deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1336
Published: 2024-02-29
Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the optimizeAllOn function. This makes it possible for unauthenticated attackers to modify image optimization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression; https://www.wordfence.com/threat-intel/vulnerabilities/id/ca4cf299-9dee-4ebf-83f3-4c3471bd9fb0?source=cve; https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE: CVE-2024-1337
Published: 2024-02-29
Description: The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveSktbuilderPageData' function in all versions up to, and including, 4.1. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary content into pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3034383/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3164b96f-d876-4cbc-bddf-51e9d9becee6?source=cve; https://plugins.trac.wordpress.org/changeset/3034383/
CVE: CVE-2024-1338
Published: 2024-02-29
Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the stopOptimizeAll function. This makes it possible for unauthenticated attackers to modify image optimization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression; https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3dd131-dbd8-431c-96f4-4ab2c3be4dbd?source=cve; https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE: CVE-2024-1339
Published: 2024-02-29
Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the reinitialize function. This makes it possible for unauthenticated attackers to remove all plugin data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression; https://www.wordfence.com/threat-intel/vulnerabilities/id/2d08e462-8297-477e-89da-47f26bd6beae?source=cve; https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE: CVE-2024-1340
Published: 2024-02-29
Description: The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php#L492; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3033542%40login-lockdown%2Ftrunk&old=3027788%40login-lockdown%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/34021007-b5d3-479b-a0d4-50e301f22c9c?source=cve
CVE: CVE-2024-1349
Published: 2024-02-29
Description: The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/embedpress/tags/3.9.8/EmbedPress/Shortcode.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3035539%40embedpress%2Ftrunk&old=3029957%40embedpress%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/631d200f-7b0b-4105-b91e-030af459ba99?source=cve
CVE: CVE-2024-1389
Published: 2024-02-29
Description: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to change the Stripe payment keys.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/paid-member-subscriptions/trunk/includes/gateways/stripe/admin/functions-admin-connect.php#L11; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034497%40paid-member-subscriptions%2Ftrunk&old=3031453%40paid-member-subscriptions%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/cd5f5861-5be4-456d-915d-bafb7bff2110?source=cve
CVE: CVE-2024-1390
Published: 2024-02-29
Description: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creating_pricing_table_page function in all versions up to, and including, 2.11.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create pricing tables.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/paid-member-subscriptions/trunk/includes/admin/class-admin-subscription-plans.php#L477; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034497%40paid-member-subscriptions%2Ftrunk&old=3031453%40paid-member-subscriptions%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/10f00859-3adf-40ff-8f33-827bbb1f62df?source=cve
CVE: CVE-2024-1408
Published: 2024-02-29
Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edit-profile-text-box shortcode in all versions up to, and including, 4.14.4 due to insufficient input sanitization and output escaping on user supplied attributes such as 'type'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WordpressPluginDirectory/wp-user-avatar/blob/fde360946c86d67610d8f95a82752199ce25b39a/wp-user-avatar/sr/ShortcodeParser/Builder/FieldsShortcodeCallback.php#L524; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037126%40wp-user-avatar%2Ftrunk&old=3030229%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6e50081f-6658-4cc7-bf0a-d[PII_REDACTED]6?source=cve
CVE: CVE-2024-1411
Published: 2024-02-29
Description: The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of the Twitter Buttons Widget in all versions up to, and including, 2.7.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3035790/powerpack-lite-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/64480862-c076-4ea9-a03b-9aed81f876d5?source=cve; https://plugins.trac.wordpress.org/changeset/3035790/powerpack-lite-for-elementor
CVE: CVE-2024-1425
Published: 2024-02-29
Description: The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Calendar Widget Link in all versions up to, and including, 3.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/embedpress/tags/3.9.8/EmbedPress/Elementor/Widgets/Embedpress_Calendar.php#L314; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3035539%40embedpress%2Ftrunk&old=3029957%40embedpress%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4568c8-f58c-4c37-94b9-6154e5c46928?source=cve
CVE: CVE-2024-1445
Published: 2024-02-29
Description: The Page scroll to id plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/page-scroll-to-id/tags/1.7.8/includes/malihu-pagescroll2id-shortcodes-php52.php; https://plugins.trac.wordpress.org/browser/page-scroll-to-id/tags/1.7.8/includes/malihu-pagescroll2id-shortcodes.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3035333%40page-scroll-to-id%2Ftrunk&old=3034857%40page-scroll-to-id%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-1447
Published: 2024-02-29
Description: The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all versions up to, and including, 1.25 due to insufficient input sanitization and output escaping on user supplied link. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/sydney-toolbox/trunk/inc/elementor/block-slider.php#L679; https://plugins.trac.wordpress.org/browser/sydney-toolbox/trunk/inc/elementor/block-slider.php#L692; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3035233%40sydney-toolbox%2Ftrunk&old=2980978%40sydney-toolbox%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-1448
Published: 2024-02-29
Description: The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.3.56 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/sassy-social-share/tags/3.3.56/includes/class-sassy-social-share-shortcodes.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3038227%40sassy-social-share%2Ftrunk&old=2996153%40sassy-social-share%2Ftrunk&sfp_email=&sfph_mail=#file8; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c2f4b74-2568-4e5a-b55f-0130096bc19f?source=cve
CVE: CVE-2024-1470
Published: 2024-02-29
Description: Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code Injection.This issue 

only 

affects NetIQ Client Login Extension: 4.6.


CVSS Score: 7.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://portal.microfocus.com/s/article/KM000026667?language=en_US; https://portal.microfocus.com/s/article/KM000026667?language=en_US
CVE: CVE-2024-1472
Published: 2024-02-29
Description: The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's maintenance mode obtain post and page content via REST API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3035862%40wp-maintenance%2Ftrunk&old=3032356%40wp-maintenance%2Ftrunk&sfp_email=&sfph_mail=#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/645328f3-2bcb-4287-952c-2e23ec57bb4e?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3035862%40wp-maintenance%2Ftrunk&old=3032356%40wp-maintenance%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE: CVE-2024-1475
Published: 2024-02-29
Description: The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content thus bypassing the protection provided by the plugin.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037910%40coming-soon-maintenance-mode%2Ftrunk&old=3031487%40coming-soon-maintenance-mode%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/44e4a1a3-71d0-4cad-9807-f6bbc99ccb13?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037910%40coming-soon-maintenance-mode%2Ftrunk&old=3031487%40coming-soon-maintenance-mode%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-1492
Published: 2024-02-29
Description: The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function in all versions up to, and including, 4.0.8. This makes it possible for unauthenticated attackers to obtain shipping details for orders as long as the order number is known.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037482%40wpify-woo%2Ftrunk&old=3028980%40wpify-woo%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/44f691f2-b3f4-49b7-8710-015b5b11db18?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037482%40wpify-woo%2Ftrunk&old=3028980%40wpify-woo%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-1496
Published: 2024-02-29
Description: The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all versions up to, and including, 4.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/featured-image-from-url/tags/4.6.2/elementor/widgets/widget.php#L49; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037479%40featured-image-from-url%2Ftrunk&old=3034300%40featured-image-from-url%2Ftrunk&sfp_email=&sfph_mail=#file9; https://www.wordfence.com/threat-intel/vulnerabilities/id/7d1ea1c5-6a9e-4b77-bfdf-62e50d4a4c03?source=cve
CVE: CVE-2024-1519
Published: 2024-02-29
Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 4.14.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires a member listing page to be active and using the Gerbera theme.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/Themes/DragDrop/MemberDirectory/Gerbera.php#L93; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037126%40wp-user-avatar%2Ftrunk&old=3030229%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4ffd74de-6629-4088-ba5c-ac9dd5c6322c?source=cve
CVE: CVE-2024-1570
Published: 2024-02-29
Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login-password shortcode in all versions up to, and including, 4.14.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WordpressPluginDirectory/wp-user-avatar/blob/fde360946c86d67610d8f95a82752199ce25b39a/wp-user-avatar/src/ShortcodeParser/Builder/LoginFormBuilder.php#L99; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037126%40wp-user-avatar%2Ftrunk&old=3030229%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/46d4d573-3845-4d20-8a48-a2f28850383c?source=cve
CVE: CVE-2024-1586
Published: 2024-02-29
Description: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default the required authentication level is admin, but administrators have the ability to assign role based access to users as low as subscriber.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?old_path=/schema-and-structured-data-for-wp/tags/1.26&old=3038020&new_path=/schema-and-structured-data-for-wp/tags/1.27&new=3038020&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7e6ea7-4e0b-4d8a-9306-45b55d41fbb5?source=cve; https://plugins.trac.wordpress.org/changeset?old_path=/schema-and-structured-data-for-wp/tags/1.26&old=3038020&new_path=/schema-and-structured-data-for-wp/tags/1.27&new=3038020&sfp_email=&sfph_mail=
CVE: CVE-2024-1722
Published: 2024-02-29
Description: A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
CVSS Score: 3.7 (LOW)
CWE: CWE-645
References: https://access.redhat.com/security/cve/CVE-2024-1722; https://bugzilla.redhat.com/show_bug.cgi?id=2265389; https://access.redhat.com/security/cve/CVE-2024-1722
CVE: CVE-2024-1927
Published: 2024-02-29
Description: A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin/login.php. The manipulation of the argument txtpassword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254863.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Web-Based%20Student%20Clearance%20System%20-%20SQLi.md; https://vuldb.com/?ctiid.254863; https://vuldb.com/?id.254863
CVE: CVE-2024-1928
Published: 2024-02-29
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit-admin.php of the component Edit User Profile Page. The manipulation of the argument Fullname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254864.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Web-Based%20Student%20Clearance%20System%20-%20XSS.md; https://vuldb.com/?ctiid.254864; https://vuldb.com/?id.254864
CVE: CVE-2024-1938
Published: 2024-02-29
Description: Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html; https://issues.chromium.org/issues/324596281; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWSP5MIK7CDWJQHN2SJJX2YGSSS7E4O/
CVE: CVE-2024-1939
Published: 2024-02-29
Description: Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html; https://issues.chromium.org/issues/323694592; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWSP5MIK7CDWJQHN2SJJX2YGSSS7E4O/
CVE: CVE-2024-1970
Published: 2024-02-29
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Learning System V2 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255126 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/OnlineLearningSystemV2-XSS.md; https://vuldb.com/?ctiid.255126; https://vuldb.com/?id.255126