deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22809
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through <= 2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pdf-catalog-woocommerce/vulnerability/wordpress-pdf-catalog-woocommerce-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22810
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phi Phan Content Blocks Builder content-blocks-builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through <= 2.7.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/content-blocks-builder/vulnerability/wordpress-content-blocks-builder-plugin-2-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22811
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Stan MT Addons for Elementor mt-addons-for-elementor allows Stored XSS.This issue affects MT Addons for Elementor: from n/a through <= 1.0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mt-addons-for-elementor/vulnerability/wordpress-mt-addons-for-elementor-plugin-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22812
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aezaz Shaikh News Ticker Widget for Elementor news-ticker-widget-for-elementor allows Stored XSS.This issue affects News Ticker Widget for Elementor: from n/a through <= 1.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/news-ticker-widget-for-elementor/vulnerability/wordpress-news-ticker-widget-for-elementor-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22813
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through <= 1.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/conversational-forms/vulnerability/wordpress-chatbot-conversational-forms-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22814
Published: 2025-01-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/zephyr-modern-admin-theme/vulnerability/wordpress-zephyr-admin-theme-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22815
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through <= 1.1.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/button-block/vulnerability/wordpress-button-block-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22817
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra bp-profile-shortcodes-extra allows Stored XSS.This issue affects BP Profile Shortcodes Extra: from n/a through <= 2.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bp-profile-shortcodes-extra/vulnerability/wordpress-bp-profile-shortcodes-extra-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22818
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration drm-protected-video-streaming allows Stored XSS.This issue affects S3Player – WooCommerce & Elementor Integration: from n/a through <= 4.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/drm-protected-video-streaming/vulnerability/wordpress-s3player-plugin-4-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22819
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roberto Bottalico Qr Code and Barcode Scanner Reader qr-code-and-barcode-scanner-reader allows Stored XSS.This issue affects Qr Code and Barcode Scanner Reader: from n/a through <= 1.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/qr-code-and-barcode-scanner-reader/vulnerability/wordpress-qr-code-and-barcode-scanner-reader-plugin-1-0-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22820
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goldsounds VR Views vr-views allows Stored XSS.This issue affects VR Views: from n/a through <= 1.5.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vr-views/vulnerability/wordpress-vr-views-plugin-1-5-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22821
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vfthemes StorePress storepress allows DOM-Based XSS.This issue affects StorePress: from n/a through <= 1.0.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/storepress/vulnerability/wordpress-storepress-theme-1-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22822
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bishawjit-das wp custom countdown wp-custom-countdown allows Stored XSS.This issue affects wp custom countdown: from n/a through <= 2.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-custom-countdown/vulnerability/wordpress-wp-custom-countdown-plugin-2-8-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22823
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtwerdy Genesis Style Shortcodes genesis-style-shortcodes allows DOM-Based XSS.This issue affects Genesis Style Shortcodes: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/genesis-style-shortcodes/vulnerability/wordpress-genesis-style-shortcodes-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22824
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lucia.intelisano Live Flight Radar live-flight-radar allows Stored XSS.This issue affects Live Flight Radar: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/live-flight-radar/vulnerability/wordpress-live-flight-radar-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22826
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Sell Digital Downloads sell-digital-downloads allows Stored XSS.This issue affects Sell Digital Downloads: from n/a through <= 2.2.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sell-digital-downloads/vulnerability/wordpress-sell-digital-downloads-plugin-2-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22827
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in joomag WP Joomag wp-joomag allows DOM-Based XSS.This issue affects WP Joomag: from n/a through <= 2.5.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-joomag/vulnerability/wordpress-wp-joomag-plugin-2-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-21592
Published: 2025-01-09
Description: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensitive files on the file system.

Through the execution of either 'show services advanced-anti-malware' or 'show services security-intelligence' command, a user with limited permissions (e.g., a low privilege login class user) can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system.


This issue affects Junos OS SRX Series:



  *  All versions before 21.4R3-S8,

  *  from 22.2 before 22.2R3-S5,

  *  from 22.3 before 22.3R3-S3,
  *  from 22.4 before 22.4R3-S2,

  *  from 23.2 before 23.2R2-S1,

  *  from 23.4 before 23.4R2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://supportportal.juniper.net/JSA92860
CVE: CVE-2025-21593
Published: 2025-01-09
Description: An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS).

On devices with SRv6 (Segment Routing over IPv6) enabled, an attacker can send a malformed BGP UPDATE packet which will cause the rpd to crash and restart. Continued receipt of these UPDATE packets will cause a sustained DoS condition. 

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.This issue affects Junos OS: 



  *  All versions before 21.2R3-S9, 
  *  from 21.4 before 21.4R3-S10, 
  *  from 22.2 before 22.2R3-S5, 
  *  from 22.3 before 22.3R3-S4, 
  *  from 22.4 before 22.4R3-S3, 
  *  from 23.2 before 23.2R2-S2, 
  *  from 23.4 before 23.4R2;



and Junos OS Evolved: 



  *  All versions before 21.2R3-S9-EVO, 
  *  from 21.4-EVO before 21.4R3-S10-EVO, 
  *  from 22.2-EVO before 22.2R3-S5-EVO, 
  *  from 22.3-EVO before 22.3R3-S4-EVO, 
  *  from 22.4-EVO before 22.4R3-S3-EVO,
  *  from 23.2-EVO before 23.2R2-S2-EVO, 
  *  from 23.4-EVO before 23.4R2-EVO.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-664
References: https://supportportal.juniper.net/JSA92861
CVE: CVE-2025-21596
Published: 2025-01-09
Description: An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devices allows a local, low-privileged authenticated attacker executing the 'show chassis environment pem' command to cause the chassis daemon (chassisd) to crash and restart, resulting in a temporary Denial of Service (DoS). However, repeated execution of this command will eventually cause the chassisd process to fail to restart, impacting packet processing on the system.

This issue affects Junos OS on SRX1500, SRX4100, SRX4200: 



  *  All versions before 21.4R3-S9, 
  *  from 22.2 before 22.2R3-S5, 
  *  from 22.3 before 22.3R3-S4, 
  *  from 22.4 before 22.4R3-S4, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://supportportal.juniper.net/JSA92864
CVE: CVE-2025-21599
Published: 2025-01-09
Description: A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Tunnel Driver (jtd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause Denial of Service. 

Receipt of specifically malformed IPv6 packets, destined to the device, causes kernel memory to not be freed, resulting in memory exhaustion leading to a system crash and Denial of Service (DoS). Continuous receipt and processing of these packets will continue to exhaust kernel memory, creating a sustained Denial of Service (DoS) condition.
This issue only affects systems configured with IPv6.

This issue affects Junos OS Evolved: 



  *  from 22.4-EVO before 22.4R3-S5-EVO, 
  *  from 23.2-EVO before 23.2R2-S2-EVO, 
  *  from 23.4-EVO before 23.4R2-S2-EVO, 
  *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.




This issue does not affect Juniper Networks Junos OS Evolved versions prior to 22.4R1-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://supportportal.juniper.net/JSA92869
CVE: CVE-2025-21600
Published: 2025-01-09
Description: An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of 

 Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.



This issue only affects systems configured in
      either of two ways:

    
    
        *  systems with BGP traceoptions enabled

        *  systems with BGP family traffic-engineering (BGP-LS)
          configured


 and can be exploited from a directly connected and configured BGP peer. 

This issue affects iBGP and eBGP 

with 

any address family

 configured, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS: 



  *  

from 21.4 before 21.4R3-S9, 
  *  from 22.2 before 22.2R3-S5, 
  *  from 22.3 before 22.3R3-S4, 
  *  from 22.4 before 22.4R3-S5, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S3, 
  *  from 24.2 before 24.2R1-S2, 24.2R2; 




Junos OS Evolved: 



  *  from 21.4-EVO before 21.4R3-S9-EVO, 
  *  from 22.2-EVO before 22.2R3-S5-EVO, 
  *  from 22.3-EVO before 22.3R3-S4-EVO, 
  *  from 22.4-EVO before 22.4R3-S5-EVO, 
  *  from 23.2-EVO before 23.2R2-S3-EVO, 
  *  from 23.4-EVO before 23.4R2-S2-EVO, 
  *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.


This issue does not affect versions of Junos OS prior to 21.3R1.


This issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.



This is a similar, but different vulnerability than the issue reported as CVE-2024-39516.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://supportportal.juniper.net/JSA92870
CVE: CVE-2025-21602
Published: 2025-01-09
Description: An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a specific BGP update packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). 

Continuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects Junos OS: 



  *  from 21.4 before 21.4R3-S9, 
  *  from 22.2 before 22.2R3-S5, 
  *  from 22.3 before 22.3R3-S4,
  *  from 22.4 before 22.4R3-S5, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S3, 
  *  from 24.2 before 24.2R1-S2, 24.2R2; 


This issue does not affect versions prior to 21.1R1.





Junos OS Evolved: 



  *  from 21.4 before 21.4R3-S9-EVO, 
  *  from 22.2 before 22.2R3-S5-EVO, 
  *  from 22.3 before 22.3R3-S4-EVO,
  *  from 22.4 before 22.4R3-S5-EVO, 
  *  from 23.2 before 23.2R2-S3-EVO, 
  *  from 23.4 before 23.4R2-S3-EVO, 
  *  from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO.


This issue does not affect versions prior to 21.1R1-EVO
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://supportportal.juniper.net/JSA92872
CVE: CVE-2025-21628
Published: 2025-01-09
Description: Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by adding a tautological WHERE clause. This issue is patched with v3.16.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/chatwoot/chatwoot/commit/b34dac7bbe3c910186083b680e51aad5ea60b44b; https://github.com/chatwoot/chatwoot/security/advisories/GHSA-g8f9-hh83-rcq9
CVE: CVE-2025-22149
Published: 2025-01-09
Description: JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal from a JWK Set is equivalent to revocation. The affected auto-caching HTTP client was added in version v0.5.0 and fixed in v0.6.0. The only workaround would be to remove the provided auto-caching HTTP client and replace it with a custom implementation. This involves setting the HTTPClientStorageOptions.RefreshInterval to zero (or not specifying the value).
CWE: CWE-672
References: https://github.com/MicahParks/jwkset/commit/01db49a90f7f20c7fb39a699a2f19a7a5f379ed3; https://github.com/MicahParks/jwkset/issues/40; https://github.com/MicahParks/jwkset/security/advisories/GHSA-675f-rq2r-jw82
CVE: CVE-2024-13237
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Scripting (XSS).This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.38.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-contrib-2024-001
CVE: CVE-2024-13238
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This issue affects Typogrify: from 0.0.0 before 1.3.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-contrib-2024-002
CVE: CVE-2024-13239
Published: 2025-01-09
Description: Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1390
References: https://www.drupal.org/sa-contrib-2024-003
CVE: CVE-2024-13240
Published: 2025-01-09
Description: Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.drupal.org/sa-contrib-2024-004
CVE: CVE-2024-13241
Published: 2025-01-09
Description: Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285
References: https://www.drupal.org/sa-contrib-2024-005
CVE: CVE-2024-13242
Published: 2025-01-09
Description: Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-749
References: https://www.drupal.org/sa-contrib-2024-006
CVE: CVE-2024-13243
Published: 2025-01-09
Description: Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.drupal.org/sa-contrib-2024-007
CVE: CVE-2024-13244
Published: 2025-01-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.drupal.org/sa-contrib-2024-008
CVE: CVE-2024-13245
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-contrib-2024-009
CVE: CVE-2024-13246
Published: 2025-01-09
Description: Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-282
References: https://www.drupal.org/sa-contrib-2024-010
CVE: CVE-2024-13247
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-contrib-2024-011
CVE: CVE-2024-13248
Published: 2025-01-09
Description: Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-266
References: https://www.drupal.org/sa-contrib-2024-012
CVE: CVE-2024-13249
Published: 2025-01-09
Description: Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-282
References: https://www.drupal.org/sa-contrib-2024-013
CVE: CVE-2024-13250
Published: 2025-01-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.drupal.org/sa-contrib-2024-014
CVE: CVE-2024-13251
Published: 2025-01-09
Description: Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://www.drupal.org/sa-contrib-2024-015
CVE: CVE-2024-13252
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-contrib-2024-016
CVE: CVE-2024-13253
Published: 2025-01-09
Description: Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://www.drupal.org/sa-contrib-2024-017
CVE: CVE-2024-13254
Published: 2025-01-09
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://www.drupal.org/sa-contrib-2024-018