL for the `/api/system/sessions` endpoint, as that is the only one vulnerable.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-384
References: https://github.com/Graylog2/graylog2-server/commit/1596b749db86368ba476662f23a0f0c5ec2b5097; https://github.com/Graylog2/graylog2-server/commit/b93a66353f35a94a4e8f3f75ac4f5cdc5a2d4a6a; https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-3xf8-g8gr-g7rh
CVE: CVE-2024-24824
Published: 2024-02-07
Description: Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader. If a user with the appropriate permissions performs the request, arbitrary classes with 1-arg String constructors can be instantiated. This will execute arbitrary code that is run during class instantiation. In the specific use case of `java.io.File`, the behavior of the internal web-server stack will lead to information exposure by including the entire file content in the response to the REST request. Versions 5.1.11 and 5.2.4 contain a fix for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-863, CWE-863
References: https://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214; https://github.com/Graylog2/graylog2-server/commit/75ef2b8d60e7d67f859b79fe712c8ae7b2e861d8; https://github.com/Graylog2/graylog2-server/commit/7f8ef7fa8edf493106d5ef6f777d4da02c5194d9
CVE: CVE-2024-23769
Published: 2024-02-07
Description: Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 (for Windows) allows a local attacker to read privileged data.
CVSS Score: 7.3 (HIGH)
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-38995
Published: 2024-02-07
Description: An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-38995-Schuhfried-Preauth-PrivEsc.pdf; https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-38995-Schuhfried-Preauth-PrivEsc.pdf
CVE: CVE-2024-22984
Published: 2024-02-07
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-24488
Published: 2024-02-07
Description: An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00[PII_REDACTED] allows a local attacker to obtain sensitive information via the password component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://github.com/minj-ae/CVE-2024-24488; https://github.com/minj-ae/CVE-2024-24488
CVE: CVE-2023-6356
Published: 2024-02-07
Description: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing kernel panic and a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2024:0723; https://access.redhat.com/errata/RHSA-2024:0724; https://access.redhat.com/errata/RHSA-2024:0725
CVE: CVE-2023-6535
Published: 2024-02-07
Description: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2024:0723; https://access.redhat.com/errata/RHSA-2024:0724; https://access.redhat.com/errata/RHSA-2024:0725
CVE: CVE-2023-6536
Published: 2024-02-07
Description: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2024:0723; https://access.redhat.com/errata/RHSA-2024:0724; https://access.redhat.com/errata/RHSA-2024:0725
CVE: CVE-2023-6736
Published: 2024-02-07
Description: An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted content in the CODEOWNERS file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/435036; https://hackerone.com/reports/2269023; https://gitlab.com/gitlab-org/gitlab/-/issues/435036
CVE: CVE-2023-6840
Published: 2024-02-07
Description: An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/435500; https://hackerone.com/reports/2280292; https://gitlab.com/gitlab-org/gitlab/-/issues/435500
CVE: CVE-2024-1066
Published: 2024-02-07
Description: An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL `vulnerabilitiesCountByDay`
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/420341; https://gitlab.com/gitlab-org/gitlab/-/issues/420341
CVE: CVE-2024-23448
Published: 2024-02-07
Description: An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://discuss.elastic.co/t/apm-server-8-12-1-security-update-esa-2024-03/352688; https://www.elastic.co/community/security; https://discuss.elastic.co/t/apm-server-8-12-1-security-update-esa-2024-03/352688
CVE: CVE-2024-24806
Published: 2024-02-07
Description: libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918
References: http://www.openwall.com/lists/oss-security/2024/02/08/2; http://www.openwall.com/lists/oss-security/2024/02/11/1; http://www.openwall.com/lists/oss-security/2024/03/11/1
CVE: CVE-2023-48974
Published: 2024-02-08
Description: Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.axigen.com/mail-server/download/; https://www.axigen.com/updates/axigen-10.3.3.61; https://www.axigen.com/mail-server/download/
CVE: CVE-2024-24018
Published: 2024-02-08
Description: A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/dataPerm/list
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/201206030/novel-plus; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24018.txt; https://github.com/201206030/novel-plus
CVE: CVE-2024-24023
Published: 2024-02-08
Description: A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/201206030/novel-plus; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24023.txt; https://github.com/201206030/novel-plus
CVE: CVE-2024-24024
Published: 2024-02-08
Description: An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker can pass in specially crafted filePath and fieName parameters to perform arbitrary File download.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/201206030/novel-plus; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24024.txt; https://github.com/201206030/novel-plus
CVE: CVE-2024-24025
Published: 2024-02-08
Description: An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/201206030/novel-plus; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24025.txt; https://github.com/201206030/novel-plus
CVE: CVE-2024-24026
Published: 2024-02-08
Description: An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/201206030/novel-plus; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24026.txt; https://github.com/201206030/novel-plus
CVE: CVE-2024-24350
Published: 2024-02-08
Description: File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extension filtering component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://gist.github.com/viniciuspinheiros/4e53b297fd6466cf12d01867ee1c9c33; https://medium.com/%40viniciuspinheiros/e-sic-livre-2-0-authenticated-file-upload-leads-to-remote-code-execution-rce-5937c9537258; https://gist.github.com/viniciuspinheiros/4e53b297fd6466cf12d01867ee1c9c33
CVE: CVE-2024-22394
Published: 2024-02-08
Description: An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker to bypass authentication. 

This issue affects only firmware version SonicOS 7.1.1-7040.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0003; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0003
CVE: CVE-2024-24003
Published: 2024-02-08
Description: jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24003.txt; https://github.com/jishenghua/jshERP/issues/99; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24003.txt
CVE: CVE-2024-24014
Published: 2024-02-08
Description: A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/201206030/novel-plus; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24014.txt; https://github.com/201206030/novel-plus
CVE: CVE-2024-24017
Published: 2024-02-08
Description: A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /common/dict/list
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/201206030/novel-plus; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24017.txt; https://github.com/201206030/novel-plus
CVE: CVE-2024-24021
Published: 2024-02-08
Description: A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/201206030/novel-plus; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24021.txt; https://github.com/201206030/novel-plus
CVE: CVE-2023-47798
Published: 2024-02-08
Description: Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47798; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47798
CVE: CVE-2023-5665
Published: 2024-02-08
Description: The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32130 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L1013; https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L1054; https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L1128