deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-21509
Published: 2024-04-10
Description: Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321, CWE-1321
References: https://blog.slonser.info/posts/mysql2-attacker-configuration/; https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134; https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691
CVE: CVE-2024-2428
Published: 2024-04-10
Description: The Ultimate Video Player For WordPress  WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS attacks
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4832e223-4571-4b45-97db-2fd403797c49/; https://wpscan.com/vulnerability/4832e223-4571-4b45-97db-2fd403797c49/
CVE: CVE-2024-2734
Published: 2024-04-10
Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3064413%40bold-page-builder&new=3064413%40bold-page-builder&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/650b5677-7c70-415f-81bf-12514393e4c9?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3064413%40bold-page-builder&new=3064413%40bold-page-builder&sfp_email=&sfph_mail=
CVE: CVE-2024-2735
Published: 2024-04-10
Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3064413/bold-page-builder/trunk/bold-builder.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc4a67b-81fa-4ef6-9167-eab5cb9002ec?source=cve; https://plugins.trac.wordpress.org/changeset/3064413/bold-page-builder/trunk/bold-builder.php
CVE: CVE-2024-2736
Published: 2024-04-10
Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3064413/bold-page-builder/trunk/content_elements/bt_bb_headline/bt_bb_headline.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/86cf664f-5de1-4692-96b3-2fd8ae35110b?source=cve; https://plugins.trac.wordpress.org/changeset/3064413/bold-page-builder/trunk/content_elements/bt_bb_headline/bt_bb_headline.php
CVE: CVE-2024-30729
Published: 2024-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-30730
Published: 2024-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-30733
Published: 2024-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-30735
Published: 2024-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-30736
Published: 2024-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-30737
Published: 2024-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-3020
Published: 2024-04-10
Description: The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/changeset/3065296/wp-carousel-free/trunk/includes/class-wp-carousel-free-import-export.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d66df15e-1a0a-49e9-bcf9-67091499b24e?source=cve; https://plugins.trac.wordpress.org/changeset/3065296/wp-carousel-free/trunk/includes/class-wp-carousel-free-import-export.php
CVE: CVE-2024-3235
Published: 2024-04-10
Description: The Essential Grid Gallery WordPress Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the on_front_ajax_action() function. This makes it possible for unauthenticated attackers to view private and password protected posts that may have private or sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://www.essential-grid.com/documentation/changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/adadac1e-3d92-41a5-90d4-b2028c8c40c0?source=cve; https://codecanyon.net/item/essential-grid-wordpress-plugin/7563340
CVE: CVE-2024-3538
Published: 2024-04-10
Description: A vulnerability was found in Campcodes Church Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/addTithes.php. The manipulation of the argument na leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259908.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.259908; https://vuldb.com/?id.259908
CVE: CVE-2024-3539
Published: 2024-04-10
Description: A vulnerability was found in Campcodes Church Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/addgiving.php. The manipulation of the argument amount leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259909 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.259909; https://vuldb.com/?id.259909
CVE: CVE-2024-3540
Published: 2024-04-10
Description: A vulnerability was found in Campcodes Church Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_sundaysch.php. The manipulation of the argument Gender leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259910 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.259910; https://vuldb.com/?id.259910
CVE: CVE-2024-2539
Published: 2024-04-10
Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget '_id' attributes in all versions up to, and including, 8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3065560/addons-for-elementor/trunk/templates/addons/marquee-text/content.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/52d79cdd-739f-4ae9-9214-bc64ca7d8ecb?source=cve; https://plugins.trac.wordpress.org/changeset/3065560/addons-for-elementor/trunk/templates/addons/marquee-text/content.php
CVE: CVE-2024-2655
Published: 2024-04-10
Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post widgets in all versions up to, and including, 8.3.5 due to insufficient input sanitization and output escaping on author display names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/templates/post-meta/author.php#L8; https://www.wordfence.com/threat-intel/vulnerabilities/id/69f2fc37-4c02-48da-b1e8-350ecc8ba086?source=cve; https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/templates/post-meta/author.php#L8
CVE: CVE-2024-3210
Published: 2024-04-10
Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'reg-single-checkbox' shortcode in all versions up to, and including, 4.15.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3067520/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f4986bc3-ee34-43a6-bad2-9f6665adb35c?source=cve; https://plugins.trac.wordpress.org/changeset/3067520/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php
CVE: CVE-2024-3541
Published: 2024-04-10
Description: A vulnerability classified as problematic has been found in Campcodes Church Management System 1.0. This affects an unknown part of the file /admin/admin_user.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259911.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%208.pdf; https://vuldb.com/?ctiid.259911; https://vuldb.com/?id.259911
CVE: CVE-2024-3542
Published: 2024-04-10
Description: A vulnerability classified as problematic was found in Campcodes Church Management System 1.0. This vulnerability affects unknown code of the file /admin/add_visitor.php. The manipulation of the argument mobile leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259912.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%209.pdf; https://vuldb.com/?ctiid.259912; https://vuldb.com/?id.259912
CVE: CVE-2024-0159
Published: 2024-04-10
Description: Dell Alienware Command Center, versions 5.5.52.0 and prior, contain improper access control vulnerability, leading to Denial of Service on local system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1107
References: https://www.dell.com/support/kbdoc/en-us/000218222/dsa-2024-016-security-update-for-dell-alienware-command-center-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218222/dsa-2024-016-security-update-for-dell-alienware-command-center-vulnerabilities
CVE: CVE-2024-22450
Published: 2024-04-10
Description: Dell Alienware Command Center, versions prior to 6.2.7.0, contain an uncontrolled search path element vulnerability. A local malicious user could potentially inject malicious files in the file search path, leading to system compromise.
CVSS Score: 7.4 (HIGH)
CWE: CWE-427
References: https://www.dell.com/support/kbdoc/en-us/000218222/dsa-2024-016-security-update-for-dell-alienware-command-center-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000218222/dsa-2024-016-security-update-for-dell-alienware-command-center-vulnerabilities
CVE: CVE-2024-1780
Published: 2024-04-10
Description: The BizCalendar Web plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.1.0.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3127487/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b76b12ed-1bb4-4aa9-ab9f-06084c667f40?source=cve; https://plugins.trac.wordpress.org/browser/bizcalendar-web/trunk/admin/bizcalendar-admin.php
CVE: CVE-2024-22448
Published: 2024-04-10
Description: Dell BIOS contains an Out-of-Bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000221744/dsa-2024-066; https://www.dell.com/support/kbdoc/en-us/000221744/dsa-2024-066
CVE: CVE-2024-20737
Published: 2024-04-10
Description: After Effects versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb24-09.html; https://helpx.adobe.com/security/products/after_effects/apsb24-09.html
CVE: CVE-2024-20778
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-20779
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-20780
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-26046
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-26047
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-26076
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-26079
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-26084
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-26087
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-26097
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-26098
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2024-26122
Published: 2024-04-10
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html; https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
CVE: CVE-2023-2794
Published: 2024-04-10
Description: A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_deliver().
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=2255387; https://bugzilla.redhat.com/show_bug.cgi?id=2255387; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLAWJAAS3HDI2KMCZXF4DMR3Y4BQNMKO/