deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-28877
Published: 2024-06-11
Description: MicroDicom DICOM Viewer is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-163-01; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-163-01
CVE: CVE-2024-33606
Published: 2024-06-11
Description: An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User interaction is required to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-939, CWE-862
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-163-01; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-163-01
CVE: CVE-2024-4669
Published: 2024-06-11
Description: The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and Schedule widgets in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/events-addon-for-elementor/trunk/elementor/widgets/basic/nabasic-slider.php#L1403; https://plugins.trac.wordpress.org/browser/events-addon-for-elementor/trunk/elementor/widgets/event-unique/naevents-unique-schedule.php#L1267; https://plugins.trac.wordpress.org/browser/events-addon-for-elementor/trunk/elementor/widgets/event-unique/naevents-unique-upcoming.php#L1287
CVE: CVE-2024-5646
Published: 2024-06-11
Description: The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/futurio-extra/tags/2.0.5/inc/elementor/widgets/advanced-text-block.php#L265; https://plugins.trac.wordpress.org/changeset/3100491/#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb3bd9b-ac1f-4488-931f-2ba37576df2d?source=cve
CVE: CVE-2024-5830
Published: 2024-06-11
Description: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-787, CWE-843
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/342456991; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5831
Published: 2024-06-11
Description: Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/339171223; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5832
Published: 2024-06-11
Description: Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/340196361; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5833
Published: 2024-06-11
Description: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/342602616; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5834
Published: 2024-06-11
Description: Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/342840932; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5835
Published: 2024-06-11
Description: Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-122
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/341991535; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5836
Published: 2024-06-11
Description: Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-474
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/341875171; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5837
Published: 2024-06-11
Description: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/342415789; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5838
Published: 2024-06-11
Description: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/342522151; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5839
Published: 2024-06-11
Description: Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-474
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/340122160; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5840
Published: 2024-06-11
Description: Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/41492103; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5841
Published: 2024-06-11
Description: Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/326765855; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5842
Published: 2024-06-11
Description: Use after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/40062622; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5843
Published: 2024-06-11
Description: Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/333940412; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5844
Published: 2024-06-11
Description: Heap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/331960660; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5845
Published: 2024-06-11
Description: Use after free in Audio in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/340178596; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5846
Published: 2024-06-11
Description: Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/341095523; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-5847
Published: 2024-06-11
Description: Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/341313077; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU/
CVE: CVE-2024-35225
Published: 2024-06-11
Description: Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/<host>`, which runs the custom JavaScript contained in `host` set by the actor. As any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. Patches are included in versions 4.2.0 and 3.2.4. As a workaround, server operators who are unable to upgrade can disable the `jupyter-server-proxy` extension.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-116, CWE-79
References: https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328; https://github.com/jupyterhub/jupyter-server-proxy/commit/7abc9dc5bbb0b4b440548a5375261b8b8192fc22; https://github.com/jupyterhub/jupyter-server-proxy/commit/ff78128087e73fb9d0909e1366f8bf051e8ea878
CVE: CVE-2024-36103
Published: 2024-06-12
Description: OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU97214223/; https://www.elecom.co.jp/news/security/20240528-01/; https://jvn.jp/en/vu/JVNVU97214223/
CVE: CVE-2024-4315
Published: 2024-06-12
Description: parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` function fails to properly sanitize Windows-style paths (backward slash `\`), allowing attackers to perform directory traversal attacks on Windows systems. This vulnerability can be exploited through various routes, including `personalities` and `/del_preset`, to read or delete any file on the Windows filesystem, compromising the system's availability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/parisneo/lollms/commit/95ad36eeffc6a6be3e3f35ed35a384d768f0ecf6; https://huntr.com/bounties/8a1b0197-2c36-4276-b92b-630a2a9bb09c; https://github.com/parisneo/lollms/commit/95ad36eeffc6a6be3e3f35ed35a384d768f0ecf6
CVE: CVE-2024-4892
Published: 2024-06-12
Description: The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/buddypress/tags/12.4.1/bp-members/bp-members-blocks.php#L249; https://plugins.trac.wordpress.org/changeset/3100815/buddypress/trunk/bp-members/bp-members-blocks.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/113c154d-94a0-41da-a5ed-d9b2617e1c2c?source=cve
CVE: CVE-2024-5543
Published: 2024-06-12
Description: The Slideshow Gallery LITE plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/slideshow-gallery/trunk/slideshow-gallery.php#L620; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3100785%40slideshow-gallery%2Ftrunk&old=3098970%40slideshow-gallery%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5edd72d9-3086-4f4f-ae5b-830c8621b83a?source=cve
CVE: CVE-2024-36856
Published: 2024-06-12
Description: RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. An attacker can exhaust system memory and crash the daemon by establishing and maintaining a vast number of long-lived malicious publish/subscribe sessions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://gist.github.com/pengwGit/d8410afeb0d5d11ab79f596a32178c2e; https://github.com/rmqtt/rmqtt/releases/tag/0.4.0; https://gist.github.com/pengwGit/d8410afeb0d5d11ab79f596a32178c2e
CVE: CVE-2024-4564
Published: 2024-06-12
Description: The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Shop Slider, Tabs Classic, and Image Comparison widgets in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woolementor/trunk/widgets/image-comparison/image-comparison.php#L418; https://plugins.trac.wordpress.org/browser/woolementor/trunk/widgets/shop-slider/template.php#L29; https://plugins.trac.wordpress.org/browser/woolementor/trunk/widgets/tabs-classic/tabs-classic.php#L329
CVE: CVE-2024-5553
Published: 2024-06-12
Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via several parameters in all versions up to, and including, 4.10.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses and edits an injected element, and subsequently clicks the element with the mouse scroll wheel.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.10.32/widgets/premium-button.php#L2078; https://plugins.trac.wordpress.org/changeset/3101015/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a80a3108-c685-4e26-9ecd-a0fe6ad4860c?source=cve
CVE: CVE-2024-3559
Published: 2024-06-12
Description: The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_content]' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/custom-field-suite/trunk/includes/api.php#L282; https://plugins.trac.wordpress.org/browser/custom-field-suite/trunk/includes/form.php#L69; https://www.wordfence.com/threat-intel/vulnerabilities/id/56d8af3b-6c00-49ed-872a-64f7bebb470b?source=cve
CVE: CVE-2024-0427
Published: 2024-06-12
Description: The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1806fef3-d774-46e0-aa48-7a101495f4eb/; https://wpscan.com/vulnerability/1806fef3-d774-46e0-aa48-7a101495f4eb/
CVE: CVE-2024-36454
Published: 2024-06-12
Description: Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this vulnerability is exploited, the system may be rebooted or suspended by receiving a specially crafted packet.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-908
References: https://jvn.jp/en/jp/JVN25594256/; https://www.fujitsu.com/jp/products/network/support/2024/ipcom-02/; https://jvn.jp/en/jp/JVN25594256/
CVE: CVE-2024-4924
Published: 2024-06-12
Description: The Social Sharing Plugin  WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1867505f-d112-4919-9fd5-01745aa0433e/; https://wpscan.com/vulnerability/1867505f-d112-4919-9fd5-01745aa0433e/
CVE: CVE-2024-5892
Published: 2024-06-12
Description: The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘support_unfiltered_files_upload’ function in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/addons-for-divi/tags/3.6.6/includes/extensions/unfiltered-file-uploads/ext-unfiltered-file-uploads.php#L16; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3088441%40addons-for-divi%2Ftags%2F4.0.0&old=3001416%40addons-for-divi%2Ftrunk; https://www.wordfence.com/threat-intel/vulnerabilities/id/78dae5be-a71b-45bc-8814-7cc86233ae90?source=cve
CVE: CVE-2024-0160
Published: 2024-06-12
Description: Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by bypassing BIOS authorization to modify settings in the BIOS.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: https://www.dell.com/support/kbdoc/en-us/000224763/dsa-2024-122; https://www.dell.com/support/kbdoc/en-us/000224763/dsa-2024-122