deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4550
Published: 2024-01-29
Description: Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.

An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server on which it is hosted. 


This issue affects AppBuilder: from 21.2 before 23.2.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-552, CWE-552
References: https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b; https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b
CVE: CVE-2023-4551
Published: 2024-01-29
Description: Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection.

The AppBuilder's Scheduler functionality that facilitates creation of scheduled tasks is vulnerable to command injection. This allows authenticated users to inject arbitrary operating system commands into the executing process.


This issue affects AppBuilder: from 21.2 before 23.2.


CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b; https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b
CVE: CVE-2023-4552
Published: 2024-01-29
Description: Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.

An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including access to its local file system.


This issue affects AppBuilder: from 21.2 before 23.2.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b; https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b
CVE: CVE-2023-4553
Published: 2024-01-29
Description: Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.


AppBuilder configuration files are viewable by unauthenticated users.


This issue affects AppBuilder: from 21.2 before 23.2.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b; https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b
CVE: CVE-2023-4554
Published: 2024-01-29
Description: Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files.

AppBuilder's XML processor is vulnerable to XML External Entity Processing (XXE), allowing an authenticated user to upload specially crafted XML files to induce server-side request forgery, disclose files local to the server that processes them.


This issue affects AppBuilder: from 21.2 before 23.2.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b; https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b
CVE: CVE-2024-1020
Published: 2024-01-29
Description: A vulnerability classified as problematic was found in Rebuild up to 3.5.5. Affected by this vulnerability is the function getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252289 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.252289; https://vuldb.com/?id.252289; https://www.yuque.com/mailemonyeyongjuan/tha8tr/gdd3hiwz8uo6ylab
CVE: CVE-2024-1021
Published: 2024-01-29
Description: A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252290 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://vuldb.com/?ctiid.252290; https://vuldb.com/?id.252290; https://www.yuque.com/mailemonyeyongjuan/tha8tr/yemvnt5uo53gfem5
CVE: CVE-2024-1022
Published: 2024-01-29
Description: A vulnerability, which was classified as problematic, was found in CodeAstro Simple Student Result Management System 5.6. This affects an unknown part of the file /add_classes.php of the component Add Class Page. The manipulation of the argument Class Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252291.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1lPZ1yL9UlU-uB03xz17q4OR9338X_1am/view?usp=sharing; https://vuldb.com/?ctiid.252291; https://vuldb.com/?id.252291
CVE: CVE-2024-23334
Published: 2024-01-29
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present.  Disabling follow_symlinks and using a reverse proxy are encouraged mitigations.  Version 3.9.2 fixes this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514b; https://github.com/aio-libs/aiohttp/pull/8079; https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f
CVE: CVE-2024-23829
Published: 2024-01-29
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.  Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444
References: https://github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827; https://github.com/aio-libs/aiohttp/pull/8074; https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2
CVE: CVE-2023-37571
Published: 2024-01-30
Description: Softing TH SCOPE through 3.70 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://industrial.softing.com; https://industrial.softing.com/fileadmin/psirt/downloads/2024/syt-2024-1.html; https://industrial.softing.com
CVE: CVE-2023-51813
Published: 2024-01-30
Description: Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute arbitrary code via the staff_list parameter in the index.php component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/xxxxfang/CVE-Apply/blob/main/csrf-1.md; https://github.com/xxxxfang/CVE-Apply/blob/main/csrf-1.md
CVE: CVE-2023-51837
Published: 2024-01-30
Description: Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295, CWE-295
References: https://github.com/Ylianst/MeshCentral/blob/master/mpsserver.js; https://github.com/tianjk99/Cryptographic-Misuses/blob/main/Bug_MeshCentral.md; https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-51837.md
CVE: CVE-2023-51843
Published: 2024-01-30
Description: react-dashboard 1.4.0 is vulnerable to Cross Site Scripting (XSS) as httpOnly is not set.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/flatlogic/react-dashboard; https://github.com/flatlogic/react-dashboard/issues/65; https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-51843.md
CVE: CVE-2023-51982
Published: 2024-01-30
Description: CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.(https://github.com/crate/crate/issues/15231)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://github.com/crate/crate/issues/15231; https://github.com/crate/crate/issues/15231
CVE: CVE-2023-5372
Published: 2024-01-30
Description: The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nas-products-01-30-2024
CVE: CVE-2024-1024
Published: 2024-01-30
Description: A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. This vulnerability affects unknown code of the component New Account Handler. The manipulation of the argument First Name/Last Name with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252292.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.252292; https://vuldb.com/?id.252292; https://vuldb.com/?ctiid.252292
CVE: CVE-2024-1026
Published: 2024-01-30
Description: A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. This issue affects some unknown processing of the file front/admin/config.php. The manipulation of the argument id with the input %22%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-252293 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.252293; https://vuldb.com/?id.252293; https://vuldb.com/?ctiid.252293
CVE: CVE-2024-22682
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-22938
Published: 2024-01-30
Description: Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.class.php component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/n0Sleeper/bosscmsVuln; https://github.com/n0Sleeper/bosscmsVuln/issues/1; https://www.bosscms.net/
CVE: CVE-2024-1027
Published: 2024-01-30
Description: A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Post Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-252300.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://vuldb.com/?ctiid.252300; https://vuldb.com/?id.252300; https://vuldb.com/?ctiid.252300
CVE: CVE-2024-21840
Published: 2024-01-30
Description: Incorrect Default Permissions vulnerability in Hitachi Storage Plug-in for VMware vCenter allows local users to read and write specific files.

This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.0.0 through 04.9.2.


CVSS Score: 7.9 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-108/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-108/index.html
CVE: CVE-2024-1028
Published: 2024-01-30
Description: A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Post Handler. The manipulation of the argument Description with the input <marquee>HACKED</marquee> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252301 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.252301; https://vuldb.com/?id.252301; https://vuldb.com/?ctiid.252301
CVE: CVE-2024-21488
Published: 2024-01-30
Description: Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77, CWE-77
References: https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c; https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7; https://github.com/tomas/network/commit/6ec[PII_REDACTED]ab4666df2f2d0f3399891ed2ad7
CVE: CVE-2023-45923
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-45926
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-45928
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-45930
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-1029
Published: 2024-01-30
Description: A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. Affected by this issue is some unknown functionality of the file /front/admin/tenancyDetail.php. The manipulation of the argument Nom with the input Dreux"><script>alert('XSS')</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252302 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.252302; https://vuldb.com/?id.252302; https://vuldb.com/?ctiid.252302
CVE: CVE-2023-52071
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-22643
Published: 2024-01-30
Description: A Cross-Site Request Forgery (CSRF) vulnerability in SEO Panel version 4.10.0 allows remote attackers to perform unauthorized user password resets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22643; https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22643
CVE: CVE-2024-22646
Published: 2024-01-30
Description: An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allows an attacker to guess which emails exist on the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22646; https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22646
CVE: CVE-2024-22647
Published: 2024-01-30
Description: An user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22647; https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22647
CVE: CVE-2024-22648
Published: 2024-01-30
Description: A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0. This makes it possible for remote attackers to scan ports in the local environment.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22648; https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22648
CVE: CVE-2023-7225
Published: 2024-01-30
Description: The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.abay.sh/cve-2023-7225/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3023266%40mappress-google-maps-for-wordpress%2Ftrunk&old=3022439%40mappress-google-maps-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/fce76126-0cfd-464f-b644-45d4301e958d?source=cve
CVE: CVE-2024-21803
Published: 2024-01-30
Description: Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C.

This issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.


CVSS Score: 3.5 (LOW)
CWE: CWE-416, CWE-416
References: https://bugzilla.openanolis.cn/show_bug.cgi?id=8081; https://bugzilla.openanolis.cn/show_bug.cgi?id=8081
CVE: CVE-2023-36259
Published: 2024-01-30
Description: Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sjelfull/craft-audit/pull/73; https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D; https://github.com/sjelfull/craft-audit/pull/73
CVE: CVE-2023-36260
Published: 2024-01-30
Description: An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28; https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29; https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D
CVE: CVE-2023-6374
Published: 2024-01-30
Description: Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-294
References: https://jvn.jp/vu/JVNVU99497477; https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-019_en.pdf
CVE: CVE-2023-6942
Published: 2024-01-30
Description: Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to bypass authentication by sending specially crafted packets and connect to the products illegally.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://jvn.jp/vu/JVNVU95103362; https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf
CVE: CVE-2023-6943
Published: 2024-01-30
Description: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-470
References: https://jvn.jp/vu/JVNVU95103362; https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf
CVE: CVE-2024-1061
Published: 2024-01-30
Description: The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the  'get_view' function.

CVSS Score: 8.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.tenable.com/security/research/tra-2024-02; https://www.tenable.com/security/research/tra-2024-02