deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-41945
Published: 2024-07-30
Description: fuels-ts is a library for interacting with Fuel v2.  The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the `txpool` / in a block or a previous transaction silently getting removed from the `txpool` and replaced with a new one.
CVSS Score: 3.1 (LOW)
CWE: CWE-20
References: https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf; https://github.com/FuelLabs/fuels-ts/security/advisories/GHSA-3jcg-vx7f-j6qf
CVE: CVE-2024-38983
Published: 2024-07-30
Description: Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the _assign() method at (/lib/index.js:91)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://gist.github.com/mestrtee/f82d0c3a8fe3a125f06425caef5d22ed; https://gist.github.com/mestrtee/f82d0c3a8fe3a125f06425caef5d22ed
CVE: CVE-2024-5901
Published: 2024-07-30
Description: The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including, 1.62.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.62.0/widgets/image-grid/image-grid.php#L282; https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.62.0/widgets/image-grid/tpl/default.php#L28; https://www.wordfence.com/threat-intel/vulnerabilities/id/0045c5a4-0807-4e89-8639-0802e54ce6ab?source=cve
CVE: CVE-2024-7273
Published: 2024-07-30
Description: A vulnerability classified as critical was found in itsourcecode Alton Management System 1.0. This vulnerability affects unknown code of the file search.php. The manipulation of the argument rcode leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273142 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE8-1.md; https://vuldb.com/?ctiid.273142; https://vuldb.com/?id.273142
CVE: CVE-2024-37281
Published: 2024-07-30
Description: An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://discuss.elastic.co/t/kibana-7-17-23-8-14-0-security-update-esa-2024-16/364094; https://discuss.elastic.co/t/kibana-7-17-23-8-14-0-security-update-esa-2024-16/364094
CVE: CVE-2024-7274
Published: 2024-07-30
Description: A vulnerability, which was classified as critical, has been found in itsourcecode Alton Management System 1.0. This issue affects some unknown processing of the file /reservation_status.php. The manipulation of the argument rcode leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273143.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE8-2.md; https://vuldb.com/?ctiid.273143; https://vuldb.com/?id.273143
CVE: CVE-2024-7275
Published: 2024-07-30
Description: A vulnerability, which was classified as critical, was found in itsourcecode Alton Management System 1.0. Affected is an unknown function of the file /admin/category_save.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273144.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE8-3.md; https://vuldb.com/?ctiid.273144; https://vuldb.com/?id.273144
CVE: CVE-2024-7276
Published: 2024-07-30
Description: A vulnerability has been found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/member_save.php. The manipulation of the argument last/first leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273145 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE8-4.md; https://vuldb.com/?ctiid.273145; https://vuldb.com/?id.273145
CVE: CVE-2024-7277
Published: 2024-07-31
Description: A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/menu.php of the component Add a Menu. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273146 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/Mirage/blob/main/CVE8-5.md; https://vuldb.com/?ctiid.273146; https://vuldb.com/?id.273146
CVE: CVE-2024-6255
Published: 2024-07-31
Description: A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://huntr.com/bounties/48f3e370-6dcd-4f38-9350-d0419b3a7f82; https://huntr.com/bounties/48f3e370-6dcd-4f38-9350-d0419b3a7f82
CVE: CVE-2024-7278
Published: 2024-07-31
Description: A vulnerability was found in itsourcecode Alton Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/team_save.php. The manipulation of the argument team leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273147.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE8-6.md; https://vuldb.com/?ctiid.273147; https://vuldb.com/?id.273147
CVE: CVE-2024-7279
Published: 2024-07-31
Description: A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273148.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://gist.github.com/topsky979/8eb5a3711f4802b2b05ae3702addb61e; https://vuldb.com/?ctiid.273148; https://vuldb.com/?id.273148
CVE: CVE-2024-7280
Published: 2024-07-31
Description: A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/view_reserved.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273149 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/c4e972f03739833ad2d111493f44138b; https://vuldb.com/?ctiid.273149; https://vuldb.com/?id.273149
CVE: CVE-2024-7281
Published: 2024-07-31
Description: A vulnerability classified as critical has been found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /admin/index.php?page=manage_lot. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-273150 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/13cfd55966ffe12c8904de995400fc33; https://vuldb.com/?ctiid.273150; https://vuldb.com/?id.273150
CVE: CVE-2024-7282
Published: 2024-07-31
Description: A vulnerability classified as critical was found in SourceCodester Lot Reservation Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/manage_model.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273151.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/16181c02e770952091a36784da530eab; https://vuldb.com/?ctiid.273151; https://vuldb.com/?id.273151
CVE: CVE-2024-7283
Published: 2024-07-31
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Lot Reservation Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273152.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://gist.github.com/topsky979/0cda40ceee628634e4bc984cc5651b51; https://vuldb.com/?ctiid.273152; https://vuldb.com/?id.273152
CVE: CVE-2024-7284
Published: 2024-07-31
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Lot Reservation Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_settings. The manipulation of the argument about leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273153 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gist.github.com/topsky979/16da371a38fd91d64765fd16ed3d049e; https://vuldb.com/?ctiid.273153; https://vuldb.com/?id.273153
CVE: CVE-2024-39944
Published: 2024-07-31
Description: A vulnerability has been found in Dahua products.Attackers
can send carefully crafted data packets to the interface with vulnerabilities,
causing the device to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-20
References: https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE: CVE-2024-39945
Published: 2024-07-31
Description: A vulnerability has been found in Dahua products.  After
obtaining the administrator's username and password, the attacker can send a
carefully crafted data packet to the interface with vulnerabilities, causing
the device to crash.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-703
References: https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE: CVE-2024-39946
Published: 2024-07-31
Description: A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization.
CVSS Score: 6.0 (MEDIUM)
References: https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE: CVE-2024-39947
Published: 2024-07-31
Description: A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash.
CVSS Score: 6.5 (MEDIUM)
References: https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE: CVE-2024-39948
Published: 2024-07-31
Description: A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-20
References: https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE: CVE-2024-39949
Published: 2024-07-31
Description: A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-20
References: https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE: CVE-2024-39950
Published: 2024-07-31
Description: A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
CVSS Score: 8.6 (HIGH)
CWE: CWE-121, CWE-20
References: https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE: CVE-2024-7285
Published: 2024-07-31
Description: A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/ajax.php?action=save_settings. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273154 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gist.github.com/topsky979/e2fa238262fcafdd8e301c32ee9f8e3a; https://vuldb.com/?ctiid.273154; https://vuldb.com/?id.273154
CVE: CVE-2024-7286
Published: 2024-07-31
Description: A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273155.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://gist.github.com/topsky979/da1899833a862fb19fcc146b6725a67b; https://vuldb.com/?ctiid.273155; https://vuldb.com/?id.273155
CVE: CVE-2024-7287
Published: 2024-07-31
Description: A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273156.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/d4684a6cf3ca446bb7c71c51ff6152ba; https://vuldb.com/?ctiid.273156; https://vuldb.com/?id.273156
CVE: CVE-2024-7288
Published: 2024-07-31
Description: A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_block. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273157 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://gist.github.com/topsky979/f495fd0ec7cdda5c7c6059a0b2224b64; https://vuldb.com/?ctiid.273157; https://vuldb.com/?id.273157
CVE: CVE-2024-42381
Published: 2024-07-31
Description: os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occurs before a user would expect execution of downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.)
CVSS Score: 8.3 (HIGH)
CWE: CWE-830
References: https://blog.trailofbits.com/2024/07/30/our-audit-of-homebrew/; https://brew.sh/2024/07/30/homebrew-security-audit/; https://github.com/Homebrew/brew/commit/916b37388d3851a8a93a8e9b4adc38873680ead7
CVE: CVE-2024-6165
Published: 2024-07-31
Description: The WANotifier  WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b9e6648a-9d19-4e73-ad6c-f727802d8dd5/
CVE: CVE-2024-6272
Published: 2024-07-31
Description: The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/146b94df-7fc6-4da3-9ef1-d2875ae3fa9e/
CVE: CVE-2024-6408
Published: 2024-07-31
Description: The Slider by 10Web  WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/31aaeffb-a752-4941-9d0f-1b374fbc7abb/
CVE: CVE-2024-6412
Published: 2024-07-31
Description: The HTML Forms  WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/9eb0dad6-3c19-4fe4-a20d-d45b51410444/
CVE: CVE-2024-6695
Published: 2024-07-31
Description: it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://wpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b/
CVE: CVE-2024-6770
Published: 2024-07-31
Description: The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3128079/#file56; https://plugins.trac.wordpress.org/changeset/3128079/#file58; https://plugins.trac.wordpress.org/changeset/3128092/
CVE: CVE-2024-7205
Published: 2024-07-31
Description: When the device is shared, the homepage module are before 2.19.0  in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.
CWE: CWE-201
References: https://ewelink.cc/security-advisory-240730/
CVE: CVE-2024-7289
Published: 2024-07-31
Description: A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /manage_payment.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273158 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/7f65e9704b8650e6bee74190f96d21e3; https://vuldb.com/?ctiid.273158; https://vuldb.com/?id.273158
CVE: CVE-2024-7290
Published: 2024-07-31
Description: A vulnerability classified as critical has been found in SourceCodester Establishment Billing Management System 1.0. This affects an unknown part of the file /manage_tenant.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273159.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/e40f691866138ea1abf3ca452c4ae3ac; https://vuldb.com/?ctiid.273159; https://vuldb.com/?id.273159
CVE: CVE-2024-6980
Published: 2024-07-31
Description: A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-209, CWE-918
References: https://www.bitdefender.com/consumer/support/support/security-advisories/verbose-error-handling-issue-in-gravityzone-update-server-proxy-service/
CVE: CVE-2024-7299
Published: 2024-07-31
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unknown processing of the file /preview/page of the component Entry Preview Handler. The manipulation of the argument body leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273167. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.273167; https://vuldb.com/?id.273167; https://vuldb.com/?submit.379971
CVE: CVE-2024-7300
Published: 2024-07-31
Description: A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/showcases of the component Showcase Creation Handler. The manipulation of the argument title/textarea leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.273168; https://vuldb.com/?id.273168; https://vuldb.com/?submit.380678
CVE: CVE-2023-28074
Published: 2024-07-31
Description: Dell BSAFE Crypto-C Micro Edition, version 4.1.5, and Dell BSAFE Micro Edition Suite, versions 4.0 through 4.6.1 and version 5.0, contains an Out-of-bounds Read vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.dell.com/support/kbdoc/en-us/000212325/dsa-2023-120-dell-bsafe-micro-edition-suite-security-update