deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-35212
Published: 2024-06-11
Description: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application lacks input validation due to which an attacker can gain access to the Database entries.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-196737.html; https://cert-portal.siemens.com/productcert/html/ssa-196737.html
CVE: CVE-2024-35292
Published: 2024-06-11
Description: A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA1) (All versions), SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA1) (All versions), SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA1) (All versions), SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA1) (All versions), SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA0) (All versions), SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA1) (All versions), SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA0) (All versions), SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA1) (All versions), SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA0) (All versions), SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA1) (All versions), SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA0) (All versions), SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA1) (All versions). Affected devices are using a predictable IP ID sequence number. This leaves the system susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack and eventually could allow an attacker to create a denial of service condition.
CVSS Score: 8.2 (HIGH)
CWE: CWE-330
References: https://cert-portal.siemens.com/productcert/html/ssa-481506.html; https://cert-portal.siemens.com/productcert/html/ssa-481506.html
CVE: CVE-2024-35303
Published: 2024-06-11
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant Simulation V2404 (All versions < V2404.0001). The affected applications contain a type confusion vulnerability while parsing specially crafted MODEL files. This could allow an attacker to execute code in the context of the current process.  (ZDI-CAN-22958)
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: https://cert-portal.siemens.com/productcert/html/ssa-900277.html; https://cert-portal.siemens.com/productcert/html/ssa-900277.html
CVE: CVE-2024-36266
Published: 2024-06-11
Description: A vulnerability has been identified in PowerSys (All versions < V3.11). The affected application insufficiently protects responses to authentication requests. This could allow a local attacker to bypass authentication, thereby gaining administrative privileges for the managed remote devices.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-287
References: https://cert-portal.siemens.com/productcert/html/ssa-024584.html; https://cert-portal.siemens.com/productcert/html/ssa-024584.html
CVE: CVE-2024-2461
Published: 2024-06-11
Description: If exploited an attacker could traverse the file system to access 
files or directories that would otherwise be inaccessible
CWE: CWE-23
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000202&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000202&languageCode=en&Preview=true
CVE: CVE-2024-2462
Published: 2024-06-11
Description: Allow attackers to intercept or falsify data exchanges between the client 
and the server
CWE: CWE-297
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000198&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000198&languageCode=en&Preview=true
CVE: CVE-2024-5687
Published: 2024-06-11
Description: If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the `Referer` and `Sec-*` headers, meaning there is the potential for incorrect security checks within the browser in addition to incorrect or misleading information sent to remote websites.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 127.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1889066; https://www.mozilla.org/security/advisories/mfsa2024-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1889066
CVE: CVE-2024-5688
Published: 2024-06-11
Description: If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1895086; https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html
CVE: CVE-2024-5689
Published: 2024-06-11
Description: In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and direct the user to a replica Firefox Screenshots page that could be used for phishing. This vulnerability affects Firefox < 127.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1389707; https://www.mozilla.org/security/advisories/mfsa2024-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1389707
CVE: CVE-2024-5690
Published: 2024-06-11
Description: By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1883693; https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html
CVE: CVE-2024-5691
Published: 2024-06-11
Description: By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-693
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1888695; https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html
CVE: CVE-2024-5692
Published: 2024-06-11
Description: On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an invalid character in the extension. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1891234; https://www.mozilla.org/security/advisories/mfsa2024-25/; https://www.mozilla.org/security/advisories/mfsa2024-26/
CVE: CVE-2024-5693
Published: 2024-06-11
Description: Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-829
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1891319; https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html
CVE: CVE-2024-5694
Published: 2024-06-11
Description: An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vulnerability affects Firefox < 127.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1895055; https://www.mozilla.org/security/advisories/mfsa2024-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1895055
CVE: CVE-2024-5695
Published: 2024-06-11
Description: If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in rarer situations, memory corruption could have occurred. This vulnerability affects Firefox < 127.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1895579; https://www.mozilla.org/security/advisories/mfsa2024-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1895579
CVE: CVE-2024-5696
Published: 2024-06-11
Description: By manipulating the text in an `&lt;input&gt;` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1896555; https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html
CVE: CVE-2024-5697
Published: 2024-06-11
Description: A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. This vulnerability affects Firefox < 127.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1414937; https://www.mozilla.org/security/advisories/mfsa2024-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1414937
CVE: CVE-2024-5698
Published: 2024-06-11
Description: By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 127.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021, CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1828259; https://www.mozilla.org/security/advisories/mfsa2024-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1828259
CVE: CVE-2024-5699
Published: 2024-06-11
Description: In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This vulnerability affects Firefox < 127.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-178
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1891349; https://www.mozilla.org/security/advisories/mfsa2024-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1891349
CVE: CVE-2024-5700
Published: 2024-06-11
Description: Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS Score: 7.0 (HIGH)
CWE: CWE-786, CWE-788
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1862809%2C1889355%2C1893388%2C1895123; https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html
CVE: CVE-2024-5701
Published: 2024-06-11
Description: Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1890909%2C1891422%2C1893915%2C1894047%2C1896024; https://www.mozilla.org/security/advisories/mfsa2024-25/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1890909%2C1891422%2C1893915%2C1894047%2C1896024
CVE: CVE-2024-5702
Published: 2024-06-11
Description: Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1193389; https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html
CVE: CVE-2023-52183
Published: 2024-06-11
Description: Missing Authorization vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-migration-duplicator/wordpress-wordpress-backup-migration-plugin-1-4-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-migration-duplicator/wordpress-wordpress-backup-migration-plugin-1-4-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-28021
Published: 2024-06-11
Description: A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message 
queueing mechanism’s certificate validation. If exploited an attacker could spoof a trusted entity causing a loss of confidentiality 
and integrity.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true
CVE: CVE-2024-28023
Published: 2024-06-11
Description: A vulnerability exists in the message queueing mechanism that if 
exploited can lead to the exposure of resources or functionality to 
unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-259
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true
CVE: CVE-2024-2011
Published: 2024-06-11
Description: A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that
if exploited will generally lead to a denial of service but can be used 
to execute arbitrary code, which is usually outside the scope of a
program's implicit security policy
CVSS Score: 8.6 (HIGH)
CWE: CWE-122, CWE-787
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true
CVE: CVE-2024-2012
Published: 2024-06-11
Description: vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or 
code to be executed on the UNEM server allowing sensitive data to 
be read or modified or could cause other unintended behavior
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-288
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true
CVE: CVE-2024-2013
Published: 2024-06-11
Description: An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server /
API Gateway component that if exploited allows attackers without 
any access to interact with the services and the post-authentication 
attack surface.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true
CVE: CVE-2024-34442
Published: 2024-06-11
Description: Missing Authorization vulnerability in weDevs weDocs.This issue affects weDocs: from n/a through 2.1.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wedocs/wordpress-wedocs-plugin-2-1-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wedocs/wordpress-wedocs-plugin-2-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35671
Published: 2024-06-11
Description: Missing Authorization vulnerability in Minoji MJ Update History.This issue affects MJ Update History: from n/a through 1.0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/mj-update-history/wordpress-mj-update-history-plugin-1-0-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mj-update-history/wordpress-mj-update-history-plugin-1-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35683
Published: 2024-06-11
Description: Missing Authorization vulnerability in Teplitsa of social technologies Leyka.This issue affects Leyka: from n/a through 3.31.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/leyka/wordpress-leyka-plugin-3-31-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/leyka/wordpress-leyka-plugin-3-31-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-5189
Published: 2024-06-11
Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_js’ parameter in all versions up to, and including, 5.9.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/5.9.21/includes/Classes/Asset_Builder.php#L264; https://plugins.trac.wordpress.org/changeset/3099937/; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa70238b-530e-4c90-82f4-c3113887d0e1?source=cve
CVE: CVE-2023-23775
Published: 2024-06-11
Description: Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerabilities [CWE-89] in FortiSOAR 7.2.0 and before 7.0.3 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://fortiguard.com/psirt/FG-IR-22-448; https://fortiguard.com/psirt/FG-IR-22-448
CVE: CVE-2023-46720
Published: 2024-06-11
Description: A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-356; https://fortiguard.fortinet.com/psirt/FG-IR-23-356
CVE: CVE-2023-51498
Published: 2024-06-11
Description: Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-shipping-canada-post/wordpress-woocommerce-canada-post-shipping-plugin-2-8-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-shipping-canada-post/wordpress-woocommerce-canada-post-shipping-plugin-2-8-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-52199
Published: 2024-06-11
Description: Missing Authorization vulnerability in Matthias Pfefferle & Automattic ActivityPub.This issue affects ActivityPub: from n/a through 1.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/activitypub/wordpress-activitypub-plugin-1-0-5-unauthenticated-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/activitypub/wordpress-activitypub-plugin-1-0-5-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-21754
Published: 2024-06-11
Description: A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.
CVSS Score: 1.8 (LOW)
CWE: CWE-916
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-423; https://fortiguard.fortinet.com/psirt/FG-IR-23-423
CVE: CVE-2024-23110
Published: 2024-06-11
Description: A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://fortiguard.com/psirt/FG-IR-23-460; https://fortiguard.com/psirt/FG-IR-23-460
CVE: CVE-2024-23111
Published: 2024-06-11
Description: An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-471; https://fortiguard.fortinet.com/psirt/FG-IR-23-471
CVE: CVE-2024-24703
Published: 2024-06-11
Description: Missing Authorization vulnerability in MultiVendorX WC Marketplace.This issue affects WC Marketplace: from n/a through 4.0.25.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/dc-woocommerce-multi-vendor/wordpress-multivendorx-plugin-4-1-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dc-woocommerce-multi-vendor/wordpress-multivendorx-plugin-4-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-26010
Published: 2024-06-11
Description: A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, FortiAuthenticator, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.1 through 7.0.3, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specially crafted packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-036; https://fortiguard.fortinet.com/psirt/FG-IR-24-036