deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-0946
Published: 2024-01-26
Description: A vulnerability classified as critical was found in 60IndexPage up to 1.8.5. This vulnerability affects unknown code of the file /apply/index.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252190 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918, CWE-918
References: https://note.zhaoj.in/share/iNSyaClT0hGi; https://vuldb.com/?ctiid.252190; https://vuldb.com/?id.252190
CVE: CVE-2024-0948
Published: 2024-01-26
Description: ** DISPUTED ** A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input <<h1 onload=alert(1)>>test</h1> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-252191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1tcgyzu9Fh3AMG0INR0EdOR7ZjWmBK0ZR/view?usp=sharing; https://vuldb.com/?ctiid.252191; https://vuldb.com/?id.252191
CVE: CVE-2023-52187
Published: 2024-01-27
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Thomas Maier Image Source Control Lite – Show Image Credits and Captions.This issue affects Image Source Control Lite – Show Image Credits and Captions: from n/a through 2.17.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/image-source-control-isc/wordpress-image-source-control-lite-plugin-2-17-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/image-source-control-isc/wordpress-image-source-control-lite-plugin-2-17-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-22147
Published: 2024-01-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce.This issue affects PDF Invoices & Packing Slips for WooCommerce: from n/a through 3.7.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/woocommerce-pdf-invoices-packing-slips/wordpress-pdf-invoices-packing-slips-for-woocommerce-plugin-3-7-5-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-pdf-invoices-packing-slips/wordpress-pdf-invoices-packing-slips-for-woocommerce-plugin-3-7-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-22283
Published: 2024-01-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delhivery Delhivery Logistics Courier.This issue affects Delhivery Logistics Courier: from n/a through 1.0.107.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/delhivery-logistics-courier/wordpress-delhivery-logistics-courier-plugin-1-0-107-subscriber-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/delhivery-logistics-courier/wordpress-delhivery-logistics-courier-plugin-1-0-107-subscriber-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-23506
Published: 2024-01-27
Description: Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
CVSS Score: 7.7 (HIGH)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-0-9-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/instawp-connect/wordpress-instawp-connect-plugin-0-1-0-9-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2023-6482
Published: 2024-01-27
Description: Use of encryption key derived from static information in Synaptics Fingerprint Driver allows 

an attacker to set up a TLS session with the fingerprint sensor and send restricted commands to the fingerprint sensor. This may 
allow an attacker, who has physical access to the sensor, to enroll a fingerprint into the 
template database.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://www.synaptics.com/sites/default/files/2024-01/fingerprint-driver-encryption-key-security-brief-2024-01-26.pdf; https://www.synaptics.com/sites/default/files/2024-01/fingerprint-driver-encryption-key-security-brief-2024-01-26.pdf
CVE: CVE-2023-52389
Published: 2024-01-27
Description: UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release; https://github.com/pocoproject/poco/issues/4320; https://pocoproject.org/blog/?p=1226
CVE: CVE-2023-6497
Published: 2024-01-27
Description: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up to and including 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3007737%40wordpress-simple-paypal-shopping-cart&new=3007737%40wordpress-simple-paypal-shopping-cart&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6201a1-7ca9-461b-b9ad-16407120dfae?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3007737%40wordpress-simple-paypal-shopping-cart&new=3007737%40wordpress-simple-paypal-shopping-cart&sfp_email=&sfph_mail=
CVE: CVE-2024-0664
Published: 2024-01-27
Description: The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meks Smart Social Widget in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027347%40meks-smart-social-widget&new=3027347%40meks-smart-social-widget&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/722aae99-fcfb-4234-9245-5db57aaa03c5?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027347%40meks-smart-social-widget&new=3027347%40meks-smart-social-widget&sfp_email=&sfph_mail=
CVE: CVE-2024-0667
Published: 2024-01-27
Description: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.15.21. This is due to missing or incorrect nonce validation on the 'execute' function. This makes it possible for unauthenticated attackers to execute arbitrary methods in the 'BoosterController' class via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1078, CWE-352
References: https://plugins.trac.wordpress.org/browser/form-maker/tags/1.15.21/booster/controller.php#L34; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027368%40form-maker&new=3027368%40form-maker&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d55c832b-f558-4e8a-8301-33dd38d39ef1?source=cve
CVE: CVE-2024-0697
Published: 2024-01-27
Description: The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.3 via the node_id parameter in the backuply_get_jstree function. This makes it possible for attackers with administrator privileges or higher to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3026806%40backuply&new=3026806%40backuply&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/70effa22-fbf6-44cb-9d1b-8625969c10ac?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3026806%40backuply&new=3026806%40backuply&sfp_email=&sfph_mail=
CVE: CVE-2024-0824
Published: 2024-01-27
Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Anything functionality in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3026499/exclusive-addons-for-elementor/trunk/extensions/link-anything.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/925b0a86-ed23-471c-84e2-ae78a01b1876?source=cve; https://plugins.trac.wordpress.org/changeset/3026499/exclusive-addons-for-elementor/trunk/extensions/link-anything.php
CVE: CVE-2023-48201
Published: 2024-01-27
Description: Cross Site Scripting (XSS) vulnerability in Sunlight CMS v.8.0.1, allows remote authenticated attackers to execute arbitrary code and escalate privileges via a crafted script to the Content text editor component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://mechaneus.github.io/CVE-2023-48201.html; https://mechaneus.github.io/CVE-2023-48201.html
CVE: CVE-2023-48202
Published: 2024-01-27
Description: Cross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://mechaneus.github.io/CVE-2023-48202.html; https://mechaneus.github.io/CVE-2023-48202.html
CVE: CVE-2024-0618
Published: 2024-01-27
Description: The Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported form titles in all versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.abay.sh/cve-2024-0618/; https://plugins.trac.wordpress.org/changeset/3022938/fluentform/tags/5.1.7/app/Helpers/Helper.php?old=3000676&old_path=fluentform%2Ftags%2F5.1.5%2Fapp%2FHelpers%2FHelper.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0348d465-f351-4c52-b293-8b3b058292b9?source=cve
CVE: CVE-2024-0958
Published: 2024-01-27
Description: A vulnerability was found in CodeAstro Stock Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /index.php of the component Add Category Handler. The manipulation of the argument Category Name/Category Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252203.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://drive.google.com/drive/folders/17JTwjuT09q7he_oXkMtZS5jyyXw8ZIgg?usp=sharing; https://vuldb.com/?ctiid.252203; https://vuldb.com/?id.252203
CVE: CVE-2024-22860
Published: 2024-01-27
Description: Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61991; https://github.com/FFmpeg/FFmpeg/commit/d2e8974699a9e35cc1a926bf74a972300d629cd5; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61991
CVE: CVE-2024-22862
Published: 2024-01-27
Description: Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62113; https://github.com/FFmpeg/FFmpeg/commit/ca09d8a0dcd82e3128e[PII_REDACTED]6aaf63ae6f7; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62113
CVE: CVE-2024-22861
Published: 2024-01-27
Description: Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/FFmpeg/FFmpeg/commit/87b8c1081959e45ffdcbabb3d53ac9882ef2b5ce; https://github.com/FFmpeg/FFmpeg/commit/87b8c1081959e45ffdcbabb3d53ac9882ef2b5ce
CVE: CVE-2024-0959
Published: 2024-01-27
Description: A vulnerability was found in StanfordVL GibsonEnv 0.3.1. It has been classified as critical. Affected is the function cloudpickle.load of the file gibson\utils\pposgd_fuse.py. The manipulation leads to deserialization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252204.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-502
References: https://github.com/bayuncao/vul-cve-7; https://github.com/bayuncao/vul-cve-7/blob/main/dataset.pkl; https://vuldb.com/?ctiid.252204
CVE: CVE-2024-0960
Published: 2024-01-27
Description: A vulnerability was found in flink-extended ai-flow 0.3.1. It has been declared as critical. Affected by this vulnerability is the function cloudpickle.loads of the file \ai_flow\cli\commands\workflow_command.py. The manipulation leads to deserialization. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-252205 was assigned to this vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-502
References: https://github.com/bayuncao/vul-cve-8; https://github.com/bayuncao/vul-cve-8/blob/main/dataset.pkl; https://vuldb.com/?ctiid.252205
CVE: CVE-2024-0962
Published: 2024-01-27
Description: A vulnerability was found in obgm libcoap 4.3.4. It has been rated as critical. Affected by this issue is the function get_split_entry of the file src/coap_oscore.c of the component Configuration File Handler. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-252206 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://github.com/obgm/libcoap/issues/1310; https://github.com/obgm/libcoap/issues/1310#issue[PII_REDACTED]; https://github.com/obgm/libcoap/pull/1311
CVE: CVE-2024-23738
Published: 2024-01-28
Description: An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor states "we dispute the report's accuracy ... the configuration does not enable remote code execution.."
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/V3x0r/CVE-2024-23738; https://www.electronjs.org/blog/statement-run-as-node-cves; https://github.com/V3x0r/CVE-2024-23738
CVE: CVE-2024-23743
Published: 2024-01-28
Description: Notion through 3.1.0 on macOS might allow code execution because of RunAsNode and enableNodeClilnspectArguments. NOTE: the vendor states "the attacker must launch the Notion Desktop application with nonstandard flags that turn the Electron-based application into a Node.js execution environment."
CVSS Score: 3.3 (LOW)
CWE: CWE-250
References: https://github.com/V3x0r/CVE-2024-23743; https://github.com/r3ggi/electroniz3r; https://www.electronjs.org/blog/statement-run-as-node-cves
CVE: CVE-2024-23739
Published: 2024-01-28
Description: An issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/V3x0r/CVE-2024-23739; https://www.electronjs.org/blog/statement-run-as-node-cves; https://github.com/V3x0r/CVE-2024-23739
CVE: CVE-2024-23741
Published: 2024-01-28
Description: An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/V3x0r/CVE-2024-23741; https://www.electronjs.org/blog/statement-run-as-node-cves; https://github.com/V3x0r/CVE-2024-23741
CVE: CVE-2024-23742
Published: 2024-01-28
Description: An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor disputes this because it requires local access to a victim's machine.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/V3x0r/CVE-2024-23742; https://www.electronjs.org/blog/statement-run-as-node-cves; https://github.com/V3x0r/CVE-2024-23742
CVE: CVE-2024-23740
Published: 2024-01-28
Description: An issue in Kap for macOS version 3.6.0 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/V3x0r/CVE-2024-23740; https://www.electronjs.org/blog/statement-run-as-node-cves; https://github.com/V3x0r/CVE-2024-23740
CVE: CVE-2024-0841
Published: 2024-01-28
Description: A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2024:2394; https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138
CVE: CVE-2023-6200
Published: 2024-01-28
Description: A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-362
References: https://access.redhat.com/security/cve/CVE-2023-6200; https://bugzilla.redhat.com/show_bug.cgi?id=2250377; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dade3f6a1e4e
CVE: CVE-2024-23782
Published: 2024-01-28
Description: Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier versions. If this vulnerability is exploited, a user with a contributor or higher privilege may execute an arbitrary script on the web browser of the user who accessed the website using the product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://developer.a-blogcms.jp/blog/news/JVN-34565930.html; https://jvn.jp/en/jp/JVN34565930/; https://developer.a-blogcms.jp/blog/news/JVN-34565930.html
CVE: CVE-2024-0986
Published: 2024-01-29
Description: A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_cli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252251. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://drive.google.com/file/d/10BYLQ7Rk4oag96afLZouSvDDPvsO7SoJ/view?usp=drive_link; https://vuldb.com/?ctiid.252251; https://vuldb.com/?id.252251
CVE: CVE-2024-0987
Published: 2024-01-29
Description: A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log. The manipulation leads to improper output neutralization for logs. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252252. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-117, CWE-116
References: https://note.zhaoj.in/share/mhLwGOcLxYfP; https://vuldb.com/?ctiid.252252; https://vuldb.com/?id.252252
CVE: CVE-2024-0988
Published: 2024-01-29
Description: A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of the file /application/index/common.php. The manipulation of the argument App_User_id/App_user_Token leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-252253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287
References: https://note.zhaoj.in/share/2dBOnquxgCDl; https://vuldb.com/?ctiid.252253; https://vuldb.com/?id.252253
CVE: CVE-2024-0989
Published: 2024-01-29
Description: A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this issue is the function del_sn_db of the file /application/index/controller/Service.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-252254 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://note.zhaoj.in/share/XKxaJTphW6PB; https://vuldb.com/?ctiid.252254; https://vuldb.com/?id.252254