deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-30214
Published: 2025-03-25
Description: Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-287
References: https://github.com/frappe/frappe/security/advisories/GHSA-qrv3-jc3h-f3m6
CVE: CVE-2024-58104
Published: 2025-03-25
Description: A vulnerability  in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. 

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/en-US/solution/KA-0018217
CVE: CVE-2024-58105
Published: 2025-03-25
Description: A vulnerability  in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. 

This CVE address an addtional bypass not covered in CVE-2024-58104.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-286
References: https://success.trendmicro.com/en-US/solution/KA-0018217
CVE: CVE-2025-2312
Published: 2025-03-25
Description: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-488
References: https://git.samba.org/?p=cifs-utils.git;a=commit;h=89b679228cc1be9739d54203d28289b03352c174; https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/smb?id=db363b0a1d9e6b9dc556296f1b1007aeb496a8cf
CVE: CVE-2024-31896
Published: 2025-03-25
Description: IBM SPSS Statistics 26.0, 27.0.1, 28.0.1, and 29.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.ibm.com/support/pages/node/7228971
CVE: CVE-2025-28904
Published: 2025-03-25
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shamalli Web Directory Free web-directory-free allows Blind SQL Injection.This issue affects Web Directory Free: from n/a through <= 1.7.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/web-directory-free/vulnerability/wordpress-web-directory-free-plugin-1-7-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30567
Published: 2025-03-25
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: from n/a through <= 2.6.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/wp01/vulnerability/wordpress-wp01-2-6-2-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2024-48818
Published: 2025-03-25
Description: An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://packetstorm.news/files/id/183309; https://packetstorm.news/files/id/183309
CVE: CVE-2025-30118
Published: 2025-03-25
Description: An issue was discovered on the Audi Universal Traffic Recorder 2.88. It has Susceptibility to denial of service. It uses the same default credentials for all devices and does not implement proper multi-device authentication, allowing attackers to deny the owner access by occupying the only available connection. The SSID remains broadcast at all times, increasing exposure to potential attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://github.com/geo-chen/Audi/blob/main/README.md#finding-1---cve-2025-30118-audi-utr-susceptibility-to-dos
CVE: CVE-2025-30216
Published: 2025-03-25
Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a Heap Overflow vulnerability occurs in the `Crypto_TM_ProcessSecurity` function (`crypto_tm.c:1735:8`). When processing the Secondary Header Length of a TM protocol packet, if the Secondary Header Length exceeds the packet's total length, a heap overflow is triggered during the memcpy operation that copies packet data into the dynamically allocated buffer `p_new_dec_frame`. This allows an attacker to overwrite adjacent heap memory, potentially leading to arbitrary code execution or system instability. A patch is available at commit 810fd66d592c883125272fef123c3240db2f170f.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://github.com/nasa/CryptoLib/commit/810fd66d592c883125272fef123c3240db2f170f; https://github.com/nasa/CryptoLib/security/advisories/GHSA-v3jc-5j74-hcjv; https://github.com/user-attachments/assets/d49cea04-ce84-4d60-bb3a-987e843f09c4
CVE: CVE-2024-55028
Published: 2025-03-25
Description: A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://visionspace.com/remote-code-execution-and-critical-vulnerabilities-in-nasa-fprime-v3-4-3/; https://visionspace.com/remote-code-execution-and-critical-vulnerabilities-in-nasa-fprime-v3-4-3/
CVE: CVE-2024-55029
Published: 2025-03-25
Description: NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://visionspace.com/remote-code-execution-and-critical-vulnerabilities-in-nasa-fprime-v3-4-3/; https://visionspace.com/remote-code-execution-and-critical-vulnerabilities-in-nasa-fprime-v3-4-3/
CVE: CVE-2024-55030
Published: 2025-03-25
Description: A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://visionspace.com/remote-code-execution-and-critical-vulnerabilities-in-nasa-fprime-v3-4-3/; https://visionspace.com/remote-code-execution-and-critical-vulnerabilities-in-nasa-fprime-v3-4-3/
CVE: CVE-2025-25371
Published: 2025-03-25
Description: NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/; https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/
CVE: CVE-2025-25372
Published: 2025-03-25
Description: NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/; https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/
CVE: CVE-2025-25373
Published: 2025-03-25
Description: The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/; https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/
CVE: CVE-2025-25374
Published: 2025-03-25
Description: In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causing a platform denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/; https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/
CVE: CVE-2025-27830
Published: 2025-03-25
Description: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=708241; https://lists.debian.org/debian-lts-announce/2025/04/msg00014.html
CVE: CVE-2025-27831
Published: 2025-03-25
Description: An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doc_common.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=708132; https://lists.debian.org/debian-lts-announce/2025/04/msg00014.html
CVE: CVE-2025-27832
Published: 2025-03-25
Description: An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=708133; https://lists.debian.org/debian-lts-announce/2025/04/msg00014.html
CVE: CVE-2025-27833
Published: 2025-03-25
Description: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=708259
CVE: CVE-2025-27834
Published: 2025-03-25
Description: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=708253
CVE: CVE-2025-27835
Published: 2025-03-25
Description: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=708131; https://lists.debian.org/debian-lts-announce/2025/04/msg00014.html
CVE: CVE-2025-27836
Published: 2025-03-25
Description: An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=708192; https://lists.debian.org/debian-lts-announce/2025/04/msg00014.html
CVE: CVE-2025-27837
Published: 2025-03-25
Description: An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://bugs.ghostscript.com/show_bug.cgi?id=708238
CVE: CVE-2025-29789
Published: 2025-03-25
Description: OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulnerable to Directory Traversal in the Load Code feature. Version 7.3.0 contains a patch for the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://github.com/openemr/openemr/commit/ef3bb7f84ebe8ef54d55416e587ec2fefd065489; https://github.com/openemr/openemr/security/advisories/GHSA-ffpq-2wqj-v8ff
CVE: CVE-2025-30741
Published: 2025-03-25
Description: Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://fokus.cool/2025/03/25/pixelfed-vulnerability.html; https://github.com/pixelfed/pixelfed/releases/tag/v0.12.5; https://mastodon.social/@pixelfed/[PII_REDACTED]7179498
CVE: CVE-2025-30219
Published: 2025-03-25
Description: RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions
will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-g58g-82mw-9m3p
CVE: CVE-2025-30222
Published: 2025-03-25
Description: Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape.
CWE: CWE-200
References: https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6; https://github.com/ericcornelissen/shescape/pull/1916; https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2
CVE: CVE-2024-47516
Published: 2025-03-26
Description: A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure instance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://access.redhat.com/security/cve/CVE-2024-47516; https://bugzilla.redhat.com/show_bug.cgi?id=2315805
CVE: CVE-2025-2276
Published: 2025-03-26
Description: The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_module_actions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/ultimate-dashboard/tags/3.8.7/modules/feature/class-feature-module.php#L118; https://www.wordfence.com/threat-intel/vulnerabilities/id/ffee6564-2718-4461-b481-cbf0e204a04d?source=cve
CVE: CVE-2025-2302
Published: 2025-03-26
Description: The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aws_search_terms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/advanced-woo-search/tags/3.28/includes/class-aws-shortcodes.php#L175; https://plugins.trac.wordpress.org/browser/advanced-woo-search/tags/3.28/includes/class-aws-shortcodes.php#L50; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8fca84-3ea1-432f-8cfe-9a1d1f70fa6f?source=cve
CVE: CVE-2025-1490
Published: 2025-03-26
Description: The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3271906%40smart-maintenance-mode&new=3271906%40smart-maintenance-mode&sfp_email=&sfph_mail=; https://wordpress.org/plugins/smart-maintenance-mode/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9ca8ac-e735-4e84-af0f-45d22a8e2124?source=cve
CVE: CVE-2025-2165
Published: 2025-03-26
Description: The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sh-email-alert/tags/1.0/manage.php#L156; https://wordpress.org/plugins/sh-email-alert/; https://www.wordfence.com/threat-intel/vulnerabilities/id/dc20180b-4665-4ade-b512-b0f0148200e7?source=cve
CVE: CVE-2025-2573
Published: 2025-03-26
Description: The Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/amazing-service-box-visual-composer-addons/trunk/asb_addon.php#L114; https://plugins.trac.wordpress.org/browser/amazing-service-box-visual-composer-addons/trunk/asb_addon.php#L45; https://wordpress.org/plugins/amazing-service-box-visual-composer-addons/#developers
CVE: CVE-2025-2576
Published: 2025-03-26
Description: The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ayyash-studio/tags/1.0.3/includes/Importer/Wxr/StudioImporter.php#L351; https://plugins.trac.wordpress.org/browser/ayyash-studio/tags/1.0.3/includes/Importer/Wxr/StudioImporter.php#L37; https://wordpress.org/plugins/ayyash-studio/#developers
CVE: CVE-2025-30742
Published: 2025-03-26
Description: httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not have a final '\0' character.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-193
References: https://github.com/pizhenwei/atophttpd/blob/74c9f14796b15dc9de5839a5749202f933937a9c/httpd.c#L376-L381; https://github.com/pizhenwei/atophttpd/blob/74c9f14796b15dc9de5839a5749202f933937a9c/httpd.c#L492-L496; https://github.com/pizhenwei/atophttpd/blob/74c9f14796b15dc9de5839a5749202f933937a9c/httpd.c#L71-L72
CVE: CVE-2024-11847
Published: 2025-03-26
Description: The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f57ecff2-0cff-40c7-b6e4-5b162b847d65/
CVE: CVE-2024-12683
Published: 2025-03-26
Description: The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1569ee00-56c3-4a1b-940e-e0256a748675/
CVE: CVE-2024-13146
Published: 2025-03-26
Description: The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/19cb40dd-53b0-46db-beb0-1841e385ce09/
CVE: CVE-2025-1784
Published: 2025-03-26
Description: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.0/classes/class-uagb-init-blocks.php#L1276; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3243058%40ultimate-addons-for-gutenberg&new=3243058%40ultimate-addons-for-gutenberg&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9ac33fd5-602b-4810-96e1-850ea6ee739d?source=cve
CVE: CVE-2023-52972
Published: 2025-03-26
Description: Huawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks . Successful exploitation this vulnerability could lead to termination of some system processes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://www.huawei.com/en/psirt/security-advisories/2025/huawei-sa-20250325-01-pc-en
CVE: CVE-2024-30155
Published: 2025-03-26
Description: HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1275
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120110
CVE: CVE-2024-13702
Published: 2025-03-26
Description: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSchedulingCalendar' shortcodes in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3256449%40crm-customer-relationship-management-by-vcita&new=3256449%40crm-customer-relationship-management-by-vcita&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d3239b-0f65-46f7-977b-9995542a6eb9?source=cve