deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-42398
Published: 2024-08-06
Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE: CVE-2024-42399
Published: 2024-08-06
Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE: CVE-2024-42400
Published: 2024-08-06
Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVSS Score: 5.3 (MEDIUM)
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE: CVE-2024-41270
Published: 2024-08-06
Description: An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-327, CWE-327
References: https://gist.github.com/nyxfqq/cfae38fada582a0f576d154be1aeb1fc
CVE: CVE-2024-42218
Published: 2024-08-06
Description: 1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1289
References: https://app-updates.agilebits.com; https://support.1password.com/kb/202408/
CVE: CVE-2024-42219
Published: 2024-08-06
Description: 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1289
References: https://app-updates.agilebits.com; https://support.1password.com/kb/202408a/
CVE: CVE-2024-7532
Published: 2024-08-06
Description: Out of bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/350528343
CVE: CVE-2024-7533
Published: 2024-08-06
Description: Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/353552540
CVE: CVE-2024-7534
Published: 2024-08-06
Description: Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787, CWE-120
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/352467338
CVE: CVE-2024-7535
Published: 2024-08-06
Description: Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/352690885
CVE: CVE-2024-7536
Published: 2024-08-06
Description: Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/354847246
CVE: CVE-2024-7550
Published: 2024-08-06
Description: Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/355256380
CVE: CVE-2024-38166
Published: 2024-08-06
Description: An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38166
CVE: CVE-2024-38206
Published: 2024-08-06
Description: An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.
CVSS Score: 8.5 (HIGH)
CWE: CWE-918
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38206
CVE: CVE-2024-34604
Published: 2024-08-07
Description: Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34605
Published: 2024-08-07
Description: Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34606
Published: 2024-08-07
Description: Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34607
Published: 2024-08-07
Description: Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34608
Published: 2024-08-07
Description: Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34609
Published: 2024-08-07
Description: Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34610
Published: 2024-08-07
Description: Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34611
Published: 2024-08-07
Description: Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive information.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34612
Published: 2024-08-07
Description: Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34613
Published: 2024-08-07
Description: Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy watch.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34614
Published: 2024-08-07
Description: Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34615
Published: 2024-08-07
Description: Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to cause memory corruption.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34616
Published: 2024-08-07
Description: Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive data.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-276
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34617
Published: 2024-08-07
Description: Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-276
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34618
Published: 2024-08-07
Description: Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34619
Published: 2024-08-07
Description: Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34620
Published: 2024-08-07
Description: Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileged service.
CVSS Score: 8.4 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=08
CVE: CVE-2024-34621
Published: 2024-08-07
Description: Out-of-bounds read in applying binary with data in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34622
Published: 2024-08-07
Description: Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitrary code with Samsung Notes privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34623
Published: 2024-08-07
Description: Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitrary code with Samsung Notes privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34624
Published: 2024-08-07
Description: Out-of-bounds read in applying paragraphs in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34625
Published: 2024-08-07
Description: Out-of-bounds read in applying connection point in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34626
Published: 2024-08-07
Description: Out-of-bounds read in applying own binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34627
Published: 2024-08-07
Description: Out-of-bounds read in parsing implemention in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34628
Published: 2024-08-07
Description: Out-of-bounds read in applying binary with path in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34629
Published: 2024-08-07
Description: Out-of-bounds read in applying binary with text common object in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34630
Published: 2024-08-07
Description: Out-of-bounds read in applying own binary with textbox in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34631
Published: 2024-08-07
Description: Out-of-bounds read in applying new binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34632
Published: 2024-08-07
Description: Out-of-bounds read in uuid parsing in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34633
Published: 2024-08-07
Description: Out-of-bounds read in parsing object header in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34634
Published: 2024-08-07
Description: Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34635
Published: 2024-08-07
Description: Out-of-bounds read in parsing textbox object in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34636
Published: 2024-08-07
Description: Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=08
CVE: CVE-2024-34788
Published: 2024-08-07
Description: An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-200
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-for-Mobile-EPMM-July-2024
CVE: CVE-2024-36130
Published: 2024-08-07
Description: An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-285
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-for-Mobile-EPMM-July-2024
CVE: CVE-2024-36131
Published: 2024-08-07
Description: An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system of the appliance.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-for-Mobile-EPMM-July-2024
CVE: CVE-2024-36132
Published: 2024-08-07
Description: Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-for-Mobile-EPMM-July-2024
CVE: CVE-2024-37403
Published: 2024-08-07
Description: Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-24
References: https://forums.ivanti.com/s/article/Security-Advisory-CVE-2024-37403-Dirty-Stream-for-Ivanti-Docs-Work-for-Android
CVE: CVE-2024-3973
Published: 2024-08-07
Description: The House Manager  WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8c6ce66e-091a-41da-a13d-5f80cadb499a/
CVE: CVE-2024-6494
Published: 2024-08-07
Description: The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5b21a9be-b5fe-47ef-91c7-018dd42f763f/
CVE: CVE-2024-42062
Published: 2024-08-07
Description: CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that affects Apache CloudStack versions 4.10.0 up to 4.19.1.0, domain admin accounts were found to be able to query all registered account-users API and secret keys in an environment, including that of a root admin. An attacker who has domain admin access can exploit this to gain root admin and other-account privileges and perform malicious operations that can result in compromise of resources integrity and confidentiality, data loss, denial of service and availability of CloudStack managed infrastructure.

Users are recommended to upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863, CWE-863
References: https://cloudstack.apache.org/blog/security-release-advisory-4.19.1.1-4.18.2.3; https://lists.apache.org/thread/lxqtfd6407prbw3801hb4fz3ot3t8wlj; https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-3-and-4-19-1-1/
CVE: CVE-2024-42222
Published: 2024-08-07
Description: In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to network details, configurations and data.

Affected users are advised to upgrade to version 4.19.1.1 to address this issue. Users on older versions of CloudStack considering to upgrade, can skip 4.19.1.0 and upgrade directly to 4.19.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://cloudstack.apache.org/blog/security-release-advisory-4.19.1.1-4.18.2.3; https://github.com/apache/cloudstack/issues/9456; https://lists.apache.org/thread/lxqtfd6407prbw3801hb4fz3ot3t8wlj
CVE: CVE-2024-5290
Published: 2024-08-07
Description: An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).




Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613; https://snyk.io/blog/abusing-ubuntu-root-privilege-escalation/; https://ubuntu.com/security/notices/USN-6945-1
CVE: CVE-2024-7553
Published: 2024-08-07
Description: Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.

Required Configuration:

Only environments with Windows as the underlying operating system is affected by this issue
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://jira.mongodb.org/browse/CDRIVER-5650; https://jira.mongodb.org/browse/PHPC-2369; https://jira.mongodb.org/browse/SERVER-93211
CVE: CVE-2024-6522
Published: 2024-08-07
Description: The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 8.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://mec.webnus.net/change-log/; https://plugins.trac.wordpress.org/browser/modern-events-calendar-lite/trunk/app/features/fes.php#L54; https://wordpress.org/plugins/modern-events-calendar-lite/#developers
CVE: CVE-2024-7265
Published: 2024-08-07
Description: Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://cert.pl/en/posts/2024/08/CVE-2024-7265/; https://cert.pl/posts/2024/08/CVE-2024-7265/; https://www.gov.pl/web/ezd-rp