deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-11315
Published: 2024-11-18
Description: The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23, CWE-434, CWE-22, CWE-434
References: https://www.twcert.org.tw/en/cp-139-8255-0bb1a-2.html; https://www.twcert.org.tw/tw/cp-132-8254-8daa2-1.html
CVE: CVE-2024-22067
Published: 2024-11-18
Description: ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]692935173
CVE: CVE-2024-49574
Published: 2024-11-18
Description: Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-49574.html
CVE: CVE-2024-41151
Published: 2024-11-18
Description: Deserialization of Untrusted Data vulnerability in Apache HertzBeat.

This vulnerability can only be exploited by authorized attackers.


This issue affects Apache HertzBeat: before 1.6.1.

Users are recommended to upgrade to version 1.6.1, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://lists.apache.org/thread/oor9nw6nh2ojnfw8d8oxrv40cbtk5mwj; https://lists.apache.org/thread/p33tg0vo5nh6kscth4262ktsqo3h5lqo; http://www.openwall.com/lists/oss-security/2024/11/16/6
CVE: CVE-2024-41967
Published: 2024-11-18
Description: A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2024-047
CVE: CVE-2024-41968
Published: 2024-11-18
Description: A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2024-047
CVE: CVE-2024-41969
Published: 2024-11-18
Description: A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2024-047
CVE: CVE-2024-45505
Published: 2024-11-18
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating).

This vulnerability can only be exploited by authorized attackers.
This issue affects Apache HertzBeat (incubating): before 1.6.1.

Users are recommended to upgrade to version 1.6.1, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://lists.apache.org/thread/gvbc68krhqhht7mkkkx7k13k6k6fdhy0; https://lists.apache.org/thread/h8k14o1bfyod66p113pkgnt1s52p6p19; http://www.openwall.com/lists/oss-security/2024/11/16/4
CVE: CVE-2024-45791
Published: 2024-11-18
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat.

This issue affects Apache HertzBeat: before 1.6.1.

Users are recommended to upgrade to version 1.6.1, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://lists.apache.org/thread/jmbsfjsvrfnvosh1ftrm3ry4j3sb7doz; https://lists.apache.org/thread/lvsczrp8kdynppmzyxtkh4ord4gpw1ph; http://www.openwall.com/lists/oss-security/2024/11/16/5
CVE: CVE-2024-47208
Published: 2024-11-18
Description: Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-918
References: https://issues.apache.org/jira/browse/OFBIZ-13158; https://lists.apache.org/thread/022r19skfofhv3lzql33vowlrvqndh11; https://ofbiz.apache.org/download.html
CVE: CVE-2024-48962
Published: 2024-11-18
Description: Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-352, CWE-1336, CWE-94, CWE-352
References: https://issues.apache.org/jira/browse/OFBIZ-13162; https://lists.apache.org/thread/6sddh4pts90cp8ktshqb4xykdp6lb6q6; https://ofbiz.apache.org/download.html
CVE: CVE-2023-39176
Published: 2024-11-18
Description: A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/security/cve/CVE-2023-39176; https://bugzilla.redhat.com/show_bug.cgi?id=2326503; https://www.zerodayinitiative.com/advisories/ZDI-24-586/
CVE: CVE-2023-39179
Published: 2024-11-18
Description: A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/security/cve/CVE-2023-39179; https://bugzilla.redhat.com/show_bug.cgi?id=2326529; https://www.zerodayinitiative.com/advisories/ZDI-24-586/
CVE: CVE-2023-39180
Published: 2024-11-18
Description: A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this to create a denial-of-service condition on affected installations of Linux. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-400, CWE-125
References: https://access.redhat.com/security/cve/CVE-2023-39180; https://bugzilla.redhat.com/show_bug.cgi?id=2326531; https://www.zerodayinitiative.com/advisories/ZDI-24-589/
CVE: CVE-2024-41970
Published: 2024-11-18
Description: A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-732
References: https://cert.vde.com/en/advisories/VDE-2024-047
CVE: CVE-2024-41971
Published: 2024-11-18
Description: A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://cert.vde.com/en/advisories/VDE-2024-047
CVE: CVE-2024-41972
Published: 2024-11-18
Description: A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-35
References: https://cert.vde.com/en/advisories/VDE-2024-047
CVE: CVE-2024-41973
Published: 2024-11-18
Description: A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://cert.vde.com/en/advisories/VDE-2024-047
CVE: CVE-2024-41974
Published: 2024-11-18
Description: A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS limited to BACNet communication.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://cert.vde.com/en/advisories/VDE-2024-047
CVE: CVE-2024-42383
Published: 2024-11-18
Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for the hostname field.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-823
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42383
CVE: CVE-2024-42384
Published: 2024-11-18
Description: Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://www.nozominetworks.com/blog
CVE: CVE-2024-42385
Published: 2024-11-18
Description: Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-140
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42385
CVE: CVE-2024-42386
Published: 2024-11-18
Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.
CVSS Score: 8.2 (HIGH)
CWE: CWE-823
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42386
CVE: CVE-2024-42387
Published: 2024-11-18
Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-823
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42387
CVE: CVE-2024-42388
Published: 2024-11-18
Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-823
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42388
CVE: CVE-2024-42389
Published: 2024-11-18
Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-823
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42389
CVE: CVE-2024-42390
Published: 2024-11-18
Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-823
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42390
CVE: CVE-2024-42391
Published: 2024-11-18
Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-823
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42391
CVE: CVE-2024-42392
Published: 2024-11-18
Description: Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-140
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42392
CVE: CVE-2024-11023
Published: 2024-11-18
Description: Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization.  If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024; https://github.com/firebase/firebase-js-sdk/pull/8056
CVE: CVE-2024-11319
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).This issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/django-cms/django-cms/commit/241d1cbe47a68f5d271ce4d27ad5e32e2c360ec3; https://iltosec.com/blog/post/django-cms-413-stored-xss-vulnerability-exploiting-the-page-title-field/; https://www.django-cms.org/en/blog/2024/11/13/django-cms-security-update/
CVE: CVE-2024-48896
Published: 2024-11-18
Description: A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://bugzilla.redhat.com/show_bug.cgi?id=2318822
CVE: CVE-2024-48897
Published: 2024-11-18
Description: A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=2318821
CVE: CVE-2024-48898
Published: 2024-11-18
Description: A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=2318820
CVE: CVE-2024-48901
Published: 2024-11-18
Description: A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=2318817
CVE: CVE-2024-52316
Published: 2024-11-18
Description: Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-391, CWE-754
References: https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928; http://www.openwall.com/lists/oss-security/2024/11/18/2; https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
CVE: CVE-2024-52317
Published: 2024-11-18
Description: Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests 
could lead to request and/or response mix-up between users.

This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.

Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs; http://www.openwall.com/lists/oss-security/2024/11/18/3; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-3370
Published: 2024-11-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egebilgi Software Website Template allows SQL Injection.This issue affects Website Template: before 29.04.2024.
CVSS Score: 8.6 (HIGH)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1860
CVE: CVE-2024-52318
Published: 2024-11-18
Description: Incorrect object recycling and reuse vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96.

Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-326
References: https://lists.apache.org/thread/co243cw1nlh6p521c5265cm839wkqdp9; http://www.openwall.com/lists/oss-security/2024/11/18/4; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-11303
Published: 2024-11-18
Description: The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601: through 1.2.
CWE: CWE-22
References: https://cyberdanube.com/en/en-st-polten-uas-path-traversal-in-korenix-jetport/; http://seclists.org/fulldisclosure/2024/Nov/8
CVE: CVE-2024-11318
Published: 2024-11-18
Description: An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifier on the "/cgi-bin/ocap/" endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/idor-vulnerability-absysnet
CVE: CVE-2024-8781
Published: 2024-11-18
Description: Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allows Privilege Escalation, -Privilege Abuse.This issue affects Application Security Platform (ASP): v1.4.25.188.
CWE: CWE-250, CWE-424
References: https://www.usom.gov.tr/bildirim/tr-24-1861
CVE: CVE-2024-9526
Published: 2024-11-18
Description: There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/kubeflow/pipelines/pull/10315
CVE: CVE-2024-11304
Published: 2024-11-18
Description: Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS). This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.
CWE: CWE-79
References: https://cyberdanube.com/en/en-st-polten-uas-stored-cross-site-scripting-in-seh-utnserver-pro/index.html; http://seclists.org/fulldisclosure/2024/Nov/7
CVE: CVE-2024-28058
Published: 2024-11-18
Description: In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an active session, an internal threat actor could impersonate the revoked user and gain unauthorized access to sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://community.netwitness.com/t5/netwitness-platform-online/tkb-p/netwitness-online-documentation; https://community.netwitness.com/t5/netwitness-platform-product/nw-2024-06-netwitness-platform-broken-access-control/ta-p/719454
CVE: CVE-2024-37155
Published: 2024-11-18
Description: OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query. GraphQL Queries in OpenCTI can be validated using the `secureIntrospectionPlugin`. The regex check in the plkugin can be bypassed by removing the carriage return and line feed characters (`\r\n`).  Running a curl command against a local instance of OpenCTI will result in a limited error message. By running the same Introspection query without the `\r\n` characters, the unauthenticated user is able to successfully run a full Introspection query. Bypassing this restriction allows the attacker to gather a wealth of information about the GraphQL endpoint functionality that can be used to perform actions and/or read data without authorization.  These queries can also be weaponized to conduct a Denial of Service (DoS) attack if sent repeatedly. Users should upgrade to version 6.1.9 to receive a patch for the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/OpenCTI-Platform/opencti/blob/6343b82b0b0a5d3ded3b30d08ce282328a556268/opencti-platform/opencti-graphql/src/graphql/graphql.js#L83-L94; https://github.com/OpenCTI-Platform/opencti/commit/f87d96918c63b0c3d3ebfbea6c789d48e2f56ad5; https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-4mvw-j8r9-xcgc
CVE: CVE-2024-52427
Published: 2024-11-18
Description: Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SSI) Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.3.11.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-82, CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/event-tickets-with-ticket-scanner/vulnerability/wordpress-event-tickets-with-ticket-scanner-plugin-2-3-11-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-52428
Published: 2024-11-18
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Peter Ads Booster by Ads Pro free-wp-booster-by-ads-pro allows PHP Local File Inclusion.This issue affects Ads Booster by Ads Pro: from n/a through <= 1.12.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/free-wp-booster-by-ads-pro/vulnerability/wordpress-ads-booster-by-ads-pro-plugin-1-12-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-52429
Published: 2024-11-18
Description: Unrestricted Upload of File with Dangerous Type vulnerability in AntonHoelstad WP Quick Setup wp-quick-setup allows Upload a Web Shell to a Web Server.This issue affects WP Quick Setup: from n/a through <= 2.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wp-quick-setup/vulnerability/wordpress-wp-quick-setup-plugin-2-0-arbitrary-plugin-and-theme-installation-to-remote-code-execution-vulnerability?_s_id=cve
CVE: CVE-2024-52430
Published: 2024-11-18
Description: Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through <= 0.2.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/lis-video-gallery/vulnerability/wordpress-lis-video-gallery-plugin-0-2-1-php-object-injection-vulnerability?_s_id=cve