deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1971
Published: 2024-02-29
Description: A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Parameter Handler. The manipulation of the argument password with the input nochizplz'+or+1%3d1+limit+1%23 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255127.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/Surya2Developer%20Online_shopping_-system/SQL%20Injection%20Auth.md; https://vuldb.com/?ctiid.255127; https://vuldb.com/?id.255127
CVE: CVE-2024-20267
Published: 2024-02-29
Description: A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the netstack process to unexpectedly restart, which could cause the device to stop processing network traffic or to reload. 
 This vulnerability is due to lack of proper error checking when processing an ingress MPLS frame. An attacker could exploit this vulnerability by sending a crafted IPv6 packet that is encapsulated within an MPLS frame to an MPLS-enabled interface of the targeted device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition.
 Note: The IPv6 packet can be generated multiple hops away from the targeted device and then encapsulated within MPLS. The DoS condition may occur when the NX-OS device processes the packet.
CVSS Score: 8.6 (HIGH)
CWE: CWE-120, CWE-120
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv6-mpls-dos-R9ycXkwM; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv6-mpls-dos-R9ycXkwM
CVE: CVE-2024-20291
Published: 2024-02-29
Description: A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device.
 This vulnerability is due to incorrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access network resources that should be protected by an ACL that was applied on port channel subinterfaces.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-po-acl-TkyePgvL; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-po-acl-TkyePgvL
CVE: CVE-2024-20294
Published: 2024-02-29
Description: A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.
 This vulnerability is due to improper handling of specific fields in an LLDP frame. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface of an affected device and having an authenticated user retrieve LLDP statistics from the affected device through CLI show commands or Simple Network Management Protocol (SNMP) requests. A successful exploit could allow the attacker to cause the LLDP service to crash and stop running on the affected device. In certain situations, the LLDP crash may result in a reload of the affected device.
 Note: LLDP is a Layer 2 link protocol. To exploit this vulnerability, an attacker would need to be directly connected to an interface of an affected device, either physically or logically (for example, through a Layer 2 Tunnel configured to transport the LLDP protocol).
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-805
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-lldp-dos-z7PncTgt; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-lldp-dos-z7PncTgt
CVE: CVE-2024-20321
Published: 2024-02-29
Description: A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
 This vulnerability exists because eBGP traffic is mapped to a shared hardware rate-limiter queue. An attacker could exploit this vulnerability by sending large amounts of network traffic with certain characteristics through an affected device. A successful exploit could allow the attacker to cause eBGP neighbor sessions to be dropped, leading to a DoS condition in the network.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-770
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ebgp-dos-L3QCwVJ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ebgp-dos-L3QCwVJ
CVE: CVE-2024-20344
Published: 2024-02-29
Description: A vulnerability in system resource management in Cisco UCS 6400 and 6500 Series Fabric Interconnects that are in Intersight Managed Mode (IMM) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the Device Console UI of an affected device.
 This vulnerability is due to insufficient rate-limiting of TCP connections to an affected device. An attacker could exploit this vulnerability by sending a high number of TCP packets to the Device Console UI. A successful exploit could allow an attacker to cause the Device Console UI process to crash, resulting in a DoS condition. A manual reload of the fabric interconnect is needed to restore complete functionality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsfi-imm-syn-p6kZTDQC; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsfi-imm-syn-p6kZTDQC
CVE: CVE-2024-21722
Published: 2024-02-29
Description: The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-insufficient-session-expiration-in-mfa-management-views.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-insufficient-session-expiration-in-mfa-management-views.html
CVE: CVE-2024-21723
Published: 2024-02-29
Description: Inadequate parsing of URLs could result into an open redirect.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-open-redirect-in-installation-application.html; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-open-redirect-in-installation-application.html
CVE: CVE-2024-21724
Published: 2024-02-29
Description: Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-in-media-selection-fields.html; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-in-media-selection-fields.html
CVE: CVE-2024-21725
Published: 2024-02-29
Description: Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-xss-in-mail-address-outputs.html; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-xss-in-mail-address-outputs.html
CVE: CVE-2024-21726
Published: 2024-02-29
Description: Inadequate content filtering leads to XSS vulnerabilities in various components.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-inadequate-content-filtering-within-the-filter-code.html; https://www.sonarsource.com/blog/joomla-multiple-xss-vulnerabilities/; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-inadequate-content-filtering-within-the-filter-code.html
CVE: CVE-2024-22251
Published: 2024-02-29
Description: VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read leading to information disclosure.












CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://www.vmware.com/security/advisories/VMSA-2024-0005.html; https://www.vmware.com/security/advisories/VMSA-2024-0005.html
CVE: CVE-2024-22936
Published: 2024-02-29
Description: Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Information Systems v.3053 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/SnoopJesus420/CVEs/blob/main/CVE-2023-; https://github.com/SnoopJesus420/CVEs/blob/main/CVEs-2024/CVE-2024-22936.md; https://github.com/SnoopJesus420/CVEs/blob/main/CVE-2023-
CVE: CVE-2024-22939
Published: 2024-02-29
Description: Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_edit component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/NUDTTAN91/CVE-2024-22939; https://github.com/NUDTTAN91/CVE20240109/blob/master/README.md; https://github.com/NUDTTAN91/CVE-2024-22939
CVE: CVE-2024-23052
Published: 2024-02-29
Description: An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/WukongCRM_9.0.md#1remote-code-execution-vulnerability; https://github.com/WuKongOpenSource/WukongCRM-9.0-JAVA/issues/28; https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/WukongCRM_9.0.md#1remote-code-execution-vulnerability
CVE: CVE-2024-23302
Published: 2024-02-29
Description: Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2024-23328
Published: 2024-02-29
Description: Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java.` The blacklist of mysql jdbc attacks can be bypassed and attackers can further exploit it for deserialized execution or reading arbitrary files. This vulnerability is patched in 1.18.15 and 2.3.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/dataease/dataease/commit/4128adf5fc4592b55fa1722a53b178967545d46a; https://github.com/dataease/dataease/commit/bb540e6dc83df106ac3253f331066129a7487d1a; https://github.com/dataease/dataease/security/advisories/GHSA-8x8q-p622-jf25
CVE: CVE-2024-23519
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in M&S Consulting Email Before Download.This issue affects Email Before Download: from n/a through 6.9.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/email-before-download/wordpress-email-before-download-plugin-6-9-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/email-before-download/wordpress-email-before-download-plugin-6-9-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-23807
Published: 2024-02-29
Description: The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs.

Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.

This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/apache/xerces-c/pull/54; https://lists.apache.org/thread/c497tgn864tsbm8w0bo3f0d81s07zk9r; https://github.com/apache/xerces-c/pull/54
CVE: CVE-2024-23946
Published: 2024-02-29
Description: Possible path traversal in Apache OFBiz allowing file inclusion.
Users are recommended to upgrade to version 18.12.12, that fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-434
References: http://www.openwall.com/lists/oss-security/2024/02/28/9; https://issues.apache.org/jira/browse/OFBIZ-12884; https://lists.apache.org/thread/w4lp5ncpzttf41hn5bsc04mzq4o6lw3g
CVE: CVE-2024-24146
Published: 2024-02-29
Description: A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-434
References: https://github.com/libming/libming/issues/307; https://github.com/libming/libming/issues/307
CVE: CVE-2024-24147
Published: 2024-02-29
Description: A memory leak issue discovered in parseSWF_FILLSTYLEARRAY in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/libming/libming/issues/311; https://github.com/libming/libming/issues/311
CVE: CVE-2024-24149
Published: 2024-02-29
Description: A memory leak issue discovered in parseSWF_GLYPHENTRY in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/libming/libming/issues/310; https://github.com/libming/libming/issues/310
CVE: CVE-2024-24150
Published: 2024-02-29
Description: A memory leak issue discovered in parseSWF_TEXTRECORD in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/libming/libming/issues/309; https://github.com/libming/libming/issues/309
CVE: CVE-2024-24155
Published: 2024-02-29
Description: Bento4 v1.5.1-628 contains a Memory leak on AP4_Movie::AP4_Movie, parsing tracks and added into m_Tracks list, but mp42aac cannot correctly delete when we got an no audio track found error. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mp4 file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/axiomatic-systems/Bento4/issues/919; https://github.com/axiomatic-systems/Bento4/issues/919
CVE: CVE-2024-24701
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Native Grid LLC A no-code page builder for beautiful performance-based content.This issue affects A no-code page builder for beautiful performance-based content: from n/a through 2.1.20.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/setka-editor/wordpress-setka-editor-plugin-2-1-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/setka-editor/wordpress-setka-editor-plugin-2-1-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-24708
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in W3speedster W3SPEEDSTER.This issue affects W3SPEEDSTER: from n/a through 7.19.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/w3speedster-wp/wordpress-w3speedster-plugin-7-19-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/w3speedster-wp/wordpress-w3speedster-plugin-7-19-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-25006
Published: 2024-02-29
Description: XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://xenforo.com/community/threads/xenforo-2-2-14-released.219044/; https://xenforo.com/docs/xf2/permissions/; https://xenforo.com/tickets/BC37EB98/?v=5da7bd5728
CVE: CVE-2024-25065
Published: 2024-02-29
Description: Possible path traversal in Apache OFBiz allowing authentication bypass.
Users are recommended to upgrade to version 18.12.12, that fixes the issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2024/02/28/10; https://issues.apache.org/jira/browse/OFBIZ-12887; https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfc
CVE: CVE-2024-25128
Published: 2024-02-29
Description: Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol. Upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/dpgaspar/Flask-AppBuilder/commit/6336456d83f8f111c842b2b53d1e89627f2502c8; https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-j2pw-vp55-fqqj; https://github.com/dpgaspar/Flask-AppBuilder/commit/6336456d83f8f111c842b2b53d1e89627f2502c8
CVE: CVE-2024-25262
Published: 2024-02-29
Description: texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://bugs.launchpad.net/ubuntu/+source/texlive-bin/+bug/2047912; https://tug.org/svn/texlive/trunk/Build/source/texk/ttfdump/ChangeLog?revision=69605&view=co; https://bugs.launchpad.net/ubuntu/+source/texlive-bin/+bug/2047912
CVE: CVE-2024-25712
Published: 2024-02-29
Description: http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cosmosofcyberspace.github.io/improper_http_method_leads_to_xss/poc.html; https://github.com/swaggo/http-swagger/releases/tag/v1.2.6; https://cosmosofcyberspace.github.io/improper_http_method_leads_to_xss/poc.html
CVE: CVE-2024-25713
Published: 2024-02-29
Description: yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)
CVSS Score: 8.6 (HIGH)
CWE: CWE-94
References: https://github.com/ibireme/yyjson/security/advisories/GHSA-q4m7-9pcm-fpxh; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX/
CVE: CVE-2024-25830
Published: 2024-02-29
Description: F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the root and admin password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-284
References: https://neroteam.com/blog/f-logic-datacube3-vulnerability-report; https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
CVE: CVE-2024-25831
Published: 2024-02-29
Description: F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://neroteam.com/blog/f-logic-datacube3-vulnerability-report; https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
CVE: CVE-2024-25832
Published: 2024-02-29
Description: F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by manipulating the filename extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://neroteam.com/blog/f-logic-datacube3-vulnerability-report; https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
CVE: CVE-2024-25833
Published: 2024-02-29
Description: F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://neroteam.com/blog/f-logic-datacube3-vulnerability-report; https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
CVE: CVE-2024-25930
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/custom-order-statuses-for-woocommerce/wordpress-custom-order-statuses-for-woocommerce-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-order-statuses-for-woocommerce/wordpress-custom-order-statuses-for-woocommerce-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-25931
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Heureka Group Heureka.This issue affects Heureka: from n/a through 1.0.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/heureka/wordpress-heureka-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/heureka/wordpress-heureka-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-25932
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Manish Kumar Agarwal Change Table Prefix change-table-prefix allows Cross Site Request Forgery.This issue affects Change Table Prefix: from n/a through <= 2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/change-table-prefix/vulnerability/wordpress-change-table-prefix-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/change-table-prefix/wordpress-change-table-prefix-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve