deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-50075
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

xhci: tegra: fix checked USB2 port number

If USB virtualizatoin is enabled, USB2 ports are shared between all
Virtual Functions. The USB2 port number owned by an USB2 root hub in
a Virtual Function may be less than total USB2 phy number supported
by the Tegra XUSB controller.

Using total USB2 phy number as port number to check all PORTSC values
would cause invalid memory access.

[  116.923438] Unable to handle kernel paging request at virtual address 006c622f7665642f
...
[  117.213640] Call trace:
[  117.216783]  tegra_xusb_enter_elpg+0x23c/0x658
[  117.222021]  tegra_xusb_runtime_suspend+0x40/0x68
[  117.227260]  pm_generic_runtime_suspend+0x30/0x50
[  117.232847]  __rpm_callback+0x84/0x3c0
[  117.237038]  rpm_suspend+0x2dc/0x740
[  117.241229] pm_runtime_work+0xa0/0xb8
[  117.245769]  process_scheduled_works+0x24c/0x478
[  117.251007]  worker_thread+0x23c/0x328
[  117.255547]  kthread+0x104/0x1b0
[  117.259389]  ret_from_fork+0x10/0x20
[  117.263582] Code: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/7d381137cb6ecf558ef6698c7730ddd482d4c8f2; https://git.kernel.org/stable/c/9c696bf4ab54c7cec[PII_REDACTED]4305f0ceeac0a; https://git.kernel.org/stable/c/c46555f14b71f95a447f5d49fc3f1f80a1472da2
CVE: CVE-2024-50076
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

vt: prevent kernel-infoleak in con_font_get()

font.data may not initialize all memory spaces depending on the implementation
of vc->vc_sw->con_font_get. This may cause info-leak, so to prevent this, it
is safest to modify it to initialize the allocated memory space to 0, and it
generally does not affect the overall performance of the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-909
References: https://git.kernel.org/stable/c/1e5a17dc77d8a8bbe67040b32e2ef755901aba44; https://git.kernel.org/stable/c/23c4cb8a56978e5b1baa171d42e616e316c2039d; https://git.kernel.org/stable/c/adb1f312f38f0d2c928ceaff089262798cc260b4
CVE: CVE-2024-50077
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix multiple init when debugfs is disabled

If bt_debugfs is not created successfully, which happens if either
CONFIG_DEBUG_FS or CONFIG_DEBUG_FS_ALLOW_ALL is unset, then iso_init()
returns early and does not set iso_inited to true. This means that a
subsequent call to iso_init() will result in duplicate calls to
proto_register(), bt_sock_register(), etc.

With CONFIG_LIST_HARDENED and CONFIG_BUG_ON_DATA_CORRUPTION enabled, the
duplicate call to proto_register() triggers this BUG():

  list_add double add: new=ffffffffc0b280d0, prev=ffffffffbab56250,
    next=ffffffffc0b280d0.
  ------------[ cut here ]------------
  kernel BUG at lib/list_debug.c:35!
  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
  CPU: 2 PID: 887 Comm: bluetoothd Not tainted 6.10.11-1-ao-desktop #1
  RIP: 0010:__list_add_valid_or_report+0x9a/0xa0
  ...
    __list_add_valid_or_report+0x9a/0xa0
    proto_register+0x2b5/0x340
    iso_init+0x23/0x150 [bluetooth]
    set_iso_socket_func+0x68/0x1b0 [bluetooth]
    kmem_cache_free+0x308/0x330
    hci_sock_sendmsg+0x990/0x9e0 [bluetooth]
    __sock_sendmsg+0x7b/0x80
    sock_write_iter+0x9a/0x110
    do_iter_readv_writev+0x11d/0x220
    vfs_writev+0x180/0x3e0
    do_writev+0xca/0x100
  ...

This change removes the early return. The check for iso_debugfs being
NULL was unnecessary, it is always NULL when iso_inited is false.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/8fb8e912afb4c47dec12ea9a5853e7a8db95816f; https://git.kernel.org/stable/c/a9b7b535ba192c6b77e6c15a4c82d853163eab8c; https://git.kernel.org/stable/c/adf1b179c2ff8073c24bf87e5a605fcc5a09798b
CVE: CVE-2024-50078
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Call iso_exit() on module unload

If iso_init() has been called, iso_exit() must be called on module
unload. Without that, the struct proto that iso_init() registered with
proto_register() becomes invalid, which could cause unpredictable
problems later. In my case, with CONFIG_LIST_HARDENED and
CONFIG_BUG_ON_DATA_CORRUPTION enabled, loading the module again usually
triggers this BUG():

  list_add corruption. next->prev should be prev (ffffffffb5355fd0),
    but was [PII_REDACTED]. (next=ffffffffc0a010d0).
  ------------[ cut here ]------------
  kernel BUG at lib/list_debug.c:29!
  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
  CPU: 1 PID: 4159 Comm: modprobe Not tainted 6.10.11-4+bt2-ao-desktop #1
  RIP: 0010:__list_add_valid_or_report+0x61/0xa0
  ...
    __list_add_valid_or_report+0x61/0xa0
    proto_register+0x299/0x320
    hci_sock_init+0x16/0xc0 [bluetooth]
    bt_init+0x68/0xd0 [bluetooth]
    __pfx_bt_init+0x10/0x10 [bluetooth]
    do_one_initcall+0x80/0x2f0
    do_init_module+0x8b/0x230
    __do_sys_init_module+0x15f/0x190
    do_syscall_64+0x68/0x110
  ...
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/05f84d86169b2ebac185c5736a256823d42c425b; https://git.kernel.org/stable/c/4af7ba39a1a02e16ee8cd0d3b6c6657f51b8ad7a; https://git.kernel.org/stable/c/d458cd1221e9e56da3b2cc5518ad3225caa91f20
CVE: CVE-2024-50079
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work

When the sqpoll is exiting and cancels pending work items, it may need
to run task_work. If this happens from within io_uring_cancel_generic(),
then it may be under waiting for the io_uring_task waitqueue. This
results in the below splat from the scheduler, as the ring mutex may be
attempted grabbed while in a TASK_INTERRUPTIBLE state.

Ensure that the task state is set appropriately for that, just like what
is done for the other cases in io_run_task_work().

do not call blocking ops when !TASK_RUNNING; state=1 set at [<[PII_REDACTED]387fd2>] prepare_to_wait+0x88/0x2fc
WARNING: CPU: 6 PID: 59939 at kernel/sched/core.c:8561 __might_sleep+0xf4/0x140
Modules linked in:
CPU: 6 UID: 0 PID: 59939 Comm: iou-sqp-59938 Not tainted 6.12.0-rc3-00113-g8d020023b155 #7456
Hardware name: linux,dummy-virt (DT)
pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __might_sleep+0xf4/0x140
lr : __might_sleep+0xf4/0x140
sp : ffff80008c5e7830
x29: ffff80008c5e7830 x28: ffff0000d93088c0 x27: ffff60001c2d7230
x26: dfff[PII_REDACTED]00 x25: ffff0000e16b9180 x24: ffff80008c5e7a50
x23: 1ffff000118bcf4a x22: ffff0000e16b9180 x21: ffff0000e16b9180
x20:[PII_REDACTED]00011b x19: ffff80008310fac0 x18: 1ffff000118bcd90
x17: 30303c5b20746120 x16:[PII_REDACTED]3d6574 x15: [PII_REDACTED]
x14: [PII_REDACTED] x13: [PII_REDACTED] x12: ffff600036c64f0b
x11: 1fffe00036c64f0a x10: ffff600036c64f0a x9 : dfff[PII_REDACTED]00
x8 : 00009fffc939b0f6 x7 : ffff0001b6327853 x6 : [PII_REDACTED]
x5 : ffff0001b6327850 x4 : ffff600036c64f0b x3 : ffff8000803c35bc
x2 : [PII_REDACTED] x1 : [PII_REDACTED] x0 : ffff0000e16b9180
Call trace:
 __might_sleep+0xf4/0x140
 mutex_lock+0x84/0x124
 io_handle_tw_list+0xf4/0x260
 tctx_task_work_run+0x94/0x340
 io_run_task_work+0x1ec/0x3c0
 io_uring_cancel_generic+0x364/0x524
 io_sq_thread+0x820/0x124c
 ret_from_fork+0x10/0x20
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/887ba598d9cfb537bdb3dfd95f087ff8a08cb74d; https://git.kernel.org/stable/c/8f7033aa4089fbaf7a33995f0f2ee6c9d7b9ca1b
CVE: CVE-2024-50080
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ublk: don't allow user copy for unprivileged device

UBLK_F_USER_COPY requires userspace to call write() on ublk char
device for filling request buffer, and unprivileged device can't
be trusted.

So don't allow user copy for unprivileged device.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/42aafd8b48adac1c3b20fe5892b1b91b80c1a1e6; https://git.kernel.org/stable/c/6414ab5c9c9c068eca6dc4fd3a036bc4b83164dc; https://git.kernel.org/stable/c/8f3d5686a2409877c5e8e2540774d24ed2b4a4ce
CVE: CVE-2024-50081
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

blk-mq: setup queue ->tag_set before initializing hctx

Commit 7b815817aa58 ("blk-mq: add helper for checking if one CPU is mapped to specified hctx")
needs to check queue mapping via tag set in hctx's cpuhp handler.

However, q->tag_set may not be setup yet when the cpuhp handler is
enabled, then kernel oops is triggered.

Fix the issue by setup queue tag_set before initializing hctx.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/25466e5b4bb11a8415ce8d0be89ab77135f7e444; https://git.kernel.org/stable/c/73d964ce4bc8b4de88a7c2e40df494f0d5cd8950; https://git.kernel.org/stable/c/c25c0c9035bb8b28c844dfddeda7b8bdbcfcae95
CVE: CVE-2024-50086
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix user-after-free from session log off

There is racy issue between smb2 session log off and smb2 session setup.
It will cause user-after-free from session log off.
This add session_lock when setting SMB2_SESSION_EXPIRED and referece
count to session struct not to free session while it is being used.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/0f62358ce85b2d4c949ef1b648be01b29cec667a; https://git.kernel.org/stable/c/5511999e9615e4318e9142d23b29bd1597befc08; https://git.kernel.org/stable/c/7aa8804c0b67b3cb263a472d17f2cb50d7f1a930
CVE: CVE-2024-50087
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix uninitialized pointer free on read_alloc_one_name() error

The function read_alloc_one_name() does not initialize the name field of
the passed fscrypt_str struct if kmalloc fails to allocate the
corresponding buffer.  Thus, it is not guaranteed that
fscrypt_str.name is initialized when freeing it.

This is a follow-up to the linked patch that fixes the remaining
instances of the bug introduced by commit e43eec81c516 ("btrfs: use
struct qstr instead of name and namelen pairs").
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824, CWE-824
References: https://git.kernel.org/stable/c/1ec28de5e476913ae51f909660b4447eddb28838; https://git.kernel.org/stable/c/2ab5e243c2266c841e0f6904fad1514b18eaf510; https://git.kernel.org/stable/c/7fc7c47b9ba0cf2d192f2117a64b24881b0b577f
CVE: CVE-2024-50088
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix uninitialized pointer free in add_inode_ref()

The add_inode_ref() function does not initialize the "name" struct when
it is declared.  If any of the following calls to "read_one_inode()
returns NULL,

	dir = read_one_inode(root, parent_objectid);
	if (!dir) {
		ret = -ENOENT;
		goto out;
	}

	inode = read_one_inode(root, inode_objectid);
	if (!inode) {
		ret = -EIO;
		goto out;
	}

then "name.name" would be freed on "out" before being initialized.

out:
	...
	kfree(name.name);

This issue was reported by Coverity with CID 1526744.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://git.kernel.org/stable/c/12cf028381aa19bc[PII_REDACTED]2c280256e8d82d; https://git.kernel.org/stable/c/66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4; https://git.kernel.org/stable/c/a941f3d5b1469c60a7e70e775584f110b47e0d16
CVE: CVE-2024-10479
Published: 2024-10-29
Description: A vulnerability, which was classified as problematic, was found in LinZhaoguan pb-cms up to 2.0.1. Affected is an unknown function of the file /admin#themes of the component Theme Management Module. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://gitee.com/LinZhaoguan/pb-cms/issues/IAYHUP; https://vuldb.com/?ctiid.282090; https://vuldb.com/?id.282090
CVE: CVE-2024-22065
Published: 2024-10-29
Description: There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-78
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]16225572
CVE: CVE-2024-10000
Published: 2024-10-29
Description: The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with student-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/learning-management-system/tags/1.13.3; https://www.wordfence.com/threat-intel/vulnerabilities/id/575f103e-cfc7-4efd-a592-658a3e919671?source=cve
CVE: CVE-2024-10008
Published: 2024-10-29
Description: The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/learning-management-system/tags/1.13.3//includes/RestApi/Controllers/Version1/UsersController.php#L1726; https://www.wordfence.com/threat-intel/vulnerabilities/id/0c54166e-2af2-409d-8c67-9c07f2028543?source=cve
CVE: CVE-2024-10241
Published: 2024-10-29
Description: Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates
CVE: CVE-2024-10312
Published: 2024-10-29
Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.4 via the render function in elements/tabs/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3175285/exclusive-addons-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/dc931943-13f3-4ab1-b70f-c234253ca269?source=cve
CVE: CVE-2024-50052
Published: 2024-10-29
Description: Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2024-50480
Published: 2024-10-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Upload a Web Shell to a Web Server.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/marketing-automation-by-azexo/vulnerability/wordpress-marketing-automation-by-azexo-plugin-1-27-80-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50482
Published: 2024-10-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/woo-product-design/vulnerability/wordpress-woocommerce-product-design-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50484
Published: 2024-10-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/multi-purpose-mail-form/vulnerability/wordpress-multi-purpose-mail-form-plugin-1-0-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50493
Published: 2024-10-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in masterhomepage Automatic Translation automatic-translation allows Upload a Web Shell to a Web Server.This issue affects Automatic Translation: from n/a through <= 1.0.4.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/automatic-translation/vulnerability/wordpress-automatic-translation-plugin-1-0-4-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50494
Published: 2024-10-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce wc-sudan-payment-gateway allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through <= 1.2.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wc-sudan-payment-gateway/vulnerability/wordpress-sudan-payment-gateway-for-woocommerce-plugin-1-2-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-10048
Published: 2024-10-29
Description: The Post Status Notifier Lite and Premium plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.11.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3174969/post-status-notifier-lite/tags/1.11.7/lib/Psn/Admin/ListTable/Rules.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/90220c8d-8efc-48a2-955c-3155598f5f19?source=cve
CVE: CVE-2024-22066
Published: 2024-10-29
Description: There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated attacker could use the vulnerability to obtain sensitive information about the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294, CWE-294
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]16225590
CVE: CVE-2024-45477
Published: 2024-10-29
Description: Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.28.0 or 2.0.0-M4 is the recommended mitigation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/shdv0tw9hggj7tx9pl7g93mgok2lwbj9; http://www.openwall.com/lists/oss-security/2024/10/28/1
CVE: CVE-2024-46872
Published: 2024-10-29
Description: Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://mattermost.com/security-updates
CVE: CVE-2024-47401
Published: 2024-10-29
Description: Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://mattermost.com/security-updates
CVE: CVE-2024-49642
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi Todo Custom Field todo-custom-field allows Reflected XSS.This issue affects Todo Custom Field: from n/a through <= 3.0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/todo-custom-field/vulnerability/wordpress-todo-custom-field-plugin-3-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50411
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.7.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-abstracts-manuscripts-manager/vulnerability/wordpress-wp-abstracts-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50412
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Stored XSS.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.15.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cf7-conditional-fields/vulnerability/wordpress-conditional-fields-for-contact-form-7-plugin-2-4-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50413
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through <= 1.27.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/import-users-from-csv-with-meta/vulnerability/wordpress-import-and-export-users-and-customers-plugin-1-27-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50414
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buttonizer Button contact VR button-contact-vr allows Stored XSS.This issue affects Button contact VR: from n/a through <= 4.7.9.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/button-contact-vr/vulnerability/wordpress-button-contact-vr-plugin-4-7-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50415
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Ads.txt & App-ads.txt Manager for WordPress app-ads-txt allows Stored XSS.This issue affects Ads.txt & App-ads.txt Manager for WordPress: from n/a through <= 1.1.7.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/app-ads-txt/vulnerability/wordpress-ads-txt-app-ads-txt-manager-for-wordpress-plugin-1-1-7-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve