deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-37036
Published: 2024-06-12
Description: CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass
when sending a malformed POST request and particular configuration parameters are set.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE: CVE-2024-37037
Published: 2024-06-12
Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path
Traversal’) vulnerability exists that could allow an authenticated user with access to the device’s
web interface to corrupt files and impact device functionality when sending a crafted HTTP
request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE: CVE-2024-37038
Published: 2024-06-12
Description: CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated
user with access to the device’s web interface to perform unauthorized file and firmware
uploads when crafting custom web requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276, CWE-276
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE: CVE-2024-37039
Published: 2024-06-12
Description: CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the
device when an attacker sends a specially crafted HTTP request.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-252
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE: CVE-2024-37040
Published: 2024-06-12
Description: CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability
exists that could allow a user with access to the device’s web interface to cause a fault on the
device when sending a malformed HTTP request.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-120
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE: CVE-2024-37878
Published: 2024-06-12
Description: Cross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary code via the /TWCMS-gh-pages/twcms/runtime/twcms_view/default,index.htm.php" PHP directly echoes parameters input from external sources
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/sylvieverykawaii/243f1756151bee027725c6961d8c1ba9; https://gist.github.com/sylvieverykawaii/243f1756151bee027725c6961d8c1ba9
CVE: CVE-2024-5557
Published: 2024-06-12
Description: CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause
exposure of SNMP credentials when an attacker has access to the controller logs.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-532
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-04.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-04.pdf
CVE: CVE-2024-5558
Published: 2024-06-12
Description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could
cause escalation of privileges when an attacker abuses a limited admin account.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-367
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-04.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-04.pdf
CVE: CVE-2024-5560
Published: 2024-06-12
Description: CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the
device’s web interface when an attacker sends a specially crafted HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE: CVE-2024-5898
Published: 2024-06-12
Description: A vulnerability was found in itsourcecode Payroll Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file print_payroll.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-268142 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/guiyxli/cve/issues/1; https://vuldb.com/?ctiid.268142; https://vuldb.com/?id.268142
CVE: CVE-2024-5905
Published: 2024-06-12
Description: A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some functionality of the agent. However, they are not able to disrupt Cortex XDR agent protection mechanisms using this vulnerability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-346
References: https://security.paloaltonetworks.com/CVE-2024-5905; https://security.paloaltonetworks.com/CVE-2024-5905
CVE: CVE-2024-5906
Published: 2024-06-12
Description: A cross-site scripting (XSS) vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to perform actions in the context of another user's browser when accessed by that other user.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2024-5906; https://security.paloaltonetworks.com/CVE-2024-5906
CVE: CVE-2024-5907
Published: 2024-06-12
Description: A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated privileges. However, execution does require the local user to successfully exploit a race condition, which makes this vulnerability difficult to exploit.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://security.paloaltonetworks.com/CVE-2024-5907; https://security.paloaltonetworks.com/CVE-2024-5907
CVE: CVE-2024-5908
Published: 2024-06-12
Description: A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://security.paloaltonetworks.com/CVE-2024-5908; https://security.paloaltonetworks.com/CVE-2024-5908
CVE: CVE-2024-5909
Published: 2024-06-12
Description: A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://security.paloaltonetworks.com/CVE-2024-5909; https://security.paloaltonetworks.com/CVE-2024-5909
CVE: CVE-2024-0865
Published: 2024-06-12
Description: CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege
escalation when logged in as a non-administrative user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-03.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-03.pdf
CVE: CVE-2024-24051
Published: 2024-06-12
Description: Improper input validation of printing files in Monoprice Select Mini V2 V37.115.32 allows attackers to instruct the device's movable parts to destinations that exceed the devices' maximum coordinates via the printing of a malicious .gcode file.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/tkruppert/Reported_Vulnerabilities/blob/main/CVE-2024-24051.md; https://github.com/tkruppert/Reported_Vulnerabilities/blob/main/CVE-2024-24051.md
CVE: CVE-2024-28762
Published: 2024-06-12
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions.  IBM X-Force ID:  285246.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/285246; https://www.ibm.com/support/pages/node/7156847; https://exchange.xforce.ibmcloud.com/vulnerabilities/285246
CVE: CVE-2024-2747
Published: 2024-06-12
Description: CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could
cause privilege escalation when a valid user replaces a trusted file name on the system and
reboots the machine.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-100-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-100-01.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-100-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-100-01.pdf
CVE: CVE-2024-37629
Published: 2024-06-12
Description: SummerNote v0.9.1 is vulnerable to Cross Site Scripting (XSS) via the Code View Function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/summernote/summernote/issues/4642; https://github.com/summernote/summernote/releases/tag/v0.9.1; https://grumpz.net/cve-2024-37629-simple-xss-payload-exploits-0day-vulnerability-in-10000-web-apps
CVE: CVE-2024-5559
Published: 2024-06-12
Description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could
cause denial of service, device reboot, or an attacker gaining full control of the relay when a
specially crafted reset token is entered into the front panel of the device.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-02.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-02.pdf
CVE: CVE-2023-29267
Published: 2024-06-12
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user.  IBM X-Force ID:  287612.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287612; https://www.ibm.com/support/pages/node/7156851; https://exchange.xforce.ibmcloud.com/vulnerabilities/287612
CVE: CVE-2024-31881
Published: 2024-06-12
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain columnar tables by an authenticated user.  IBM X-Force ID:  287613.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287613; https://www.ibm.com/support/pages/node/7156852; https://exchange.xforce.ibmcloud.com/vulnerabilities/287613
CVE: CVE-2024-5798
Published: 2024-06-12
Description: Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.

This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9
CVSS Score: 2.6 (LOW)
CWE: CWE-287
References: https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770; https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770
CVE: CVE-2023-49559
Published: 2024-06-12
Description: An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.
CVSS Score: 3.7 (LOW)
CWE: CWE-770
References: https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1; https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1
CVE: CVE-2024-36523
Published: 2024-06-12
Description: An access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in the application after deleting their own or administrator accounts. This is provided that the users do not log out of their deleted accounts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://github.com/648540858/wvp-GB28181-pro/issues/1456; https://github.com/648540858/wvp-GB28181-pro/issues/1456
CVE: CVE-2024-37665
Published: 2024-06-12
Description: An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/648540858/wvp-GB28181-pro; https://github.com/guipi01/WVP-GB28181; https://github.com/648540858/wvp-GB28181-pro
CVE: CVE-2024-3467
Published: 2024-06-12
Description: There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03; https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03
CVE: CVE-2024-3468
Published: 2024-06-12
Description: There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.
CWE: CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-02
CVE: CVE-2024-1495
Published: 2024-06-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. It was possible for an attacker to cause a denial of service using maliciously crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#redos-in-gomod-dependency-linker; https://gitlab.com/gitlab-org/gitlab/-/issues/441807; https://hackerone.com/reports/2359528
CVE: CVE-2024-1736
Published: 2024-06-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#redos-in-ci-interpolation-fix-bypass; https://gitlab.com/gitlab-org/gitlab/-/issues/442695; https://hackerone.com/reports/2358689
CVE: CVE-2024-1963
Published: 2024-06-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's Asana integration allowed an attacker to potentially cause a regular expression denial of service by sending specially crafted requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#redos-in-asana-integration-issue-mapping-when-webhook-is-called; https://gitlab.com/gitlab-org/gitlab/-/issues/443577; https://hackerone.com/reports/2376482
CVE: CVE-2024-4201
Published: 2024-06-12
Description: A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#xss-and-content-injection-when-viewing-raw-xhtml-files-on-ios-devices; https://gitlab.com/gitlab-org/gitlab/-/issues/458229; https://hackerone.com/reports/2473886
CVE: CVE-2024-3922
Published: 2024-06-13
Description: The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://dokan.co/docs/wordpress/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d9de41de-f2f7-4b16-8ec9-d30bbd3d8786?source=cve; https://dokan.co/docs/wordpress/changelog/
CVE: CVE-2023-52890
Published: 2024-06-13
Description: NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
CVSS Score: 4.5 (MEDIUM)
References: https://github.com/tuxera/ntfs-3g/issues/84; https://github.com/tuxera/ntfs-3g/issues/84
CVE: CVE-2024-38293
Published: 2024-06-13
Description: ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://adullact.net/frs/download.php/file/8930/CHANGELOG.md; https://alcasar.net/download; https://adullact.net/frs/download.php/file/8930/CHANGELOG.md
CVE: CVE-2024-38294
Published: 2024-06-13
Description: ALCASAR before 3.6.1 allows email_registration_back.php remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://adullact.net/frs/download.php/file/8930/CHANGELOG.md; https://alcasar.net/download; https://adullact.net/frs/download.php/file/8930/CHANGELOG.md
CVE: CVE-2024-38295
Published: 2024-06-13
Description: ALCASAR before 3.6.1 allows still_connected.php remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://adullact.net/frs/download.php/file/8930/CHANGELOG.md; https://alcasar.net/download; https://adullact.net/frs/download.php/file/8930/CHANGELOG.md
CVE: CVE-2024-2098
Published: 2024-06-13
Description: The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-289, CWE-863
References: https://plugins.trac.wordpress.org/changeset/3072712/download-manager; https://www.wordfence.com/threat-intel/vulnerabilities/id/1301c8af-d81a-40f1-96fa-e8252309d8a4?source=cve; https://plugins.trac.wordpress.org/changeset/3072712/download-manager
CVE: CVE-2024-2762
Published: 2024-06-13
Description: The FooGallery  WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its Gallery settings before outputting them back in the page, which could allow users with a role as low as Author to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/92e0f5ca-0184-4e9c-b01a-7656e05dce69/; https://wpscan.com/vulnerability/92e0f5ca-0184-4e9c-b01a-7656e05dce69/
CVE: CVE-2024-3032
Published: 2024-06-13
Description: Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://wpscan.com/vulnerability/d130a60c-c36b-4994-9b0e-e52cd7f99387/; https://wpscan.com/vulnerability/d130a60c-c36b-4994-9b0e-e52cd7f99387/
CVE: CVE-2024-3552
Published: 2024-06-13
Description: The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/34b03ee4-de81-4fec-9f3d-e1bd5b94d136/; https://wpscan.com/vulnerability/34b03ee4-de81-4fec-9f3d-e1bd5b94d136/
CVE: CVE-2024-4145
Published: 2024-06-13
Description: The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks (such as within a multi-site network).
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/7d5b8764-c82d-4969-a707-f38b63bcadca/; https://wpscan.com/vulnerability/7d5b8764-c82d-4969-a707-f38b63bcadca/
CVE: CVE-2024-4149
Published: 2024-06-13
Description: The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button  WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0256ec2a-f1a9-4110-9978-ee88f9e24237/; https://wpscan.com/vulnerability/0256ec2a-f1a9-4110-9978-ee88f9e24237/
CVE: CVE-2024-5661
Published: 2024-06-13
Description: An issue has been identified in both XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR which may allow a malicious administrator of a guest VM to cause the host to become slow and/or unresponsive.
CVSS Score: 6.0 (MEDIUM)
References: https://support.citrix.com/article/CTX677100/xenserver-and-citrix-hypervisor-security-update-for-cve20245661; https://support.citrix.com/article/CTX677100/xenserver-and-citrix-hypervisor-security-update-for-cve20245661