deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-21813
Published: 2024-05-16
Description: Exposure of resource to wrong sphere in some Intel(R) DTT software installers may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.9 (HIGH)
CWE: CWE-668, CWE-269
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00984.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00984.html
CVE: CVE-2024-21814
Published: 2024-05-16
Description: Uncontrolled search path for some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01032.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01032.html
CVE: CVE-2024-21818
Published: 2024-05-16
Description: Uncontrolled search path in some Intel(R) PCM software before version 202311 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01035.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01035.html
CVE: CVE-2024-21823
Published: 2024-05-16
Description: Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access
CVSS Score: 7.5 (HIGH)
CWE: CWE-1264, CWE-400
References: http://www.openwall.com/lists/oss-security/2024/05/15/1; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/
CVE: CVE-2024-21828
Published: 2024-05-16
Description: Improper access control in some Intel(R) Ethernet Controller Administrative Tools software before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01056.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01056.html
CVE: CVE-2024-21831
Published: 2024-05-16
Description: Uncontrolled search path in some Intel(R) Processor Diagnostic Tool software before version 4.1.9.41 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01069.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01069.html
CVE: CVE-2024-21835
Published: 2024-05-16
Description: Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-277, CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01066.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01066.html
CVE: CVE-2024-21837
Published: 2024-05-16
Description: Uncontrolled search path in some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01055.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01055.html
CVE: CVE-2024-21841
Published: 2024-05-16
Description: Uncontrolled search path for some Intel(R) Distribution for GDB software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01042.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01042.html
CVE: CVE-2024-21843
Published: 2024-05-16
Description: Uncontrolled search path for some Intel(R) Computing Improvement Program software before version 2.4.0.10654 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01059.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01059.html
CVE: CVE-2024-21861
Published: 2024-05-16
Description: Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01067.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01067.html
CVE: CVE-2024-21862
Published: 2024-05-16
Description: Uncontrolled search path in some Intel(R) Quartus(R) Prime Standard Edition Design software before version 23.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01055.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01055.html
CVE: CVE-2024-21864
Published: 2024-05-16
Description: Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-86, CWE-707
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01053.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01053.html
CVE: CVE-2024-22015
Published: 2024-05-16
Description: Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to potentially denial of service via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00996.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00996.html
CVE: CVE-2024-22095
Published: 2024-05-16
Description: Improper input validation in PlatformVariableInitDxe driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html
CVE: CVE-2024-22379
Published: 2024-05-16
Description: Uncontrolled search path in some Intel(R) Inspector software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01043.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01043.html
CVE: CVE-2024-22382
Published: 2024-05-16
Description: Improper input validation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html
CVE: CVE-2024-22384
Published: 2024-05-16
Description: Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2022.0.0 published Nov 2023 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 2.8 (LOW)
CWE: CWE-125
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00983.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00983.html
CVE: CVE-2024-22390
Published: 2024-05-16
Description: Improper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01050.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01050.html
CVE: CVE-2024-22476
Published: 2024-05-16
Description: Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01109.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01109.html
CVE: CVE-2024-23487
Published: 2024-05-16
Description: Improper input validation in UserAuthenticationSmm driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html
CVE: CVE-2024-23980
Published: 2024-05-16
Description: Improper buffer restrictions in PlatformPfrDxe driver in UEFI firmware for some Intel(R) Server D50FCP Family products may allow a privileged user to enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html
CVE: CVE-2024-24981
Published: 2024-05-16
Description: Improper input validation in PfrSmiUpdateFw driver in UEFI firmware for some Intel(R) Server M50FCP Family products may allow a privileged user to enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html
CVE: CVE-2024-2619
Published: 2024-05-16
Description: The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary HTML in pages that will be shown whenever a user accesses an injected page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862, CWE-79
References: https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.25/admin/class-hfe-admin.php#L220; https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.25/admin/class-hfe-admin.php#L74; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3070659%40header-footer-elementor%2Ftrunk&old=3053177%40header-footer-elementor%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-3609
Published: 2024-05-16
Description: The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the reviewx_remove_guest_image function in all versions up to, and including, 1.6.27. This makes it possible for authenticated attackers, with subscriber access and above, to delete attachments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3086273%40reviewx%2Ftrunk&old=3054184%40reviewx%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f8152adf-1ca9-4a19-b539-39e257ab94c8?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3086273%40reviewx%2Ftrunk&old=3054184%40reviewx%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-4204
Published: 2024-05-16
Description: The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to missing or incorrect nonce validation on the plugin's AJAX actions.. This makes it possible for unauthenticated attackers to create and duplicate posts, retrieve post content, and modify post taxonomy among other things via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085134%40ithemeland-bulk-posts-editing-lite%2Ftrunk&old=2946926%40ithemeland-bulk-posts-editing-lite%2Ftrunk&sfp_email=&sfph_mail=#file51; https://www.wordfence.com/threat-intel/vulnerabilities/id/34b39462-32c5-4f7d-b54f-d95f40b6ed92?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085134%40ithemeland-bulk-posts-editing-lite%2Ftrunk&old=2946926%40ithemeland-bulk-posts-editing-lite%2Ftrunk&sfp_email=&sfph_mail=#file51
CVE: CVE-2023-26862
Published: 2024-05-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-3134
Published: 2024-05-16
Description: The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title_html_tag attribute in all versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35702 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3087193%40master-addons%2Ftrunk&old=3078134%40master-addons%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6106c972-5475-4c19-8630-3a01edc616ad?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3087193%40master-addons%2Ftrunk&old=3078134%40master-addons%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-30060
Published: 2024-05-16
Description: Azure Monitor Agent Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30060; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30060
CVE: CVE-2024-3551
Published: 2024-05-17
Description: The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398; https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f8df3a-f247-4365-a9f6-6124065b4883?source=cve; https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398
CVE: CVE-2024-2697
Published: 2024-05-17
Description: The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c430b30d-61db-45f5-8499-91b491503b9c/; https://wpscan.com/vulnerability/c430b30d-61db-45f5-8499-91b491503b9c/; https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/socialdriver-framework/swift-framework-202400-authenticated-contributor-stored-cross-site-scripting-via-shortcode
CVE: CVE-2024-2744
Published: 2024-05-17
Description: The NextGEN Gallery  WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a5579c15-50ba-4618-95e4-04b2033d721f/; https://wpscan.com/vulnerability/a5579c15-50ba-4618-95e4-04b2033d721f/
CVE: CVE-2024-32800
Published: 2024-05-17
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Felix Moira Popup More Popups allows Stored XSS.This issue affects Popup More Popups: from n/a through 2.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/popup-more/wordpress-popup-popup-more-popups-plugin-2-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/popup-more/wordpress-popup-popup-more-popups-plugin-2-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34567
Published: 2024-05-17
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-notify-lite/wordpress-easy-notify-lite-plugin-1-1-29-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-notify-lite/wordpress-easy-notify-lite-plugin-1-1-29-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34575
Published: 2024-05-17
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/dethemekit-for-elementor/wordpress-dethemekit-for-elementor-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dethemekit-for-elementor/wordpress-dethemekit-for-elementor-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34752
Published: 2024-05-17
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Reflected XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/page-builder-add/wordpress-landing-page-builder-1-5-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/page-builder-add/wordpress-landing-page-builder-1-5-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34757
Published: 2024-05-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visualmodo Borderless borderless allows DOM-Based XSS.This issue affects Borderless: from n/a through <= 1.7.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/borderless/vulnerability/wordpress-borderless-widgets-elements-templates-and-toolkit-for-elementor-gutenberg-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/borderless/wordpress-borderless-widgets-elements-templates-and-toolkit-for-elementor-gutenberg-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-3231
Published: 2024-05-17
Description: The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/81dbb5c0-ccdd-4af1-b2f2-71cb1b37fe93/; https://wpscan.com/vulnerability/81dbb5c0-ccdd-4af1-b2f2-71cb1b37fe93/
CVE: CVE-2024-3580
Published: 2024-05-17
Description: The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/31f401c4-735a-4efb-b81f-ab98c00c526b/; https://wpscan.com/vulnerability/31f401c4-735a-4efb-b81f-ab98c00c526b/
CVE: CVE-2022-44581
Published: 2024-05-17
Description: Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-922
References: https://patchstack.com/database/vulnerability/defender-security/wordpress-defender-security-plugin-3-3-2-broken-authentication-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/defender-security/wordpress-defender-security-plugin-3-3-2-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2022-45070
Published: 2024-05-17
Description: Missing Authorization vulnerability in FmeAddons Conditional Checkout Fields for WooCommerce.This issue affects Conditional Checkout Fields for WooCommerce: from n/a through 1.2.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/conditional-checkout-fields-for-woocommerce/wordpress-conditional-checkout-fields-for-woocommerce-plugin-1-2-1-broken-authentication-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/conditional-checkout-fields-for-woocommerce/wordpress-conditional-checkout-fields-for-woocommerce-plugin-1-2-1-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2022-45368
Published: 2024-05-17
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Lenderd 1003 Mortgage Application allows Relative Path Traversal.This issue affects 1003 Mortgage Application: from n/a through 1.75.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/1003-mortgage-application/wordpress-1003-mortgage-application-plugin-1-73-local-file-inclusion?_s_id=cve; https://patchstack.com/database/vulnerability/1003-mortgage-application/wordpress-1003-mortgage-application-plugin-1-73-local-file-inclusion?_s_id=cve