deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4509
Published: 2024-04-18
Description: It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: https://advisories.octopus.com/post/2024/sa2024-02/; https://advisories.octopus.com/post/2024/sa2024-02/
CVE: CVE-2024-3928
Published: 2024-04-18
Description: A vulnerability was found in Dromara open-capacity-platform 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /actuator/heapdump of the component auth-server. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261367.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/ggfzx/OCP-Security-Misconfiguration/tree/main; https://vuldb.com/?ctiid.261367; https://vuldb.com/?id.261367
CVE: CVE-2024-3931
Published: 2024-04-18
Description: A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/roles/check.php of the component User Selector. The manipulation of the argument ID Number leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 13.46, 14.38, 15.33, 16.27, 17.21 and 18.8 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://totara.community/mod/forum/discuss.php?d=27644; https://vuldb.com/?ctiid.261368; https://vuldb.com/?id.261368
CVE: CVE-2024-3932
Published: 2024-04-18
Description: A vulnerability classified as problematic has been found in Totara LMS up to 18.7. This affects an unknown part of the component User Selector. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 13.46, 14.38, 15.33, 16.27, 17.21 and 18.8 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.1 (LOW)
CWE: CWE-352, CWE-862
References: https://totara.community/mod/forum/discuss.php?d=27644; https://vuldb.com/?ctiid.261369; https://vuldb.com/?id.261369
CVE: CVE-2024-29956
Published: 2024-04-18
Description: A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the Brocade SANnav password in clear text in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/23240; https://support.broadcom.com/external/content/SecurityAdvisories/0/23240
CVE: CVE-2024-1426
Published: 2024-04-18
Description: The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ attribute of the Price List widget in all versions up to, and including, 5.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3070672/bdthemes-element-pack-lite/trunk/modules/price-list/widgets/price-list.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/2edfceaf-e719-4351-8f5c-2d7dd401c84e?source=cve; https://plugins.trac.wordpress.org/changeset/3070672/bdthemes-element-pack-lite/trunk/modules/price-list/widgets/price-list.php
CVE: CVE-2024-1429
Published: 2024-04-18
Description: The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tab_link’ attribute of the Panel Slider widget in all versions up to, and including, 5.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32572 is likely a duplicate of this or CVE-2024-1426.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3070672/bdthemes-element-pack-lite/trunk/modules/panel-slider/widgets/panel-slider.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/7ec6b03c-e594-4b20-9da0-78413048ba70?source=cve; https://plugins.trac.wordpress.org/changeset/3070672/bdthemes-element-pack-lite/trunk/modules/panel-slider/widgets/panel-slider.php
CVE: CVE-2024-2729
Published: 2024-04-18
Description: The Otter Blocks  WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5014f886-020e-49d1-96a5-2159eed8ba14/; https://wpscan.com/vulnerability/5014f886-020e-49d1-96a5-2159eed8ba14/
CVE: CVE-2023-49742
Published: 2024-04-18
Description: Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/support-genix-lite/wordpress-support-genix-plugin-1-2-3-broken-access-control-lead-to-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/support-genix-lite/wordpress-support-genix-plugin-1-2-3-broken-access-control-lead-to-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-31869
Published: 2024-04-18
Description: Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to  CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq  which concerned API, not UI configuration page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2024/04/17/10; https://github.com/apache/airflow/pull/38795; https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3
CVE: CVE-2024-32142
Published: 2024-04-18
Description: Missing Authorization vulnerability in Ovic Team Ovic Responsive WPBakery.This issue affects Ovic Responsive WPBakery: from n/a through 1.3.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ovic-vc-addon/wordpress-ovic-responsive-wpbakery-plugin-1-3-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ovic-vc-addon/wordpress-ovic-responsive-wpbakery-plugin-1-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-41864
Published: 2024-04-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/pepro-cf7-database/wordpress-peprodev-cf7-database-plugin-1-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pepro-cf7-database/wordpress-peprodev-cf7-database-plugin-1-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-28076
Published: 2024-04-18
Description: The SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability. A potential attacker can redirect to different domain when using URL parameter with relative entry in the correct format
CVSS Score: 7.0 (HIGH)
CWE: CWE-601
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28076; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm
CVE: CVE-2024-29001
Published: 2024-04-18
Description: A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and user interaction to be exploited.  
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29001; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm
CVE: CVE-2024-32587
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvialoSimple EnvíaloSimple allows Reflected XSS.This issue affects EnvíaloSimple: from n/a through 2.2.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/envialosimple-email-marketing-y-newsletters-gratis/wordpress-envialosimple-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/envialosimple-email-marketing-y-newsletters-gratis/wordpress-envialosimple-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32588
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through 4.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/learnpress-import-export/wordpress-learnpress-export-import-plugin-4-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/learnpress-import-export/wordpress-learnpress-export-import-plugin-4-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32590
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webfood Kattene allows Stored XSS.This issue affects Kattene: from n/a through 1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/kattene/wordpress-kattene-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/kattene/wordpress-kattene-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32591
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele De Rosa Backend Designer allows Stored XSS.This issue affects Backend Designer: from n/a through 1.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/backend-designer/wordpress-backend-designer-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/backend-designer/wordpress-backend-designer-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32592
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VoidCoders, innovs Void Elementor WHMCS Elements For Elementor Page Builder allows Stored XSS.This issue affects Void Elementor WHMCS Elements For Elementor Page Builder: from n/a through 2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/void-elementor-whmcs-elements/wordpress-void-elementor-whmcs-elements-for-elementor-page-builder-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/void-elementor-whmcs-elements/wordpress-void-elementor-whmcs-elements-for-elementor-page-builder-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32593
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBits WPBITS Addons For Elementor Page Builder allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through 1.3.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpbits-addons-for-elementor/wordpress-wpbits-addons-for-elementor-page-builder-plugin-1-3-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpbits-addons-for-elementor/wordpress-wpbits-addons-for-elementor-page-builder-plugin-1-3-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32594
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AttesaWP Attesa Extra allows Stored XSS.This issue affects Attesa Extra: from n/a through 1.3.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/attesa-extra/wordpress-attesa-extra-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/attesa-extra/wordpress-attesa-extra-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32595
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mat Bao Corp WP Helper Premium allows Reflected XSS.This issue affects WP Helper Premium: from n/a before 4.6.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-helper-lite/wordpress-wp-helper-premium-plugin-4-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-helper-lite/wordpress-wp-helper-premium-plugin-4-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32596
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric-Oliver Mächler DSGVO Youtube allows Stored XSS.This issue affects DSGVO Youtube: from n/a through 1.4.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dsgvo-youtube/wordpress-dsgvo-youtube-plugin-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dsgvo-youtube/wordpress-dsgvo-youtube-plugin-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32597
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This issue affects WordPress Importer: from n/a through 1.0.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-smart-import/wordpress-wp-smart-import-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-smart-import/wordpress-wp-smart-import-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32598
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms BA Book Everything allows Stored XSS.This issue affects BA Book Everything: from n/a through 1.6.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ba-book-everything/wordpress-ba-book-everything-plugin-1-6-8-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/ba-book-everything/wordpress-ba-book-everything-plugin-1-6-8-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-32599
Published: 2024-04-18
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator.This issue affects WP Dummy Content Generator: from n/a through <= 3.2.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/wp-dummy-content-generator/vulnerability/wordpress-wp-dummy-content-generator-plugin-3-2-1-arbitrary-code-execution-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-dummy-content-generator/wordpress-wp-dummy-content-generator-plugin-3-2-1-arbitrary-code-execution-vulnerability?_s_id=cve
CVE: CVE-2024-32601
Published: 2024-04-18
Description: Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Popup Anything.This issue affects Popup Anything: from n/a through 2.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/popup-anything-on-click/wordpress-popup-anything-plugin-2-8-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/popup-anything-on-click/wordpress-popup-anything-plugin-2-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32603
Published: 2024-04-18
Description: Deserialization of Untrusted Data vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.20.
CVSS Score: 8.5 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/wc4bp/wordpress-woobuddy-plugin-3-4-20-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc4bp/wordpress-woobuddy-plugin-3-4-20-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-32604
Published: 2024-04-18
Description: Authorization Bypass Through User-Controlled Key vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/wp-recall/wordpress-wp-recall-plugin-16-26-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-recall/wordpress-wp-recall-plugin-16-26-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-26921
Published: 2024-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

inet: inet_defrag: prevent sk release while still in use

ip_local_out() and other functions can pass skb->sk as function argument.

If the skb is a fragment and reassembly happens before such function call
returns, the sk must not be released.

This affects skb fragments reassembled via netfilter or similar
modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.

Eric Dumazet made an initial analysis of this bug.  Quoting Eric:
  Calling ip_defrag() in output path is also implying skb_orphan(),
  which is buggy because output path relies on sk not disappearing.

  A relevant old patch about the issue was :
  8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")

  [..]

  net/ipv4/ip_output.c depends on skb->sk being set, and probably to an
  inet socket, not an arbitrary one.

  If we orphan the packet in ipvlan, then downstream things like FQ
  packet scheduler will not work properly.

  We need to change ip_defrag() to only use skb_orphan() when really
  needed, ie whenever frag_list is going to be used.

Eric suggested to stash sk in fragment queue and made an initial patch.
However there is a problem with this:

If skb is refragmented again right after, ip_do_fragment() will copy
head->sk to the new fragments, and sets up destructor to sock_wfree.
IOW, we have no choice but to fix up sk_wmem accouting to reflect the
fully reassembled skb, else wmem will underflow.

This change moves the orphan down into the core, to last possible moment.
As ip_defrag_offset is aliased with sk_buff->sk member, we must move the
offset into the FRAG_CB, else skb->sk gets clobbered.

This allows to delay the orphaning long enough to learn if the skb has
to be queued or if the skb is completing the reasm queue.

In the former case, things work as before, skb is orphaned.  This is
safe because skb gets queued/stolen and won't continue past reasm engine.

In the latter case, we will steal the skb->sk reference, reattach it to
the head skb, and fix up wmem accouting when inet_frag inflates truesize.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/18685451fc4e546fc0e718580d32df3c0e5c8272; https://git.kernel.org/stable/c/1b6de5e6575b56502665c65cf93b0ae6aa0f51ab; https://git.kernel.org/stable/c/4318608dc28ef184158b[PII_REDACTED]716bea23f0
CVE: CVE-2024-29003
Published: 2024-04-18
Description: The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requires authentication and requires user interaction. 
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29003; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm
CVE: CVE-2024-2833
Published: 2024-04-18
Description: The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3064421/job-postings/trunk/include/shortcodes/class-job-search.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f6710f53-34fe-4549-9e1a-7826be74c912?source=cve; https://plugins.trac.wordpress.org/changeset/3064421/job-postings/trunk/include/shortcodes/class-job-search.php
CVE: CVE-2024-32554
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Knight Lab Knight Lab Timeline allows Stored XSS.This issue affects Knight Lab Timeline: from n/a through 3.9.3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/knight-lab-timelinejs/wordpress-knight-lab-timeline-plugin-3-9-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/knight-lab-timelinejs/wordpress-knight-lab-timeline-plugin-3-9-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32556
Published: 2024-04-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer allows Stored XSS.This issue affects HurryTimer: from n/a through 2.9.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/hurrytimer/wordpress-hurrytimer-plugin-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/hurrytimer/wordpress-hurrytimer-plugin-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve