deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-47650
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Axton WP-WebAuthn wp-webauthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through <= 1.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-webauthn/vulnerability/wordpress-wp-webauthn-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-9555
Published: 2024-10-06
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. Affected by this issue is the function formSetEasy_Wizard of the file /goform/formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetEasy_Wizard.md; https://vuldb.com/?ctiid.279362; https://vuldb.com/?id.279362
CVE: CVE-2024-9556
Published: 2024-10-06
Description: A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetEnableWizard.md; https://vuldb.com/?ctiid.279363; https://vuldb.com/?id.279363
CVE: CVE-2024-9557
Published: 2024-10-06
Description: A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formSetWanPPPoE of the file /goform/formSetWanPPPoE. The manipulation of the argument webpage leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetWanPPPoE.md; https://vuldb.com/?ctiid.279364; https://vuldb.com/?id.279364
CVE: CVE-2024-9558
Published: 2024-10-06
Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formSetWanPPTP of the file /goform/formSetWanPPTP. The manipulation of the argument webpage leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetWanPPTP.md; https://vuldb.com/?ctiid.279365; https://vuldb.com/?id.279365
CVE: CVE-2024-9559
Published: 2024-10-06
Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formWlanSetup of the file /goform/formWlanSetup. The manipulation of the argument webpage leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formWlanSetup.md; https://vuldb.com/?ctiid.279366; https://vuldb.com/?id.279366
CVE: CVE-2024-9560
Published: 2024-10-06
Description: A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is the function delCatelogs of the file /CDGServer3/document/Catelogs;logindojojs?command=DelCatelogs. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/38f64855-27ec-4170-ac78-f29ca595901e?code=G8A6P3; https://vuldb.com/?ctiid.279368; https://vuldb.com/?id.279368
CVE: CVE-2024-9561
Published: 2024-10-06
Description: A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetWAN_Wizard51/formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetWAN_Wizard.md; https://vuldb.com/?ctiid.279369; https://vuldb.com/?id.279369
CVE: CVE-2024-9562
Published: 2024-10-06
Description: A vulnerability classified as critical was found in D-Link DIR-605L 2.13B01 BETA. This vulnerability affects the function formSetWizard1/formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetWizard.md; https://vuldb.com/?ctiid.279370; https://vuldb.com/?id.279370
CVE: CVE-2024-9563
Published: 2024-10-07
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. This issue affects the function formWlanSetup_Wizard of the file /goform/formWlanSetup_Wizard. The manipulation of the argument webpage leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formWlanSetup_Wizard.md; https://vuldb.com/?ctiid.279371; https://vuldb.com/?id.279371
CVE: CVE-2024-9564
Published: 2024-10-07
Description: A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. Affected is the function formWlanWizardSetup of the file /goform/formWlanWizardSetup. The manipulation of the argument webpage leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formWlanWizardSetup.md; https://vuldb.com/?ctiid.279372; https://vuldb.com/?id.279372
CVE: CVE-2024-9565
Published: 2024-10-07
Description: A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. Affected by this vulnerability is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetPassword.md; https://vuldb.com/?ctiid.279373; https://vuldb.com/?id.279373
CVE: CVE-2024-20090
Published: 2024-10-07
Description: In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09028313; Issue ID: MSV-1703.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20091
Published: 2024-10-07
Description: In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09028313; Issue ID: MSV-1701.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20092
Published: 2024-10-07
Description: In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09028313; Issue ID: MSV-1700.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20093
Published: 2024-10-07
Description: In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09028313; Issue ID: MSV-1699.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20094
Published: 2024-10-07
Description: In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00843282; Issue ID: MSV-1535.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20095
Published: 2024-10-07
Description: In m4u, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08996894; Issue ID: MSV-1636.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20096
Published: 2024-10-07
Description: In m4u, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08996900; Issue ID: MSV-1635.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20097
Published: 2024-10-07
Description: In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09028313; Issue ID: MSV-1630.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20098
Published: 2024-10-07
Description: In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08996886; Issue ID: MSV-1626.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20099
Published: 2024-10-07
Description: In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08997492; Issue ID: MSV-1625.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20100
Published: 2024-10-07
Description: In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998449; Issue ID: MSV-1603.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20101
Published: 2024-10-07
Description: In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998901; Issue ID: MSV-1602.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20102
Published: 2024-10-07
Description: In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998892; Issue ID: MSV-1601.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-20103
Published: 2024-10-07
Description: In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09001358; Issue ID: MSV-1599.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2024
CVE: CVE-2024-47335
Published: 2024-10-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.13.11.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/bit-form/vulnerability/wordpress-bit-form-plugin-2-13-11-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-47344
Published: 2024-10-07
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Stylemix uListing ulisting.This issue affects uListing: from n/a through <= 2.1.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/Wordpress/Plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-1-5-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-21455
Published: 2024-10-07
Description: Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-119
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-23369
Published: 2024-10-07
Description: Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-23370
Published: 2024-10-07
Description: Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-23374
Published: 2024-10-07
Description: Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-23375
Published: 2024-10-07
Description: Memory corruption during the network scan request.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-23376
Published: 2024-10-07
Description: Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-23378
Published: 2024-10-07
Description: Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-23379
Published: 2024-10-07
Description: Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-33049
Published: 2024-10-07
Description: Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-33064
Published: 2024-10-07
Description: Information disclosure while parsing the multiple MBSSID IEs from the beacon.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-33065
Published: 2024-10-07
Description: Memory corruption while taking snapshot when an offset variable is set by camera driver.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-33066
Published: 2024-10-07
Description: Memory corruption while redirecting log file to any file location with any file name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-33069
Published: 2024-10-07
Description: Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-33070
Published: 2024-10-07
Description: Transient DOS while parsing ESP IE from beacon/probe response frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-33071
Published: 2024-10-07
Description: Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-33073
Published: 2024-10-07
Description: Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-38397
Published: 2024-10-07
Description: Transient DOS while parsing probe response and assoc response frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-38399
Published: 2024-10-07
Description: Memory corruption while processing user packets to generate page faults.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-38425
Published: 2024-10-07
Description: Information disclosure while sending implicit broadcast containing APP launch information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
CVE: CVE-2024-42027
Published: 2024-10-07
Description: The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they have the appropriate time and resources.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1391
References: https://hackerone.com/reports/2546437
CVE: CVE-2024-43047
Published: 2024-10-07
Description: Memory corruption while maintaining memory maps of HLOS memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43047
CVE: CVE-2024-45153
Published: 2024-10-07
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-46325
Published: 2024-10-07
Description: TP-Link WR740N V6 has a stack overflow vulnerability via the ssid parameter in /userRpm/popupSiteSurveyRpm.htm url.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TP-LINK/WR740N/popupSiteSurveyRpm.md
CVE: CVE-2024-9566
Published: 2024-10-07
Description: A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. This vulnerability affects the function formDeviceReboot of the file /goform/formDeviceReboot. The manipulation of the argument next_page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formDeviceReboot.md; https://vuldb.com/?ctiid.279460; https://vuldb.com/?id.279460
CVE: CVE-2024-9567
Published: 2024-10-07
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. This issue affects the function formAdvFirewall of the file /goform/formAdvFirewall. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formAdvFirewall.md; https://vuldb.com/?ctiid.279461; https://vuldb.com/?id.279461
CVE: CVE-2023-6361
Published: 2024-10-07
Description: A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow controlling the Structured Exception Handler (SEH) registers. This could allow attackers to execute arbitrary code via a long filename argument.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-winhex
CVE: CVE-2023-6362
Published: 2024-10-07
Description: A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow controlling the Structured Exception Handler (SEH) registers. This could allow attackers to execute arbitrary code via a long filename argument.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-winhex
CVE: CVE-2024-45933
Published: 2024-10-07
Description: OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/post/edit/ endpoint.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: http://TobeReleased.com; https://github.com/AslamMahi/CVE-Aslam-Mahi/blob/main/MobinaJafarian-OnlineNewsSite%20v%201.0/CVE-2024-45933.md