deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5173
Published: 2024-06-26
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.5.3/includes/widgets/htmega_videoplayer.php#L549; https://www.wordfence.com/threat-intel/vulnerabilities/id/aac9569e-d33d-45b3-bd03-2e7f48536ae5?source=cve; https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.5.3/includes/widgets/htmega_videoplayer.php#L549
CVE: CVE-2024-28973
Published: 2024-06-26
Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a high privileged victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-29173
Published: 2024-06-26
Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Server-Side Request Forgery (SSRF) vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to disclosure of information on the application or remote client.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-29174
Published: 2024-06-26
Description: Dell Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.30, LTS 7.10.1.20 contain an SQL Injection vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing unauthorized access to application data.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-89
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-29175
Published: 2024-06-26
Description: Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to man-in-the-middle attack that exposes sensitive session information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-29176
Published: 2024-06-26
Description: Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-29177
Published: 2024-06-26
Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a disclosure of temporary sensitive information vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the reuse of disclosed information to gain unauthorized access to the application report.
CVSS Score: 2.7 (LOW)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-5181
Published: 2024-06-26
Description: A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by manipulating the path of the vulnerable binary file specified in the backend parameter, allowing the execution of arbitrary code on the system. This issue is due to improper neutralization of special elements used in an OS command, leading to potential full control over the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e; https://huntr.com/bounties/c6e3cb58-6fa4-4207-bb92-ae[PII_REDACTED]; https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e
CVE: CVE-2024-27867
Published: 2024-06-26
Description: An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/en-us/120907; http://seclists.org/fulldisclosure/2024/Jul/2; https://support.apple.com/en-us/HT214111
CVE: CVE-2024-37138
Published: 2024-06-26
Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the application sending over an unauthorized file to the managed system.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-23
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-37139
Published: 2024-06-26
Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through its Lifetime vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to temporary resource constraint of system application. Exploitation may lead to denial of service of the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-664
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-37140
Published: 2024-06-26
Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the system application's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-37141
Published: 2024-06-26
Description: Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to information disclosure.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2024-21520
Published: 2024-06-26
Description: Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/encode/django-rest-framework/commit/3b41f[PII_REDACTED]da957b119712978fa2266b642; https://github.com/encode/django-rest-framework/pull/9435; https://security.snyk.io/vuln/SNYK-PYTHON-DJANGORESTFRAMEWORK-7252137
CVE: CVE-2024-34580
Published: 2024-06-26
Description: Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload in a KeyInfo element. NOTE: the project disputes this CVE Record on the grounds that any vulnerabilities are the result of a failure to configure XML Security for C++ securely. Even when avoiding this particular issue, any use of this library would need considerable additional code and a deep understanding of the standards and protocols involved to arrive at a secure implementation for any particular use case. We recommend against continued direct use of this library.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://cloud.google.com/blog/topics/threat-intelligence/apache-library-allows-server-side-request-forgery; https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2024-21893.md; https://lists.apache.org/thread/po2gocnw4gtf4boy5mmjb54g62qhbrl9
CVE: CVE-2024-34581
Published: 2024-06-26
Description: The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is a URI ... that may be used to obtain key and/or certificate information" statement and no accompanying information about SSRF risks, and this may have contributed to vulnerable implementations such as those discussed in CVE-2023-36661 and CVE-2024-21893. NOTE: this was mitigated in 1.1 and 2.0 via a directly referenced Best Practices document that calls on implementers to be wary of SSRF.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918
References: https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2024-21893.md; https://www.w3.org/Signature/Drafts/WD-xmldsig-core-200003plc/; https://www.w3.org/TR/2013/NOTE-xmldsig-bestpractices-20130411/
CVE: CVE-2024-36802
Published: 2024-06-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-3633
Published: 2024-06-26
Description: The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2e0baffb-7ab8-4c17-aa2a-7f28a0be1a41/; https://wpscan.com/vulnerability/2e0baffb-7ab8-4c17-aa2a-7f28a0be1a41/
CVE: CVE-2024-4105
Published: 2024-06-26
Description: A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC.
The affected products and versions are as follows:
FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
CI Server R1.01.00 to R1.03.00
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf; https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf
CVE: CVE-2024-4106
Published: 2024-06-26
Description: A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product.
The affected products and versions are as follows:
FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
CI Server R1.01.00 to R1.03.00
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-258
References: https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf; https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf
CVE: CVE-2024-4758
Published: 2024-06-26
Description: The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
CVSS Score: 7.6 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/64ec57a5-35d8-4c69-bdba-096c2245a0db/; https://wpscan.com/vulnerability/64ec57a5-35d8-4c69-bdba-096c2245a0db/
CVE: CVE-2024-4957
Published: 2024-06-26
Description: The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0a560ed4-7dec-4274-b4a4-39dea0c0d67e/; https://wpscan.com/vulnerability/0a560ed4-7dec-4274-b4a4-39dea0c0d67e/
CVE: CVE-2024-4959
Published: 2024-06-26
Description: The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/449e4da8-beae-4ff6-9ddc-0e17781c0391/; https://wpscan.com/vulnerability/449e4da8-beae-4ff6-9ddc-0e17781c0391/
CVE: CVE-2024-5071
Published: 2024-06-26
Description: The Bookster  WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulate the data sent when booking an appointment (the request body) to change its status from pending to approved.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://wpscan.com/vulnerability/07b293cf-5174-45de-8606-a782a96a35b3/; https://wpscan.com/vulnerability/07b293cf-5174-45de-8606-a782a96a35b3/
CVE: CVE-2024-5169
Published: 2024-06-26
Description: The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f0de62e3-5e85-43f3-8e3e-e816dafb1406/; https://wpscan.com/vulnerability/f0de62e3-5e85-43f3-8e3e-e816dafb1406/
CVE: CVE-2024-5199
Published: 2024-06-26
Description: The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/a2cb8d7d-6d7c-42e9-b3db-cb3959bfd41b/; https://wpscan.com/vulnerability/a2cb8d7d-6d7c-42e9-b3db-cb3959bfd41b/
CVE: CVE-2024-5332
Published: 2024-06-26
Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3103786/exclusive-addons-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c547cc-2820-4138-b042-a0ec2e7f2fca?source=cve; https://plugins.trac.wordpress.org/changeset/3103786/exclusive-addons-for-elementor
CVE: CVE-2024-5473
Published: 2024-06-26
Description: The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9c70cfc4-5759-469a-a6a3-510c405bd28a/; https://wpscan.com/vulnerability/9c70cfc4-5759-469a-a6a3-510c405bd28a/
CVE: CVE-2024-5573
Published: 2024-06-26
Description: The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3b01044b-355f-40d3-8e11-23a890f98c76/; https://wpscan.com/vulnerability/3b01044b-355f-40d3-8e11-23a890f98c76/
CVE: CVE-2024-5215
Published: 2024-06-26
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/trunk/includes/widgets/htmega_user_login_form.php#L1961; https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/trunk/includes/widgets/htmega_user_register_form.php#L2910; https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/trunk/includes/widgets/htmega_videoplayer.php#L520
CVE: CVE-2024-28830
Published: 2024-06-26
Description: Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p7, <2.2.0p28, <2.1.0p45 and <=2.0.0p39 (EOL) causes automation user secrets to be written to audit log files accessible to administrators.
CVSS Score: 2.7 (LOW)
CWE: CWE-532, CWE-532
References: https://checkmk.com/werk/17056; https://checkmk.com/werk/17056
CVE: CVE-2024-37098
Published: 2024-06-26
Description: Server-Side Request Forgery (SSRF) vulnerability in Blossom Themes BlossomThemes Email Newsletter.This issue affects BlossomThemes Email Newsletter: from n/a through 2.2.6.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/blossomthemes-email-newsletter/wordpress-blossomthemes-email-newsletter-plugin-2-2-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/blossomthemes-email-newsletter/wordpress-blossomthemes-email-newsletter-plugin-2-2-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-37252
Published: 2024-06-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Icegram Email Subscribers & Newsletters allows SQL Injection.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.25.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/email-subscribers/wordpress-email-subscribers-by-icegram-express-plugin-5-7-25-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/email-subscribers/wordpress-email-subscribers-by-icegram-express-plugin-5-7-25-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-6344
Published: 2024-06-26
Description: A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Configuration Section. The manipulation of the argument Configuration Name leads to cross site scripting. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component. The vendor explains, that "[s]ince ZKBio CVSecurity v5000 has been withdrawn from the market, we recommend upgrading to ZKBio CVSecurity V6600 6.1.3_R or above". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.269733; https://vuldb.com/?id.269733; https://vuldb.com/?submit.358596
CVE: CVE-2024-4228
Published: 2024-06-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWE - 522 - Insufficiently Protected Credentials vulnerability in Magarsus Consultancy SSO (Single Sign On) allows SQL Injection.This issue affects SSO (Single Sign On): from 1.0 before 1.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-0800; https://www.usom.gov.tr/bildirim/tr-24-0800
CVE: CVE-2024-4604
Published: 2024-06-26
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magarsus Consultancy SSO (Single Sign On) allows Manipulating Hidden Fields.This issue affects SSO (Single Sign On): from 1.0 before 1.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.usom.gov.tr/bildirim/tr-24-0800; https://www.usom.gov.tr/bildirim/tr-24-0800
CVE: CVE-2024-6349
Published: 2024-06-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.