deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-45919
Published: 2024-03-27
Description: Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-126
References: http://seclists.org/fulldisclosure/2024/Jan/47; https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858; http://packetstormsecurity.com/files/176802/Mesa-23.0.4-Buffer-Overflow.html
CVE: CVE-2023-45920
Published: 2024-03-27
Description: Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2024/Jan/48; https://sourceforge.net/p/mcj/tickets/155/; http://packetstormsecurity.com/files/176803/Xfig-3.2.8-Null-Pointer.html
CVE: CVE-2023-45922
Published: 2024-03-27
Description: glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-754
References: http://seclists.org/fulldisclosure/2024/Jan/50; http://seclists.org/fulldisclosure/2024/Jan/71; https://gitlab.freedesktop.org/mesa/mesa/-/issues/9857
CVE: CVE-2023-45924
Published: 2024-03-27
Description: libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-476
References: http://seclists.org/fulldisclosure/2024/Jan/52; https://gitlab.freedesktop.org/glvnd/libglvnd/-/issues/242; https://gitlab.freedesktop.org/glvnd/libglvnd/-/merge_requests/295
CVE: CVE-2023-45925
Published: 2024-03-27
Description: GNU Midnight Commander 4.8.29-146-g299d9a2fb was discovered to contain a NULL pointer dereference via the function x_error_handler() at tty/x11conn.c. NOTE: this is disputed because it should be categorized as a usability problem (an X operation silently fails).
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2024/Jan/53; https://midnight-commander.org/ticket/4484; http://packetstormsecurity.com/files/176808/Midnight-Commander-4.8.29-146-g299d9a2fb-Null-Pointer.html
CVE: CVE-2023-45935
Published: 2024-03-27
Description: Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2024/Jan/61; https://bugreports.qt.io/browse/QTBUG-115599; http://packetstormsecurity.com/files/176815/qt-6.6-6.5-6.2-Null-Pointer.html
CVE: CVE-2023-46046
Published: 2024-03-27
Description: An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via ti_expr in a crafted .mzn file. NOTE: this is disputed because there is no common libminizinc use case in which an unattended process is supposed to run forever to process a series of atttacker-controlled .mzn files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2024/Jan/63; https://github.com/MiniZinc/libminizinc/commit/afe67acc20898e4308044b54c4acf7a08df544f0; https://github.com/MiniZinc/libminizinc/issues/730
CVE: CVE-2023-46047
Published: 2024-03-27
Description: An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the sanei_configure_attach() function. NOTE: this is disputed because there is no expectation that the product should be starting with an attacker-controlled configuration file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2024/Jan/64; https://gitlab.com/sane-project/backends/-/issues/708; http://packetstormsecurity.com/files/176818/sane-1.2.1-Null-Pointer.html
CVE: CVE-2023-46048
Published: 2024-03-27
Description: Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2024/Jan/65; https://tug.org/pipermail/tex-live/2023-August/049400.html; http://packetstormsecurity.com/files/176819/tex-live-944e257-Null-Pointer.html
CVE: CVE-2023-29134
Published: 2024-03-27
Description: An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/895774; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/898722; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/900133
CVE: CVE-2023-31634
Published: 2024-03-27
Description: In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the TeslaMate instance, an attacker can switch the port to 3000 to enter Grafana for remote operations. At that time, the default username and password can be used to enter the Grafana management console without logging in, a related issue to CVE-2022-23126.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/XC9409/CVE-2023-31634/blob/main/PoC; https://github.com/adriankumpf/teslamate/releases/tag/v1.27.2; https://github.com/XC9409/CVE-2023-31634/blob/main/PoC
CVE: CVE-2023-31854
Published: 2024-03-27
Description: std::bad_alloc is mishandled in Precomp 0.4.8. NOTE: this is disputed because it should be categorized as a usability problem.
References: https://github.com/schnaader/precomp-cpp/issues/139; https://github.com/schnaader/precomp-cpp/issues/139
CVE: CVE-2023-39306
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder allows Reflected XSS.This issue affects Fusion Builder: from n/a through 3.11.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fusion-builder/wordpress-avada-builder-plugin-3-11-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fusion-builder/wordpress-avada-builder-plugin-3-11-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46049
Published: 2024-03-27
Description: LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) to llvm-lto. NOTE: this is disputed because the relationship between pdflatex.fmt and any LLVM language front end is not explained, and because a crash of the llvm-lto application should be categorized as a usability problem.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2024/Jan/66; https://github.com/llvm/llvm-project/issues/67388; https://llvm.org/docs/Security.html
CVE: CVE-2023-46051
Published: 2024-03-27
Description: TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2024/Jan/68; https://tug.org/pipermail/tex-live/2023-August/049406.html; http://packetstormsecurity.com/files/176822/tex-live-944e257-Null-Pointer.html
CVE: CVE-2023-46052
Published: 2024-03-27
Description: Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
CVSS Score: 7.1 (HIGH)
References: http://seclists.org/fulldisclosure/2024/Jan/69; https://gitlab.com/sane-project/backends/-/issues/709; http://packetstormsecurity.com/files/176823/sane-1.2.1-Buffer-Overflow.html
CVE: CVE-2023-49815
Published: 2024-03-27
Description: Unrestricted Upload of File with Dangerous Type vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 5.0.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/wapppress-builds-android-app-for-website/wordpress-wapppress-plugin-5-0-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wapppress-builds-android-app-for-website/wordpress-wapppress-plugin-5-0-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-52228
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through 2.0.24.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/beds24-online-booking/wordpress-beds24-online-booking-plugin-2-0-23-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/beds24-online-booking/wordpress-beds24-online-booking-plugin-2-0-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-22149
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliver Seidel, Bastian Germann CformsII allows Stored XSS.This issue affects CformsII: from n/a through 15.0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cforms2/wordpress-cformsii-plugin-15-0-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/cforms2/wordpress-cformsii-plugin-15-0-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-22288
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Reflected XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/print-invoices-packing-slip-labels-for-woocommerce/wordpress-woocommerce-pdf-invoices-packing-slips-delivery-notes-and-shipping-labels-plugin-4-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/print-invoices-packing-slip-labels-for-woocommerce/wordpress-woocommerce-pdf-invoices-packing-slips-delivery-notes-and-shipping-labels-plugin-4-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-22299
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-player-plugin-7-5-41-7212-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-player-plugin-7-5-41-7212-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-22300
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Email Subscribers & Newsletters allows Reflected XSS.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/email-subscribers/wordpress-icegram-express-plugin-5-7-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/email-subscribers/wordpress-icegram-express-plugin-5-7-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-22311
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N Squared Simply Schedule Appointments allows Reflected XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.6.20.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simply-schedule-appointments/wordpress-simply-schedule-appointments-plugin-1-6-6-20-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simply-schedule-appointments/wordpress-simply-schedule-appointments-plugin-1-6-6-20-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24700
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Rojas WP Editor allows Reflected XSS.This issue affects WP Editor: from n/a through 1.2.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-editor/wordpress-wp-editor-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-editor/wordpress-wp-editor-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24800
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdTribes.Io Product Feed PRO for WooCommerce allows Reflected XSS.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.2.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-product-feed-pro/wordpress-product-feed-pro-for-woocommerce-plugin-13-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-product-feed-pro/wordpress-product-feed-pro-for-woocommerce-plugin-13-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24842
Published: 2024-03-27
Description: Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2.
CVSS Score: 8.7 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/echo-knowledge-base/wordpress-knowledge-base-for-documentation-faqs-with-ai-assistance-plugin-11-30-2-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/echo-knowledge-base/wordpress-knowledge-base-for-documentation-faqs-with-ai-assistance-plugin-11-30-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-25920
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-25926
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IndiaNIC Widgets Controller allows Reflected XSS.This issue affects Widgets Controller: from n/a through 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/widgets-controller/wordpress-widgets-controller-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/widgets-controller/wordpress-widgets-controller-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-28335
Published: 2024-03-27
Description: Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is running on the same machine as the "lektor server" command.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://brave.com/privacy-updates/27-localhost-permission/; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://getlektor.com/docs/quickstart
CVE: CVE-2023-25364
Published: 2024-03-27
Description: Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.opswat.com/mdcore/release-notes/archived-release-notes#version-v521; https://docs.opswat.com/mdcore/release-notes/archived-release-notes#version-v521
CVE: CVE-2023-43768
Published: 2024-03-27
Description: An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via large commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2024-1364
Published: 2024-03-27
Description: The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://elementor.com/pro/changelog/?utm_source=wp-plugins&utm_campaign=pro-changelog&utm_medium=wp-dash; https://www.wordfence.com/threat-intel/vulnerabilities/id/531954dd-ed3f-4626-adab-c1bba8407c89?source=cve; https://elementor.com/pro/changelog/?utm_source=wp-plugins&utm_campaign=pro-changelog&utm_medium=wp-dash
CVE: CVE-2024-1521
Published: 2024-03-27
Description: The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability is only exploitable on web servers running NGINX. It is not exploitable on web servers running Apache HTTP Server.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://elementor.com/pro/changelog/?utm_source=wp-plugins&utm_campaign=pro-changelog&utm_medium=wp-dash; https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd01ea6-9476-47e1-9959-3f8d9ce1c1f3?source=cve; https://elementor.com/pro/changelog/?utm_source=wp-plugins&utm_campaign=pro-changelog&utm_medium=wp-dash
CVE: CVE-2024-27188
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze.This issue affects Breeze: from n/a through <= 2.1.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/breeze/vulnerability/wordpress-breeze-plugin-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/breeze/wordpress-breeze-plugin-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-28815
Published: 2024-03-27
Description: A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive information, changes to the system configuration, or execution of arbitrary commands within the context of the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://cwe.mitre.org/data/definitions/1188.html; https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_24-0003-001-v1.pdf; https://www.mitel.com/support/security-advisories
CVE: CVE-2024-29820
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedNao PDF Builder for WPForms allows Stored XSS.This issue affects PDF Builder for WPForms: from n/a through 1.2.88.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pdf-builder-for-wpforms/wordpress-pdf-builder-for-wpforms-plugin-1-2-88-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pdf-builder-for-wpforms/wordpress-pdf-builder-for-wpforms-plugin-1-2-88-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29906
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-meta-data-filter-and-taxonomy-filter/wordpress-mdtf-meta-data-and-taxonomies-filter-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-meta-data-filter-and-taxonomy-filter/wordpress-mdtf-meta-data-and-taxonomies-filter-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29907
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Active Websight SEO Backlink Monitor allows Reflected XSS.This issue affects SEO Backlink Monitor: from n/a through 1.5.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/seo-backlink-monitor/wordpress-seo-backlink-monitor-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seo-backlink-monitor/wordpress-seo-backlink-monitor-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29908
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kienso Co-marquage service-public.Fr allows Stored XSS.This issue affects Co-marquage service-public.Fr: from n/a through 0.5.71.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/co-marquage-service-public/wordpress-co-marquage-service-public-fr-plugin-0-5-71-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/co-marquage-service-public/wordpress-co-marquage-service-public-fr-plugin-0-5-71-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29909
Published: 2024-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille Verrier Travelers' Map allows Stored XSS.This issue affects Travelers' Map: from n/a through 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/travelers-map/wordpress-travelers-map-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/travelers-map/wordpress-travelers-map-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve