deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-27909
Published: 2024-04-05
Description: A denial of service vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in a system reboot.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://iknow.lenovo.com.cn/detail/420425; https://iknow.lenovo.com.cn/detail/420425
CVE: CVE-2024-27910
Published: 2024-04-05
Description: A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://iknow.lenovo.com.cn/detail/420425; https://iknow.lenovo.com.cn/detail/420425
CVE: CVE-2024-27911
Published: 2024-04-05
Description: A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://iknow.lenovo.com.cn/detail/420425; https://iknow.lenovo.com.cn/detail/420425
CVE: CVE-2024-27912
Published: 2024-04-05
Description: A denial of service vulnerability was reported in some Lenovo Printers that could allow an attacker to cause the device to crash by sending crafted LPD packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://iknow.lenovo.com.cn/detail/420425; https://iknow.lenovo.com.cn/detail/420425
CVE: CVE-2024-30977
Published: 2024-04-05
Description: An issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the password component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://www.secnet.cn/newsdetail/388.html; https://github.com/wodi98k/zip_crack/blob/main/SecnetAC.pdf; http://www.secnet.cn/newsdetail/388.html
CVE: CVE-2024-3355
Published: 2024-04-05
Description: A vulnerability was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin/mod_users/controller.php?action=add. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259459.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-09; https://vuldb.com/?ctiid.259459; https://vuldb.com/?id.259459
CVE: CVE-2024-3356
Published: 2024-04-05
Description: A vulnerability was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin/mod_settings/controller.php?action=add. The manipulation of the argument type leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259460.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-10; https://vuldb.com/?ctiid.259460; https://vuldb.com/?id.259460
CVE: CVE-2024-3357
Published: 2024-04-05
Description: A vulnerability classified as problematic has been found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This affects an unknown part of the file admin/mod_reports/index.php. The manipulation of the argument end leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259461 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-11.md; https://vuldb.com/?ctiid.259461; https://vuldb.com/?id.259461
CVE: CVE-2024-1994
Published: 2024-04-06
Description: The Image Watermark plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the watermark_action_ajax() function in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to apply and remove watermarks from images.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3064501%40image-watermark&new=3064501%40image-watermark&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/31a66e30-972b-4a7b-9d47-ad7abd574e36?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3064501%40image-watermark&new=3064501%40image-watermark&sfp_email=&sfph_mail=
CVE: CVE-2024-3245
Published: 2024-04-06
Description: The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Youtube block in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3064544/embedpress/tags/3.9.15/Gutenberg/dist/blocks.build.js; https://www.wordfence.com/threat-intel/vulnerabilities/id/a427c798-f546-4ca1-98ab-32b433ee5b59?source=cve; https://plugins.trac.wordpress.org/changeset/3064544/embedpress/tags/3.9.15/Gutenberg/dist/blocks.build.js
CVE: CVE-2024-1385
Published: 2024-04-06
Description: The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to the current time, which may completely take a site offline.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3035169%40wp-stateless&new=3035169%40wp-stateless&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9a475017-ef45-4614-bdc6-ddd619b8caf3?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3035169%40wp-stateless&new=3035169%40wp-stateless&sfp_email=&sfph_mail=
CVE: CVE-2024-2656
Published: 2024-04-06
Description: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a CSV import in all versions up to, and including, 5.7.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3063438/email-subscribers/trunk/lite/includes/classes/class-es-import-subscribers.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/159ddb06-e7c4-4279-a8a1-c78a02e15891?source=cve; https://plugins.trac.wordpress.org/changeset/3063438/email-subscribers/trunk/lite/includes/classes/class-es-import-subscribers.php
CVE: CVE-2024-2950
Published: 2024-04-06
Description: The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.14 via meta information (og:description) This makes it possible for unauthenticated attackers to view the first 130 characters of a password protected post which can contain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/boldgrid-easy-seo/tags/1.6.15/includes/class-boldgrid-seo-admin.php?rev=3064911; https://www.wordfence.com/threat-intel/vulnerabilities/id/d502e617-a59f-4385-b050-3702a1b1ed7e?source=cve; https://plugins.trac.wordpress.org/browser/boldgrid-easy-seo/tags/1.6.15/includes/class-boldgrid-seo-admin.php?rev=3064911
CVE: CVE-2024-3216
Published: 2024-04-06
Description: The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin's settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/trunk/admin/class-wf-woocommerce-packing-list-admin.php#L4262; https://www.wordfence.com/threat-intel/vulnerabilities/id/aeac9c4a-0754-4fb1-bf11-0cd8483451b6?source=cve; https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/trunk/admin/class-wf-woocommerce-packing-list-admin.php#L4262
CVE: CVE-2024-3358
Published: 2024-04-06
Description: A vulnerability classified as problematic was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument to leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259462 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-12.md; https://vuldb.com/?ctiid.259462; https://vuldb.com/?id.259462
CVE: CVE-2024-3359
Published: 2024-04-06
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Library System 1.0. This issue affects some unknown processing of the file admin/login.php. The manipulation of the argument user_email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259463.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-01; https://vuldb.com/?ctiid.259463; https://vuldb.com/?id.259463
CVE: CVE-2024-21506
Published: 2024-04-06
Description: Rejected reason: Duplicate of CVE-2024-5629.
CVE: CVE-2024-2444
Published: 2024-04-06
Description: The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/214e5fd7-8684-418a-b67d-60b1dcf11a48/; https://wpscan.com/vulnerability/214e5fd7-8684-418a-b67d-60b1dcf11a48/
CVE: CVE-2024-3360
Published: 2024-04-06
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Library System 1.0. Affected is an unknown function of the file admin/books/index.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259464.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-02; https://vuldb.com/?ctiid.259464; https://vuldb.com/?id.259464
CVE: CVE-2024-2471
Published: 2024-04-06
Description: The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type') in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3061049%40foogallery&old=3039399%40foogallery&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d4aeb1-0a4f-49f1-b5a9-b582e271eae1?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3061049%40foogallery&old=3039399%40foogallery&sfp_email=&sfph_mail=
CVE: CVE-2024-3361
Published: 2024-04-06
Description: A vulnerability has been found in SourceCodester Online Library System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/books/deweydecimal.php. The manipulation of the argument category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259465 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-03; https://vuldb.com/?ctiid.259465; https://vuldb.com/?id.259465
CVE: CVE-2024-2949
Published: 2024-04-06
Description: The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3065296%40wp-carousel-free&new=3065296%40wp-carousel-free&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9349208c-3e86-4ec6-9e10-5ecaa4923922?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3065296%40wp-carousel-free&new=3065296%40wp-carousel-free&sfp_email=&sfph_mail=
CVE: CVE-2024-3362
Published: 2024-04-06
Description: A vulnerability was found in SourceCodester Online Library System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/books/controller.php. The manipulation of the argument IBSN leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259466 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-04; https://vuldb.com/?ctiid.259466; https://vuldb.com/?id.259466
CVE: CVE-2024-0837
Published: 2024-04-06
Description: The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in all versions up to, and including, 5.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3045497/bdthemes-element-pack-lite/trunk/modules/custom-gallery/widgets/custom-gallery.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a54c2a89-4297-48f5-bbff-e5c20c26a632?source=cve; https://plugins.trac.wordpress.org/changeset/3045497/bdthemes-element-pack-lite/trunk/modules/custom-gallery/widgets/custom-gallery.php
CVE: CVE-2024-1428
Published: 2024-04-06
Description: The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘element_pack_wrapper_link’ attribute of the Trailer Box widget in all versions up to, and including, 5.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/5.4.14/modules/trailer-box/widgets/trailer-box.php#L2063; https://plugins.trac.wordpress.org/changeset/3047402/bdthemes-element-pack-lite/trunk/modules/wrapper-link/module.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/543c4d52-0e47-4bbb-b53e-dbe3f104734f?source=cve
CVE: CVE-2024-2458
Published: 2024-04-06
Description: The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3057392%40powerkit&new=3057392%40powerkit&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/efb816e4-c07f-4e72-bfd3-06d83ed4d642?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3057392%40powerkit&new=3057392%40powerkit&sfp_email=&sfph_mail=
CVE: CVE-2024-2132
Published: 2024-04-06
Description: The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Widget in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3062338%40ultimate-bootstrap-elements-for-elementor&new=3062338%40ultimate-bootstrap-elements-for-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb43deb-63f6-42d8-8dd6-55a59fca31ae?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3062338%40ultimate-bootstrap-elements-for-elementor&new=3062338%40ultimate-bootstrap-elements-for-elementor&sfp_email=&sfph_mail=
CVE: CVE-2024-2296
Published: 2024-04-06
Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.8.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE-2024-29833 appears to be a duplicate of this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058445%40photo-gallery&new=3058445%40photo-gallery&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/994a044d-db69-4f2d-9027-cf3665446ed3?source=cve
CVE: CVE-2024-3363
Published: 2024-04-06
Description: A vulnerability was found in SourceCodester Online Library System 1.0. It has been classified as critical. This affects an unknown part of the file admin/borrowed/index.php. The manipulation of the argument BookPublisher/BookTitle leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259467.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-05; https://vuldb.com/?ctiid.259467; https://vuldb.com/?id.259467
CVE: CVE-2024-3364
Published: 2024-04-06
Description: A vulnerability was found in SourceCodester Online Library System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file admin/books/index.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259468.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-06.md; https://vuldb.com/?ctiid.259468; https://vuldb.com/?id.259468
CVE: CVE-2024-3365
Published: 2024-04-06
Description: A vulnerability was found in SourceCodester Online Library System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/users/controller.php. The manipulation of the argument user_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259469 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-07.md; https://vuldb.com/?ctiid.259469; https://vuldb.com/?id.259469
CVE: CVE-2024-3366
Published: 2024-04-06
Description: A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.
CVSS Score: 3.5 (LOW)
CWE: CWE-74, CWE-502
References: https://github.com/xuxueli/xxl-job/issues/3391; https://vuldb.com/?ctiid.259480; https://vuldb.com/?id.259480
CVE: CVE-2024-3369
Published: 2024-04-06
Description: A vulnerability, which was classified as critical, has been found in code-projects Car Rental 1.0. Affected by this issue is some unknown functionality of the file add-vehicle.php. The manipulation of the argument Upload Image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259490 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://drive.google.com/file/d/1wLMnGzcbyCoZ_Wp-bHpLD49MZ9-XHPUK/view?usp=drive_link; https://vuldb.com/?ctiid.259490; https://vuldb.com/?id.259490
CVE: CVE-2024-22328
Published: 2024-04-06
Description: IBM Maximo Application Suite 8.10 and 8.11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  279950.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/279950; https://www.ibm.com/support/pages/node/7147543; https://exchange.xforce.ibmcloud.com/vulnerabilities/279950