deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-41585
Published: 2024-10-03
Description: DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recvCmd binary to escape from the emulated instance and inject arbitrary commands into the host machine.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41586
Published: 2024-10-03
Description: A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code via a long query string to the cgi-bin/ipfedr.cgi component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41587
Published: 2024-10-03
Description: Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41588
Published: 2024-10-03
Description: The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strncpy function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41589
Published: 2024-10-03
Description: DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41590
Published: 2024-10-03
Description: Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41591
Published: 2024-10-03
Description: DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41592
Published: 2024-10-03
Description: DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41593
Published: 2024-10-03
Description: DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41594
Published: 2024-10-03
Description: An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-326
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41595
Published: 2024-10-03
Description: DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of missing bounds checks on read and write operations.
CVSS Score: 8.0 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-41596
Published: 2024-10-03
Description: Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form parameters.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://www.forescout.com/resources/draybreak-draytek-research/; https://www.forescout.com/resources/draytek14-vulnerabilities
CVE: CVE-2024-9266
Published: 2024-10-03
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://www.herodevs.com/vulnerability-directory/cve-2024-9266
CVE: CVE-2024-46658
Published: 2024-10-03
Description: Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/jackalkarlos/CVE-2024-46658/tree/main
CVE: CVE-2024-41925
Published: 2024-10-03
Description: The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01
CVE: CVE-2024-42417
Published: 2024-10-03
Description: Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-03; https://www.deltaww.com/en-US/Cybersecurity_Advisory
CVE: CVE-2024-43699
Published: 2024-10-03
Description: Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-03; https://www.deltaww.com/en-US/Cybersecurity_Advisory
CVE: CVE-2024-45367
Published: 2024-10-03
Description: The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1390
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01
CVE: CVE-2024-44204
Published: 2024-10-04
Description: A logic issue was addressed with improved validation. This issue is fixed in iOS 18.0.1 and iPadOS 18.0.1. A user's saved passwords may be read aloud by VoiceOver.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121373; http://seclists.org/fulldisclosure/2024/Oct/1
CVE: CVE-2024-44207
Published: 2024-10-04
Description: This issue was addressed with improved checks. This issue is fixed in iOS 18.0.1 and iPadOS 18.0.1. Audio messages in Messages may be able to capture a few seconds of audio before the microphone indicator is activated.
CVSS Score: 4.3 (MEDIUM)
References: https://support.apple.com/en-us/121373; http://seclists.org/fulldisclosure/2024/Oct/1
CVE: CVE-2024-47850
Published: 2024-10-04
Description: CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/OpenPrinting/cups; https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-rq86-c7g6-r2h8; https://www.akamai.com/blog/security-research/october-cups-ddos-threat
CVE: CVE-2024-8519
Published: 2024-10-04
Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'um_loggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/core/class-shortcodes.php#L433; https://github.com/ultimatemember/ultimatemember/pull/1545; https://plugins.trac.wordpress.org/changeset/3160947/ultimate-member/tags/2.8.7/includes/core/class-shortcodes.php
CVE: CVE-2024-8520
Published: 2024-10-04
Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the admin_init or user_action_hook function. This makes it possible for unauthenticated attackers to modify a users membership status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1880; https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1945; https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1948C1-L1959C6
CVE: CVE-2024-8802
Published: 2024-10-04
Description: The Clio Grow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/clio-grow-form/trunk/includes/class-grow-form-settings.php#L550; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3173797%40clio-grow-form%2Ftrunk&old=3149451%40clio-grow-form%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/10fcfddf-0ed7-471d-86bf-c38e7021c6a4?source=cve
CVE: CVE-2024-9204
Published: 2024-10-04
Description: The Smart Custom 404 Error Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all versions up to, and including, 11.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/404page/tags/11.4.7/functions.php#L112; https://plugins.trac.wordpress.org/browser/404page/tags/11.4.7/inc/class-404page.php#L1227; https://plugins.trac.wordpress.org/changeset/3161639/#file2
CVE: CVE-2024-9237
Published: 2024-10-04
Description: The Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/fish-and-ships/tags/1.5.9/includes/wizard.php#L226; https://plugins.trac.wordpress.org/browser/fish-and-ships/tags/1.5.9/includes/wizard.php#L369; https://plugins.trac.wordpress.org/browser/fish-and-ships/tags/1.5.9/includes/wizard.php#L479
CVE: CVE-2024-9345
Published: 2024-10-04
Description: The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable when notices are present.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/product-delivery-date-for-woocommerce-lite/tags/-2.7.3/includes/component/pro-notices-in-lite/ts-pro-notices.php#L102; https://plugins.trac.wordpress.org/changeset/3161353/product-delivery-date-for-woocommerce-lite/tags/2.7.4/includes/component/pro-notices-in-lite/ts-pro-notices.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1127a5f3-1698-45e9-85bd-4eebfdbe56d4?source=cve
CVE: CVE-2024-9349
Published: 2024-10-04
Description: The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/amazon-auto-links/tags/5.4.2/include/core/main/admin/report/http_request/AmazonAutoLinks_AdminPage_Tab_HTTPRequest.php#L133; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3161302%40amazon-auto-links&new=3161302%40amazon-auto-links&sfp_email=&sfph_mail=#file5; https://www.wordfence.com/threat-intel/vulnerabilities/id/7ebd4936-9d68-42cb-a427-a1db894b49ec?source=cve
CVE: CVE-2024-9353
Published: 2024-10-04
Description: The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/popularis-extra/tags/1.2.6/includes/wizard/wizard.php#L305; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3161466%40popularis-extra&new=3161466%40popularis-extra&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc82778-0493-456f-bc73-3d70e3a2b1bf?source=cve
CVE: CVE-2024-9368
Published: 2024-10-04
Description: The Aggregator Advanced Settings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/aggregator-advanced-settings/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/838bfa4c-2eb7-4f76-a6c3-ab4684f3913c?source=cve
CVE: CVE-2024-9372
Published: 2024-10-04
Description: The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-blocks-hub/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/7d32b2cc-9336-432e-9d2e-67db8b0e3f90?source=cve
CVE: CVE-2024-9375
Published: 2024-10-04
Description: The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.0.36. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/captcha-bank/trunk/captcha-bank.php#L1297; https://www.wordfence.com/threat-intel/vulnerabilities/id/ba796adc-db76-4b9d-a6f9-f0f51f070240?source=cve
CVE: CVE-2024-9384
Published: 2024-10-04
Description: The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wholesale-pricing-woocommerce/tags/3.8.0/includes/settings/class-alg-wc-wholesale-pricing-settings-per-product.php#L126; https://plugins.trac.wordpress.org/changeset/3161269/wholesale-pricing-woocommerce/tags/3.8.1/includes/settings/class-alg-wc-wholesale-pricing-settings-per-product.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e84ee2b5-96b5-427c-ac66-7f80418ae02f?source=cve
CVE: CVE-2024-9421
Published: 2024-10-04
Description: The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/login-logout-shortcode/trunk/login-logout-shortcode.php#L39; https://wordpress.org/plugins/login-logout-shortcode/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/8f7ce513-45ba-427b-8ee0-1007e404c1a9?source=cve
CVE: CVE-2024-9445
Published: 2024-10-04
Description: The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_medium_posts shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/display-medium-posts/trunk/display-medium-posts.php#L200; https://wordpress.org/plugins/display-medium-posts/; https://www.wordfence.com/threat-intel/vulnerabilities/id/be1e0216-d9de-45e9-837c-0cccb78729a6?source=cve
CVE: CVE-2024-47854
Published: 2024-10-04
Description: An XSS vulnerability was discovered in Veritas Data Insight before 7.1. It allows a remote attacker to inject an arbitrary web script into an HTTP request that could reflect back to an authenticated user without sanitization if executed by that user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-47854; https://www.veritas.com/content/support/en_US/security/VTS24-010
CVE: CVE-2024-47855
Published: 2024-10-04
Description: util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e; https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0
CVE: CVE-2024-6442
Published: 2024-10-04
Description: In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m22j-ccg7-4v4h
CVE: CVE-2024-6443
Published: 2024-10-04
Description: In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-125, CWE-787, CWE-125, CWE-787
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gg46-3rh2-v765
CVE: CVE-2024-8804
Published: 2024-10-04
Description: The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions up to, and including, 2.4 due to insufficient restrictions on who can utilize the functionality. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3162219%40simple-embed-code&new=3162219%40simple-embed-code&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4149e1-8378-4007-bbf2-1ac3c479e7ea?source=cve
CVE: CVE-2024-9242
Published: 2024-10-04
Description: The Memberful – Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'memberful_buy_subscription_link' and 'memberful_podcasts_link' shortcodes in all versions up to, and including, 1.73.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/memberful-wp/tags/1.73.7/src/shortcodes.php#L25; https://plugins.trac.wordpress.org/browser/memberful-wp/tags/1.73.7/src/shortcodes.php#L59; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3161020%40memberful-wp&new=3161020%40memberful-wp&sfp_email=&sfph_mail=
CVE: CVE-2024-6444
Published: 2024-10-04
Description: No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qj4r-chj6-h7qp