deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-36964
Published: 2024-06-03
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/9p: only translate RWX permissions for plain 9P2000

Garbage in plain 9P2000's perm bits is allowed through, which causes it
to be able to set (among others) the suid bit. This was presumably not
the intent since the unix extended bits are handled explicitly and
conditionally on .u.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/157d468e34fdd3cb1ddc07c2be32fb3b02826b02; https://git.kernel.org/stable/c/5a605930e19f451294bd838754f7d66c976a8a2c; https://git.kernel.org/stable/c/ad4f[PII_REDACTED]2de74e3608bb736fedf3b67e32
CVE: CVE-2024-35637
Published: 2024-06-03
Description: Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-4-3-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-4-3-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-35638
Published: 2024-06-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in JumpDEMAND Inc. ActiveDEMAND.This issue affects ActiveDEMAND: from n/a through 0.2.43.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/activedemand/wordpress-activedemand-plugin-0-2-43-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/activedemand/wordpress-activedemand-plugin-0-2-43-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-35639
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler.This issue affects Simple Spoiler: from n/a through <= 1.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-spoiler/vulnerability/wordpress-simple-spoiler-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-spoiler/wordpress-simple-spoiler-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-5404
Published: 2024-06-03
Description: An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://cert.vde.com/en/advisories/VDE-2024-028; https://cert.vde.com/en/advisories/VDE-2024-028
CVE: CVE-2023-43537
Published: 2024-06-03
Description: Information disclosure while handling T2LM Action Frame in WLAN Host.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2023-43538
Published: 2024-06-03
Description: Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2023-43542
Published: 2024-06-03
Description: Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2023-43543
Published: 2024-06-03
Description: Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2023-43544
Published: 2024-06-03
Description: Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2023-43545
Published: 2024-06-03
Description: Memory corruption when more scan frequency list or channels are sent from the user space.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2023-43551
Published: 2024-06-03
Description: Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2023-43555
Published: 2024-06-03
Description: Information disclosure in Video while parsing mp2 clip with invalid section length.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2023-43556
Published: 2024-06-03
Description: Memory corruption in Hypervisor when platform information mentioned is not aligned.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2024-21478
Published: 2024-06-03
Description: transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-704, CWE-476
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2024-23360
Published: 2024-06-03
Description: Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2024-23363
Published: 2024-06-03
Description: Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html; https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html
CVE: CVE-2024-23664
Published: 2024-06-03
Description: A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow an attacker to to redirect users to an arbitrary website via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-465; https://fortiguard.fortinet.com/psirt/FG-IR-23-465
CVE: CVE-2024-23665
Published: 2024-06-03
Description: Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3 and below, version 6.3.23 and below may allow an authenticated attacker to perform unauthorized ADOM operations via crafted requests.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-285
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-474; https://fortiguard.fortinet.com/psirt/FG-IR-23-474
CVE: CVE-2024-23667
Published: 2024-06-03
Description: An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-285
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-222; https://fortiguard.fortinet.com/psirt/FG-IR-23-222
CVE: CVE-2024-23668
Published: 2024-06-03
Description: An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-222; https://fortiguard.fortinet.com/psirt/FG-IR-23-222
CVE: CVE-2024-23670
Published: 2024-06-03
Description: An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-285
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-222; https://fortiguard.fortinet.com/psirt/FG-IR-23-222
CVE: CVE-2024-35633
Published: 2024-06-03
Description: Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/blocksy-companion/vulnerability/wordpress-blocksy-companion-plugin-2-0-42-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/blocksy-companion/wordpress-blocksy-companion-plugin-2-0-42-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-35635
Published: 2024-06-03
Description: Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/ninja-tables/wordpress-ninja-tables-plugin-5-0-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ninja-tables/wordpress-ninja-tables-plugin-5-0-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-3829
Published: 2024-06-03
Description: qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the filesystem and arbitrary file write by including a symlink and a payload file in the snapshot's directory structure. This vulnerability allows for the reading and writing of arbitrary files on the server, which could potentially lead to a full takeover of the system. The issue is fixed in version v1.9.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-59
References: https://github.com/qdrant/qdrant/commit/ee7a31ec3459a6a[PII_REDACTED]615c1817ab82260; https://huntr.com/bounties/abd9c906-75ee-4d84-b76d-ce1386401e08; https://github.com/qdrant/qdrant/commit/ee7a31ec3459a6a[PII_REDACTED]615c1817ab82260
CVE: CVE-2024-34754
Published: 2024-06-03
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Contact Form Widget.This issue affects Contact Form Widget: from n/a through 1.3.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/new-contact-form-widget/wordpress-contact-form-widget-plugin-1-3-9-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/new-contact-form-widget/wordpress-contact-form-widget-plugin-1-3-9-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-34789
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Hait Post Grid Elementor Addon allows Stored XSS.This issue affects Post Grid Elementor Addon: from n/a through 2.0.16.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/post-grid-elementor-addon/wordpress-post-grid-elementor-addon-plugin-2-0-16-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/post-grid-elementor-addon/wordpress-post-grid-elementor-addon-plugin-2-0-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34790
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hans van Eijsden,niwreg ImageMagick Sharpen Resized Images allows Stored XSS.This issue affects ImageMagick Sharpen Resized Images: from n/a through 1.1.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/imagemagick-sharpen-resized-images/wordpress-download-imagemagick-sharpen-resized-images-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/imagemagick-sharpen-resized-images/wordpress-download-imagemagick-sharpen-resized-images-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34791
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpbean WPB Elementor Addons allows Stored XSS.This issue affects WPB Elementor Addons: from n/a through 1.0.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpb-elementor-addons/wordpress-wpb-elementor-addons-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpb-elementor-addons/wordpress-wpb-elementor-addons-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34793
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kharim Tomlinson WP Next Post Navi allows Stored XSS.This issue affects WP Next Post Navi: from n/a through 1.8.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-next-post-navi/wordpress-wp-next-post-navi-plugin-1-8-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-next-post-navi/wordpress-wp-next-post-navi-plugin-1-8-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34794
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through <= 0.21.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tainacan/vulnerability/wordpress-tainacan-plugin-0-21-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tainacan/wordpress-tainacan-plugin-0-21-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34795
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through <= 0.21.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tainacan/vulnerability/wordpress-tainacan-plugin-0-21-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/tainacan/wordpress-tainacan-plugin-0-21-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-34796
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects PopupAlly: from n/a through 2.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/popupally/wordpress-popupally-plugin-2-1-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/popupally/wordpress-popupally-plugin-2-1-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-34797
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Benoit Mercusot Simple Popup Manager allows Stored XSS.This issue affects Simple Popup Manager: from n/a through 1.3.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-popup-manager/wordpress-simple-popup-manager-plugin-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-popup-manager/wordpress-simple-popup-manager-plugin-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34798
Published: 2024-06-03
Description: Insertion of Sensitive Information into Log File vulnerability in Lukman Nakib Debug Log – Manger Tool.This issue affects Debug Log – Manger Tool: from n/a through 1.4.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/debug-log-config-tool/wordpress-debug-log-manger-tool-plugin-1-4-5-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/debug-log-config-tool/wordpress-debug-log-manger-tool-plugin-1-4-5-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-34801
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mervin Praison Praison SEO WordPress seo-wordpress allows DOM-Based XSS.This issue affects Praison SEO WordPress: from n/a through <= 4.0.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/seo-wordpress/vulnerability/wordpress-praison-seo-wordpress-plugin-4-0-15-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seo-wordpress/wordpress-praison-seo-wordpress-plugin-4-0-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34803
Published: 2024-06-03
Description: Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/fastly/wordpress-fastly-plugin-1-2-25-broken-access-control-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/fastly/wordpress-fastly-plugin-1-2-25-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2024-35630
Published: 2024-06-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LJ Apps WP TripAdvisor Review Slider allows Blind SQL Injection.This issue affects WP TripAdvisor Review Slider: from n/a through 12.6.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wp-tripadvisor-review-slider/wordpress-wp-tripadvisor-review-slider-plugin-12-6-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-tripadvisor-review-slider/wordpress-wp-tripadvisor-review-slider-plugin-12-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-35631
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.45.7212.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-45-7212-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-45-7212-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34385
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Wishlist yith-woocommerce-wishlist.This issue affects YITH WooCommerce Wishlist: from n/a through <= 3.32.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/yith-woocommerce-wishlist/vulnerability/wordpress-yith-woocommerce-wishlist-plugin-3-32-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yith-woocommerce-wishlist/wordpress-yith-woocommerce-wishlist-plugin-3-32-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34764
Published: 2024-06-03
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Collision with another CVE ID.
CVE: CVE-2024-34766
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic ChaosTheory allows Stored XSS.This issue affects ChaosTheory: from n/a through 1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/chaostheory/wordpress-chaostheory-theme-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chaostheory/wordpress-chaostheory-theme-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34767
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes ShopLentor allows Stored XSS.This issue affects ShopLentor: from n/a through 2.8.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woolentor-addons/wordpress-shoplentor-plugin-2-8-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woolentor-addons/wordpress-shoplentor-plugin-2-8-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34769
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in cyclonetheme Elegant Blocks allows Stored XSS.This issue affects Elegant Blocks: from n/a through 1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/elegant-blocks/wordpress-elegant-blocks-amazing-gutenberg-blocks-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/elegant-blocks/wordpress-elegant-blocks-amazing-gutenberg-blocks-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34770
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Popup Maker Popup Maker WP popup-maker-wp allows Stored XSS.This issue affects Popup Maker WP: from n/a through <= 1.3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/popup-maker-wp/vulnerability/wordpress-popup-maker-wp-plugin-1-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/popup-maker-wp/wordpress-popup-maker-wp-plugin-1-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve