deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-38406
Published: 2024-11-04
Description: Memory corruption while handling IOCTL calls in JPEG Encoder driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38407
Published: 2024-11-04
Description: Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38408
Published: 2024-11-04
Description: Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
CVSS Score: 8.2 (HIGH)
CWE: CWE-310
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38409
Published: 2024-11-04
Description: Memory corruption while station LL statistic handling.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38410
Published: 2024-11-04
Description: Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38415
Published: 2024-11-04
Description: Memory corruption while handling session errors from firmware.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38419
Published: 2024-11-04
Description: Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38421
Published: 2024-11-04
Description: Memory corruption while processing GPU commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38422
Published: 2024-11-04
Description: Memory corruption while processing voice packet with arbitrary data received from ADSP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-680
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38423
Published: 2024-11-04
Description: Memory corruption while processing GPU page table switch.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-38424
Published: 2024-11-04
Description: Memory corruption during GNSS HAL process initialization.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
CVE: CVE-2024-10389
Published: 2024-11-04
Description: There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc
CVSS Score: 7.5 (HIGH)
CWE: CWE-427, CWE-22
References: https://github.com/google/safearchive/commit/f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc
CVE: CVE-2024-48878
Published: 2024-11-04
Description: Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2024-48878.html
CVE: CVE-2024-51661
Published: 2024-11-04
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.19.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://patchstack.com/database/Wordpress/Plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-19-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-10035
Published: 2024-11-04
Description: Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in a Command ('Command Injection'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in BG-TEK Informatics Security Technologies CoslatV3 allows Command Injection, Privilege Escalation.This issue affects CoslatV3: through 3.1069.



NOTE: The vendor was contacted and it was learned that the product is not supported.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78, CWE-94
References: https://www.usom.gov.tr/bildirim/tr-24-1814
CVE: CVE-2024-10523
Published: 2024-11-04
Description: This vulnerability exists in TP-Link IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-312
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0331
CVE: CVE-2024-36485
Published: 2024-11-04
Description: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-36485.html
CVE: CVE-2024-51556
Published: 2024-11-04
Description: This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensitive information belonging to other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332
CVE: CVE-2024-51557
Published: 2024-11-04
Description: This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-799, CWE-770
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332
CVE: CVE-2024-51558
Published: 2024-11-04
Description: This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332
CVE: CVE-2024-51559
Published: 2024-11-04
Description: This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332
CVE: CVE-2024-51560
Published: 2024-11-04
Description: This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message containing sensitive information on the targeted system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332
CVE: CVE-2024-51561
Published: 2024-11-04
Description: This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting and manipulating the responses exchanged during the second factor authentication process.  

Successful exploitation of this vulnerability could allow the attacker to bypass OTP verification for accessing other user accounts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-807
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332
CVE: CVE-2024-9147
Published: 2024-11-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Bna Informatics PosPratik allows XSS Through HTTP Query Strings.This issue affects PosPratik: before v3.2.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-1815
CVE: CVE-2024-45164
Published: 2024-11-04
Description: Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigate directly to the /#app/intelligence/threatAvertPolicies URI and disable policy enforcement.
CVSS Score: 7.1 (HIGH)
CWE: CWE-863, CWE-732
References: https://notes.netbytesec.com/2024/11/cve-2024-45164-broken-access-control.html; https://www.akamai.com/global-services/support/vulnerability-reporting
CVE: CVE-2024-50523
Published: 2024-11-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through <= 1.8.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/allpost-contactform/vulnerability/wordpress-all-post-contact-form-plugin-1-6-7-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50525
Published: 2024-11-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in helloprint Helloprint helloprint allows Upload a Web Shell to a Web Server.This issue affects Helloprint: from n/a through <= 2.0.4.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/helloprint/vulnerability/wordpress-helloprint-plugin-2-0-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50526
Published: 2024-11-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/multi-purpose-mail-form/vulnerability/wordpress-multi-purpose-mail-form-plugin-1-0-2-arbitrary-file-upload-vulnerability-2?_s_id=cve; https://github.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-50526
CVE: CVE-2024-50527
Published: 2024-11-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web Server.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/stacks-mobile-app-builder/vulnerability/wordpress-stacks-mobile-app-builder-plugin-5-2-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50528
Published: 2024-11-04
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Retrieve Embedded Sensitive Data.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/stacks-mobile-app-builder/vulnerability/wordpress-stacks-mobile-app-builder-plugin-5-2-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-50529
Published: 2024-11-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in rudrainn Training – Courses training allows Upload a Web Shell to a Web Server.This issue affects Training – Courses: from n/a through <= 2.0.1.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/training/vulnerability/wordpress-training-courses-plugin-2-0-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50530
Published: 2024-11-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Upload a Web Shell to a Web Server.This issue affects Stars SMTP Mailer: from n/a through <= 2.2.1.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/stars-smtp-mailer/vulnerability/wordpress-stars-smtp-mailer-plugin-1-7-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50531
Published: 2024-11-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to a Web Server.This issue affects RSVPMaker for Toastmasters: from n/a through <= 6.2.4.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/rsvpmaker-for-toastmasters/vulnerability/wordpress-rsvpmaker-for-toastmasters-plugin-6-2-4-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-51246
Published: 2024-11-04
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51249
Published: 2024-11-04
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51251
Published: 2024-11-04
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the backup function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51253
Published: 2024-11-04
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51408
Published: 2024-11-04
Description: AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.
CVSS Score: 8.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/appsmithorg/appsmith/pull/29286; https://github.com/appsmithorg/appsmith/releases/tag/v1.46; https://github.com/jahithoque/Vulnerability-Research/tree/main/CVE-2024-51408
CVE: CVE-2024-51582
Published: 2024-11-04
Description: Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: from n/a through <= 2.2.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-35, CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/wp-hotel-booking/vulnerability/wordpress-wp-hotel-booking-plugin-2-1-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-51665
Published: 2024-11-04
Description: Server-Side Request Forgery (SSRF) vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Server Side Request Forgery.This issue affects Magical Addons For Elementor: from n/a through <= 1.2.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/magical-addons-for-elementor/vulnerability/wordpress-magical-addons-for-elementor-plugin-1-2-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-51672
Published: 2024-11-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPDeveloper BetterLinks betterlinks allows SQL Injection.This issue affects BetterLinks: from n/a through <= 2.1.7.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/betterlinks/vulnerability/wordpress-betterlinks-plugin-2-1-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-45882
Published: 2024-11-04
Description: DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_map_profile.`
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/test_v.zip; https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-45884
Published: 2024-11-04
Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMGroup.`
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/test_v.zip; https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-45885
Published: 2024-11-04
Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `autodiscovery_clear.`
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/test_v.zip; https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-45887
Published: 2024-11-04
Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `doOpenVPN.`
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/test_v.zip; https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-45888
Published: 2024-11-04
Description: DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `set_ap_map_config.'
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/test_v.zip; https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-45889
Published: 2024-11-04
Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `commandTable.`
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/test_v.zip; https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-45890
Published: 2024-11-04
Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `download_ovpn.`
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/test_v.zip; https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-45891
Published: 2024-11-04
Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_wlan_profile.`
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/test_v.zip; https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-45893
Published: 2024-11-04
Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.`
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/test_v.zip; https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51626
Published: 2024-11-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calculator-order allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through <= 1.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/woo-quote-calculator-order/vulnerability/wordpress-woocommerce-quote-calculator-plugin-1-1-sql-injection-vulnerability-2?_s_id=cve
CVE: CVE-2024-51677
Published: 2024-11-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Knowledge Base knowledgebase allows Stored XSS.This issue affects Knowledge Base: from n/a through <= 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/knowledgebase/vulnerability/wordpress-knowledge-base-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51678
Published: 2024-11-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through <= 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elo-rating-shortcode/vulnerability/wordpress-elo-rating-shortcode-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51680
Published: 2024-11-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrestaProject Cresta Addons for Elementor cresta-addons-for-elementor allows Stored XSS.This issue affects Cresta Addons for Elementor: from n/a through <= 1.0.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cresta-addons-for-elementor/vulnerability/wordpress-cresta-addons-for-elementor-plugin-1-0-9-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51681
Published: 2024-11-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution WP Pocket URLs wp-pocket-urls allows Stored XSS.This issue affects WP Pocket URLs: from n/a through <= 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-pocket-urls/vulnerability/wordpress-wp-pocket-urls-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve