deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-52470
Published: 2024-11-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Reflected XSS.This issue affects Dynamic URL SEO: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dynamic-url-seo/vulnerability/wordpress-dynamic-url-seo-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52471
Published: 2024-11-20
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Reflected XSS.This issue affects Extensions for Elementor: from n/a through 2.0.37.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/extensions-for-elementor/wordpress-extensions-for-elementor-plugin-2-0-37-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52472
Published: 2024-11-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weather Atlas Weather Atlas Widget weather-atlas allows Reflected XSS.This issue affects Weather Atlas Widget: from n/a through <= 3.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/weather-atlas/vulnerability/wordpress-weather-atlas-widget-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52473
Published: 2024-11-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandeep Verma HTML5 Lyrics Karaoke Player html5-lyrics-karaoke-player allows Reflected XSS.This issue affects HTML5 Lyrics Karaoke Player: from n/a through <= 2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/html5-lyrics-karaoke-player/vulnerability/wordpress-html5-lyrics-karaoke-player-plugin-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52598
Published: 2024-11-20
Description: 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-80, CWE-918, CWE-918
References: https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j
CVE: CVE-2024-11484
Published: 2024-11-20
Description: A vulnerability classified as critical was found in Code4Berry Decoration Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /decoration/admin/update_image.php of the component User Image Handler. The manipulation of the argument productimage1 leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://vuldb.com/?ctiid.285499; https://vuldb.com/?id.285499; https://vuldb.com/?submit.441913
CVE: CVE-2024-11485
Published: 2024-11-20
Description: A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0. Affected by this issue is some unknown functionality of the file /decoration/admin/userregister.php of the component User Handler. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-275
References: https://vuldb.com/?ctiid.285500; https://vuldb.com/?id.285500; https://vuldb.com/?submit.441914
CVE: CVE-2024-11486
Published: 2024-11-20
Description: A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decoration/admin/user_permission.php of the component User Permission Handler. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-275
References: https://vuldb.com/?ctiid.285501; https://vuldb.com/?id.285501; https://vuldb.com/?submit.441916
CVE: CVE-2024-11487
Published: 2024-11-20
Description: A vulnerability has been found in Code4Berry Decoration Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /decoration/admin/btndates_report.php of the component Between Dates Reports. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.285502; https://vuldb.com/?id.285502; https://vuldb.com/?submit.441917
CVE: CVE-2018-9468
Published: 2024-11-20
Description: In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. This could lead to local information disclosure and file rewriting with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.1 (HIGH)
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9469
Published: 2024-11-20
Description: In multiple functions of ShortcutService.java, there is a possible creation of a spoofed shortcut due to a missing permission check. This could lead to local escalation of privilege in a privileged app with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-787
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2024-11488
Published: 2024-11-20
Description: A vulnerability was found in 115cms up to 20240807 and classified as problematic. This issue affects some unknown processing of the file /app/admin/view/web_user.html. The manipulation of the argument ks leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/70; https://vuldb.com/?ctiid.285503; https://vuldb.com/?id.285503
CVE: CVE-2024-11489
Published: 2024-11-20
Description: A vulnerability was found in 115cms up to 20240807. It has been classified as problematic. Affected is an unknown function of the file /index.php/admin/web/file.html. The manipulation of the argument ks leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/70; https://vuldb.com/?ctiid.285504; https://vuldb.com/?id.285504
CVE: CVE-2024-11490
Published: 2024-11-20
Description: A vulnerability was found in 115cms up to 20240807. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php/admin/web/set.html. The manipulation of the argument type leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/70; https://vuldb.com/?ctiid.285505; https://vuldb.com/?id.285505
CVE: CVE-2024-11491
Published: 2024-11-20
Description: A vulnerability was found in 115cms up to 20240807. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php/admin/web/useradmin.html. The manipulation of the argument ks leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/70; https://vuldb.com/?ctiid.285506; https://vuldb.com/?id.285506
CVE: CVE-2024-51162
Published: 2024-11-20
Description: An issue in Audimex EE versions 15.1.20 and earlier allowing a remote attacker to escalate privileges. Analyzing the offline client code, it was identified that it is possible for any user (with any privilege) of Audimex to dump the whole Audimex database. This gives visibility upon password hashes of any user, ongoing audit data and more.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://en.web-audimex.com/ee-auditmanagement; https://github.com/Cameleon037/CVEs/blob/main/CVE-2024-51162/README.md; https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2024-51162
CVE: CVE-2024-51163
Published: 2024-11-20
Description: A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive information through the print label function. Specifically, the filePathList parameter is susceptible to LFI, enabling a malicious user to include files from the web server, such as web.config or /etc/host, leading to the disclosure of sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2024-51163; https://github.com/rahulkadavil/CVEs/tree/main/CVE-2024-51163
CVE: CVE-2024-52725
Published: 2024-11-20
Description: SemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to execute arbitrary code via the ldgid parameter in the SEMCMS_SeoAndTag.php component.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Megrez0423/Seecms
CVE: CVE-2024-52769
Published: 2024-11-20
Description: An arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://co-a1natas.feishu.cn/docx/Zsd9dnGUvoBW6tx0G5fcVx6vnBb; https://github.com/DedeBIZ/DedeV6/
CVE: CVE-2024-52770
Published: 2024-11-20
Description: An arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://co-a1natas.feishu.cn/docx/Zsd9dnGUvoBW6tx0G5fcVx6vnBb; https://github.com/DedeBIZ/DedeV6/
CVE: CVE-2024-52771
Published: 2024-11-20
Description: DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://co-a1natas.feishu.cn/docx/Zsd9dnGUvoBW6tx0G5fcVx6vnBb; https://github.com/DedeBIZ/DedeV6/
CVE: CVE-2024-52796
Published: 2024-11-20
Description: Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter.  In versions prior to v1.49.0, the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service. In v1.49.0, a fix was implemented to only authorize proxies on local IPs which resolves this issue. As a workaround, one may add rules to one's proxy and/or firewall to not accept external proxy headers such as `X-Forwarded-*` from clients.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://docs.pwpush.com/docs/proxies/#trusted-proxies; https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0; https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j
CVE: CVE-2018-9470
Published: 2024-11-20
Description: In bff_Scanner_addOutPos of Scanner.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege in an unprivileged app with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9471
Published: 2024-11-20
Description: In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-787
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9472
Published: 2024-11-20
Description: In xmlMemStrdupLoc of xmlmemory.c, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9474
Published: 2024-11-20
Description: In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9475
Published: 2024-11-20
Description: In HeadsetInterface::ClccResponse of btif_hf.cc, there is a possible out of bounds stack write due to a missing bounds check. This could lead to remote escalation of privilege via Bluetooth, if the recipient has enabled SIP calls with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9477
Published: 2024-11-20
Description: In the development options section of the Settings app, there is a possible authentication bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-294
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9478
Published: 2024-11-20
Description: In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed.  User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9479
Published: 2024-11-20
Description: In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed.  User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9480
Published: 2024-11-20
Description: In bta_hd_get_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to improper input validation. This could lead to remote information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9481
Published: 2024-11-20
Description: In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-125, CWE-190
References: https://lists.apache.org/thread.html/rcb8bae0b289d71d18a3220be256c1dfcc4d9ab49d2d6e07d1eac7c9d@%3Cdev.trafficserver.apache.org%3E
CVE: CVE-2018-9482
Published: 2024-11-20
Description: In intr_data_copy_cb of btif_hd.cc, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-125, CWE-190
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9483
Published: 2024-11-20
Description: In bta_dm_remove_sec_dev_entry of bta_dm_act.cc, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-125, CWE-416
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9484
Published: 2024-11-20
Description: In l2cu_send_peer_config_rej of l2c_utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9485
Published: 2024-11-20
Description: In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9486
Published: 2024-11-20
Description: In hidh_l2cif_data_ind of hidh_conn.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure over bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9487
Published: 2024-11-20
Description: In setVpnForcedLocked of Vpn.java, there is a possible blocking of internet traffic through vpn due to a bad uid check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2024-11081
Published: 2024-11-20
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-11492
Published: 2024-11-20
Description: A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html. The manipulation of the argument tid leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/70; https://vuldb.com/?ctiid.285507; https://vuldb.com/?id.285507
CVE: CVE-2024-11493
Published: 2024-11-20
Description: A vulnerability classified as problematic was found in 115cms up to 20240807. This vulnerability affects unknown code of the file /index.php/setpage/admin/pageAE.html. The manipulation of the argument tid leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/70; https://vuldb.com/?ctiid.285508; https://vuldb.com/?id.285508
CVE: CVE-2024-29292
Published: 2024-11-20
Description: Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to execute arbitrary OS commands via various cgi parameters.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://gist.github.com/QuartzDust/debfd7ddf934a9f5609d7f1a8cd71154; https://www.kasdanet.com/ENHCSZ/pro_view-120.html
CVE: CVE-2024-52739
Published: 2024-11-20
Description: D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp_info_htm function via the flag and cmd parameters.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/faqiadegege/IoTVuln/blob/main/DI_8400_msp_info_htm_rce/detail.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-33439
Published: 2024-11-20
Description: An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://gist.github.com/QuartzDust/848acfddff02c881eb86dd302e859e80
CVE: CVE-2024-45511
Published: 2024-11-20
Description: An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcase module due to improper sanitization of file content by the OnlyOffice formatter. This occurs when the victim opens a crafted URL pointing to a shared folder containing a malicious file uploaded by the attacker. The vulnerability allows the attacker to execute arbitrary JavaScript in the context of the victim's session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes