deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-53522
Published: 2025-01-07
Description: Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: http://bangkok.com; http://hosxp.com; http://hosxp.net
CVE: CVE-2024-54819
Published: 2025-01-07
Description: I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/mkucej/i-librarian-free/commit/ed36f6f258392fa2ec72f9820661ded75d91accc; https://github.com/partywavesec/CVE-2024-55557; https://www.partywave.site/show/research/cve-2024-54819-i-librarian-server-side-request-forgery
CVE: CVE-2024-55218
Published: 2025-01-07
Description: IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://resources.s4e.io/blog/icewarp-server-10-2-1-reflected-xss-vulnerability-cve-2024-55218/; https://www.icewarp.com/
CVE: CVE-2025-0218
Published: 2025-01-07
Description: When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when generating the directory name, leading to the possibility for a local attacker to pre-create the directory and thus prevent pgAgent from executing jobs, disrupting scheduled tasks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-340, CWE-330
References: https://github.com/pgadmin-org/pgagent/commit/1ecd193a2be3a3dc9e98f369495e1a792e6d508c; https://lists.debian.org/debian-lts-announce/2025/10/msg00018.html
CVE: CVE-2024-10541
Published: 2025-01-07
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. This is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-22132
Published: 2025-01-07
Description: WeGIA is a web manager for charitable institutions. A Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. By uploading a file containing malicious JavaScript code, an attacker can execute arbitrary scripts in the context of a victim's browser. This can lead to information theft, session hijacking, and other forms of client-side exploitation. This vulnerability is fixed in 3.2.7.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79, CWE-434
References: https://github.com/nilsonLazarin/WeGIA/commit/330f641db43cfb0c8ea8bb6025cc0732de4d4d6b; https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-h8hr-jhcx-fcv9
CVE: CVE-2025-22133
Published: 2025-01-07
Description: WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar, which can then be executed by the server. This vulnerability is fixed in 3.2.8.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94, CWE-434
References: https://github.com/nilsonLazarin/WeGIA/commit/a08f04de96d3caec85496d7a89a5b82d1960d9dd; https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-mjgr-2jxv-v8qf; https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-mjgr-2jxv-v8qf
CVE: CVE-2018-4301
Published: 2025-01-08
Description: This issue is fixed in SCSSU-201801. A potential stack based buffer overflow existed in GemaltoKeyHandle.cpp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://smartcardservices.github.io/security/
CVE: CVE-2024-40679
Published: 2025-01-08
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific conditions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://www.ibm.com/support/pages/node/7175957
CVE: CVE-2024-50603
Published: 2025-01-08
Description: An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://docs.aviatrix.com/documentation/latest/network-security/index.html; https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers; https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/
CVE: CVE-2024-55355
Published: 2025-01-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-55356
Published: 2025-01-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-56434
Published: 2025-01-08
Description: UAF vulnerability in the device node access module
Impact: Successful exploitation of this vulnerability may cause service exceptions of the device.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56435
Published: 2025-01-08
Description: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1021
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56436
Published: 2025-01-08
Description: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1021
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2023-52953
Published: 2025-01-08
Description: Path traversal vulnerability in the Medialibrary module
Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2023-52954
Published: 2025-01-08
Description: Vulnerability of improper permission control in the Gallery module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-701, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2023-52955
Published: 2025-01-08
Description: Vulnerability of improper authentication in the ANS system service module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264, CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-47239
Published: 2025-01-08
Description: Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource consumption vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://www.dell.com/support/kbdoc/en-us/000269590/dsa-2024-480-security-update-for-dell-powerscale-onefs-security-vulnerability
CVE: CVE-2024-47934
Published: 2025-01-08
Description: Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to crash management service. The Denial of Service situation can be resolved by restarting the management service.
This issue affects Portable Inspector: through 1.0.0; Portable Inspector Pro Edition: through 1.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://www.txone.com/psirt/advisories/cve-2024-47934/
CVE: CVE-2024-54120
Published: 2025-01-08
Description: Race condition vulnerability in the distributed notification module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56437
Published: 2025-01-08
Description: Vulnerability of input parameters not being verified in the widget framework module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56438
Published: 2025-01-08
Description: Vulnerability of improper memory address protection in the HUKS module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56439
Published: 2025-01-08
Description: Access control vulnerability in the identity authentication module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56440
Published: 2025-01-08
Description: Permission control vulnerability in the Connectivity module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56441
Published: 2025-01-08
Description: Race condition vulnerability in the Bastet module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56442
Published: 2025-01-08
Description: Vulnerability of native APIs not being implemented in the NFC service module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-227
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56443
Published: 2025-01-08
Description: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56444
Published: 2025-01-08
Description: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56445
Published: 2025-01-08
Description: Instruction authentication bypass vulnerability in the Findnetwork module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56446
Published: 2025-01-08
Description: Vulnerability of variables not being initialized in the notification module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-457, CWE-908
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56447
Published: 2025-01-08
Description: Vulnerability of improper permission control in the window management module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-11816
Published: 2025-01-08
Description: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpext_handle_snippet_update' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server providing an admin has created at least one code snippet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wpextended/trunk/includes/modules/core_extensions/wpext_snippets/wpext_snippets.php#L705; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213331%40wpextended&new=3213331%40wpextended&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ce53e5-8666-4227-83d3-58f35db0ce68?source=cve
CVE: CVE-2024-11916
Published: 2025-01-08
Description: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with
CVSS Score: 7.4 (HIGH)
CWE: CWE-862, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213331%40wpextended&new=3213331%40wpextended&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/747d7649-bdf5-46d0-a496-59cb7eac77ac?source=cve
CVE: CVE-2024-12112
Published: 2025-01-08
Description: The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'add_form_Emsfb' AJAX action in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping and missing authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3215764/easy-form-builder/trunk/includes/admin/class-Emsfb-create.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a71e72dd-574c-41fc-a000-7a4cf658f3d7?source=cve
CVE: CVE-2024-12521
Published: 2025-01-08
Description: The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti-embed-ga' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218204%40slotti-ajanvaraus&new=3218204%40slotti-ajanvaraus&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1d95ec4b-0cbc-49c6-821e-7050d8045159?source=cve
CVE: CVE-2024-12713
Published: 2025-01-08
Description: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3215338/sureforms/tags/1.2.3/inc/export.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/412d5fa7-08fc-402a-bcac-b2dff87de861?source=cve
CVE: CVE-2024-54121
Published: 2025-01-08
Description: Startup control vulnerability in the ability module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56448
Published: 2025-01-08
Description: Vulnerability of improper access control in the home screen widget module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-94
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56449
Published: 2025-01-08
Description: Privilege escalation vulnerability in the Account module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-840
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56450
Published: 2025-01-08
Description: Buffer overflow vulnerability in the component driver module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56451
Published: 2025-01-08
Description: Integer overflow vulnerability during glTF model loading in the 3D engine module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-680, CWE-190
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56452
Published: 2025-01-08
Description: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56453
Published: 2025-01-08
Description: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56454
Published: 2025-01-08
Description: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56455
Published: 2025-01-08
Description: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2024-56456
Published: 2025-01-08
Description: Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE: CVE-2025-21603
Published: 2025-01-08
Description: Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an attacker logs in to the affected product and manipulates the device settings, an arbitrary script may be executed on the logged-in user's web browser when accessing a crafted URL.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN57428125/; https://www.planex.co.jp/support/download/mzk-dp300n/
CVE: CVE-2024-11270
Published: 2025-01-08
Description: The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import-imgs' function and missing file type validation in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files that can lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3216237/wp-webinarsystem/trunk/includes/class-webinarsysteem-ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f1c2cb3f-2f9e-40c5-9e5f-5b85a53e5868?source=cve
CVE: CVE-2024-11271
Published: 2025-01-08
Description: The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on several functions in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify webinars.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3216237/wp-webinarsystem/trunk/includes/class-webinarsysteem-ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/88508dbd-b7a0-441d-918b-f4cb7a7cd000?source=cve
CVE: CVE-2024-12030
Published: 2025-01-08
Description: The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-meta-data-filter-and-taxonomy-filter/trunk/classes/shortcodes.php?rev=3204774#L874; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3210333%40wp-meta-data-filter-and-taxonomy-filter&new=3210333%40wp-meta-data-filter-and-taxonomy-filter&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ead824-2722-4b09-8387-e064dee371c1?source=cve
CVE: CVE-2024-12205
Published: 2025-01-08
Description: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215859%40themesflat-addons-for-elementor&new=3215859%40themesflat-addons-for-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/45c6c041-91b0-4abe-ba72-ec1251651fdb?source=cve
CVE: CVE-2024-54731
Published: 2025-01-08
Description: cpdf through 2.8 allows stack consumption via a crafted PDF document.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-674
References: https://github.com/johnwhitington/cpdf-source/issues/366
CVE: CVE-2024-10151
Published: 2025-01-08
Description: The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/487facf7-8880-48b3-b1b2-0d09823d3c46/