deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-6482
Published: 2024-09-14
Description: The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwp_update_password_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to any other role, including Administrator. The vulnerability was partially patched in version 1.7.40. The login with phone number pro plugin was required to exploit the vulnerability in versions 1.7.40 - 1.7.49.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php#L3803; https://plugins.trac.wordpress.org/changeset/3129185/; https://www.wordfence.com/threat-intel/vulnerabilities/id/de7cde2c-142c-4004-9302-be335265d87d?source=cve
CVE: CVE-2024-8862
Published: 2024-09-14
Description: A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-502
References: https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Command-Execution-via-Panda-df-query-9dc40f0477ee4b65806de7921876c222?pvs=4; https://vuldb.com/?ctiid.277499; https://vuldb.com/?id.277499
CVE: CVE-2024-8863
Published: 2024-09-14
Description: A vulnerability, which was classified as problematic, was found in aimhubio aim up to 3.24. Affected is the function dangerouslySetInnerHTML of the file textbox.tsx of the component Text Explorer. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://rumbling-slice-eb0.notion.site/Stored-XSS-through-TEXT-EXPLORER-in-aimhubio-aim-d0f07b[PII_REDACTED]a673498546d80d43?pvs=4; https://vuldb.com/?ctiid.277500; https://vuldb.com/?id.277500
CVE: CVE-2024-8864
Published: 2024-09-15
Description: A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94
References: https://rumbling-slice-eb0.notion.site/Composio-s-Local-tools-Mathematical-has-a-code-injection-risk-in-composiohq-composio-ea0e89ee10fe4edfb9a8cfeed158c765?pvs=4; https://vuldb.com/?ctiid.277501; https://vuldb.com/?id.277501
CVE: CVE-2024-8865
Published: 2024-09-15
Description: A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\server\api.py. The manipulation of the argument file leads to path traversal. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://rumbling-slice-eb0.notion.site/There-is-an-arbitrary-file-read-vulnerability-at-api-download-in-composiohq-composio-f0ec1ec26a5f434a97bb1ffde435a35b?pvs=4; https://vuldb.com/?ctiid.277502; https://vuldb.com/?id.277502
CVE: CVE-2024-8866
Published: 2024-09-15
Description: A vulnerability was found in AutoCMS 5.4. It has been classified as problematic. This affects an unknown part of the file /admin/robot.php. The manipulation of the argument sidebar leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/Hebing123/cve/issues/68; https://vuldb.com/?ctiid.277503; https://vuldb.com/?id.277503
CVE: CVE-2024-8867
Published: 2024-09-15
Description: A vulnerability was found in Perfex CRM 3.1.6. It has been declared as problematic. This vulnerability affects unknown code of the file application/controllers/Clients.php of the component Parameter Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://bytium.com/stored-cross-site-scripting-xss-vulnerability-in-perfex-crm/; https://vuldb.com/?ctiid.277504; https://vuldb.com/?id.277504
CVE: CVE-2024-8868
Published: 2024-09-15
Description: A vulnerability was found in code-projects Crud Operation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file savedata.php. The manipulation of the argument sname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/ppp-src/a/issues/7; https://vuldb.com/?ctiid.277505
CVE: CVE-2024-44060
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jennifer Hall Filmix allows Reflected XSS.This issue affects Filmix: from n/a through 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/filmix/wordpress-filmix-theme-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44062
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-field-template/wordpress-custom-field-template-plugin-2-6-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44063
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/happyforms/wordpress-happyforms-plugin-1-26-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45455
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-meta-seo/vulnerability/wordpress-wp-meta-seo-plugin-4-5-13-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-45456
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-meta-seo/vulnerability/wordpress-wp-meta-seo-plugin-4-5-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45457
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/spiffy-calendar/vulnerability/wordpress-spiffy-calendar-plugin-4-9-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45458
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/spiffy-calendar/vulnerability/wordpress-spiffy-calendar-plugin-4-9-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45459
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Reflected XSS.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.50.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-products-slider/vulnerability/wordpress-product-slider-for-woocommerce-by-pickplugins-plugin-1-13-50-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45460
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manu225 Flipping Cards flipping-cards allows Stored XSS.This issue affects Flipping Cards: from n/a through <= 1.30.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/flipping-cards/vulnerability/wordpress-flipping-cards-plugin-1-30-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44053
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mohammad Arif Opor Ayam allows Reflected XSS.This issue affects Opor Ayam: from n/a through 1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/opor-ayam/wordpress-opor-ayam-theme-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44054
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Fluida allows Stored XSS.This issue affects Fluida: from n/a through 1.8.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fluida/wordpress-fluida-theme-1-8-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44056
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Mantra allows Stored XSS.This issue affects Mantra: from n/a through 3.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mantra/wordpress-mantra-theme-3-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44057
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Nirvana allows Stored XSS.This issue affects Nirvana: from n/a through 1.6.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/nirvana/wordpress-nirvana-theme-1-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44058
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Parabola allows Stored XSS.This issue affects Parabola: from n/a through 2.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/parabola/wordpress-parabola-theme-2-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44059
Published: 2024-09-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-type-archive-mapping/vulnerability/wordpress-custom-query-blocks-plugin-5-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-8869
Published: 2024-09-15
Description: A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5. Affected is the function exportOvpn. The manipulation leads to os command injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-78
References: https://vuldb.com/?ctiid.277506; https://vuldb.com/?id.277506; https://vuldb.com/?submit.403211
CVE: CVE-2024-46918
Published: 2024-09-15
Description: app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/MISP/MISP/commit/3a5227d7b3d4518ac109af61979a00145a0de6fa; https://github.com/MISP/MISP/compare/v2.4.197...v2.4.198
CVE: CVE-2024-46938
Published: 2024-09-15
Description: An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003408
CVE: CVE-2024-8875
Published: 2024-09-15
Description: A vulnerability classified as critical was found in vedees wcms up to 0.3.2. Affected by this vulnerability is an unknown functionality of the file /wex/finder.php. The manipulation of the argument p leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/acmglz/bug2_report/blob/main/wcms%20has%20arbitrary%20file%20deletion.md; https://vuldb.com/?ctiid.277507; https://vuldb.com/?id.277507
CVE: CVE-2024-8876
Published: 2024-09-15
Description: A vulnerability, which was classified as problematic, has been found in xiaohe4966 TpMeCMS up to 1.3.3.1. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.3.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.277508; https://vuldb.com/?id.277508; https://vuldb.com/?submit.404560
CVE: CVE-2024-46942
Published: 2024-09-15
Description: In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight clustering deployment.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://docs.opendaylight.org/en/latest/release-notes/projects/mdsal.html; https://doi.org/10.48550/arXiv.2408.16940; https://lf-opendaylight.atlassian.net/browse/MDSAL-869
CVE: CVE-2024-46943
Published: 2024-09-15
Description: An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-520
References: https://docs.opendaylight.org/en/latest/release-notes/projects/aaa.html; https://doi.org/10.48550/arXiv.2408.16940; https://lf-opendaylight.atlassian.net/browse/AAA-285
CVE: CVE-2024-8880
Published: 2024-09-16
Description: A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&route=forgot&op=forgot of the component Template Handler. The manipulation of the argument username/email/captcha leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The project maintainer was informed early about the issue. Investigation shows that playSMS up to 1.4.3 contained a fix but later versions re-introduced the flaw. As long as the latest version of the playsms/tpl package is used, the software is not affected. Version >=1.4.4 shall fix this issue for sure.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-94
References: https://vuldb.com/?ctiid.277524; https://vuldb.com/?id.277524; https://vuldb.com/?submit.406095
CVE: CVE-2024-46958
Published: 2024-09-16
Description: In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/nextcloud/desktop/compare/v3.13.3...v3.13.4; https://github.com/nextcloud/desktop/issues/6863; https://github.com/nextcloud/desktop/pull/6949
CVE: CVE-2024-8776
Published: 2024-09-16
Description: SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript code to the parameter for Reflected Cross-site Scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-8070-d10bc-2.html; https://www.twcert.org.tw/tw/cp-132-8069-73393-1.html
CVE: CVE-2024-8777
Published: 2024-09-16
Description: OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations. If LDAP authentication is enabled, attackers can obtain plaintext credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-522
References: https://www.twcert.org.tw/en/cp-139-8072-928a5-2.html; https://www.twcert.org.tw/tw/cp-132-8071-46589-1.html
CVE: CVE-2024-8778
Published: 2024-09-16
Description: OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36, CWE-22
References: https://www.twcert.org.tw/en/cp-139-8074-66457-2.html; https://www.twcert.org.tw/tw/cp-132-8073-ff771-1.html
CVE: CVE-2024-8779
Published: 2024-09-16
Description: OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privileges to update system settings or create accounts with administrator privileges, thereby gaining control of the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://www.twcert.org.tw/en/cp-139-8076-6ade0-2.html; https://www.twcert.org.tw/tw/cp-132-8075-a0d06-1.html
CVE: CVE-2024-8780
Published: 2024-09-16
Description: OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regular privileges to obtain accounts and password hashes of other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.twcert.org.tw/en/cp-139-8078-36fc9-2.html; https://www.twcert.org.tw/tw/cp-132-8077-7a7c0-1.html
CVE: CVE-2024-1578
Published: 2024-09-16
Description: The MiCard PLUS Ci and MiCard PLUS BLE reader products developed by rf IDEAS and rebranded by NT-ware have a firmware fault that may result in characters randomly being dropped from some ID card reads, which would result in the wrong ID card number being assigned during ID card self-registration and might result in failed login attempts for end-users. Random characters being dropped from ID card numbers compromises the uniqueness of ID cards that can, therefore, result in a security issue if the users are using the ‘ID card self-registration’ function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1287
References: https://ntware.atlassian.net/wiki/spaces/SA/pages/[PII_REDACTED]/2024+Security+Advisory+Multiple+MiCard+PLUS+card+reader+dropped+characters; https://www.canon-europe.com/psirt/advisory-information
CVE: CVE-2024-39613
Published: 2024-09-16
Description: Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file,  which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://mattermost.com/security-updates
CVE: CVE-2024-45694
Published: 2024-09-16
Description: The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://www.twcert.org.tw/en/cp-139-8081-3fb39-2.html; https://www.twcert.org.tw/tw/cp-132-8080-7f494-1.html
CVE: CVE-2024-45695
Published: 2024-09-16
Description: The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.twcert.org.tw/en/cp-139-8083-a299e-2.html; https://www.twcert.org.tw/tw/cp-132-8082-f1687-1.html
CVE: CVE-2024-45696
Published: 2024-09-16
Description: Certain models of D-Link wireless routers contain hidden functionality. By sending specific packets to the web service, the attacker can forcibly enable the telnet service and log in using hard-coded credentials. The telnet service enabled through this method can only be accessed from within the same local network as the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-912
References: https://www.twcert.org.tw/en/cp-139-8087-c3e70-2.html; https://www.twcert.org.tw/tw/cp-132-8086-93ed5-1.html
CVE: CVE-2024-45697
Published: 2024-09-16
Description: Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote attackers can log in and execute OS commands using hard-coded credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-912
References: https://www.twcert.org.tw/en/cp-139-8089-32df6-2.html; https://www.twcert.org.tw/tw/cp-132-8088-590ed-1.html
CVE: CVE-2024-45698
Published: 2024-09-16
Description: Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-coded credentials to log into telnet and inject arbitrary OS commands, which can then be executed on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-798
References: https://www.twcert.org.tw/en/cp-139-8091-bcd52-2.html; https://www.twcert.org.tw/tw/cp-132-8090-bf06b-1.html
CVE: CVE-2024-45833
Published: 2024-09-16
Description: Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Swiftkey as the default keyboard, the masking is off and the password contains a special character..
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-693
References: https://mattermost.com/security-updates