deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4081
Published: 2024-07-23
Description: A memory corruption issue due to an improper length check in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects NI LabVIEW 2024 Q1 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-issues-due-to-improper-length-checks-in-labview.html; https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-issues-due-to-improper-length-checks-in-labview.html
CVE: CVE-2024-5602
Published: 2024-07-23
Description: A stack-based buffer overflow vulnerability due to a missing bounds check in the NI I/O Trace Tool may result in arbitrary code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted nitrace file.

The NI I/O Trace tool is installed as part of the NI System Configuration utilities included with many NI software products.  Refer to the NI Security Advisory for identifying the version of NI IO Trace.exe installed. The NI I/O Trace tool was also previously released as NI Spy.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/stack-based-buffer-overflow-vulnerability-in-ni-io-trace-tool.html; https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/stack-based-buffer-overflow-vulnerability-in-ni-io-trace-tool.html
CVE: CVE-2024-0760
Published: 2024-07-23
Description: A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. 
This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2024/07/23/1; http://www.openwall.com/lists/oss-security/2024/07/31/2; https://kb.isc.org/docs/cve-2024-0760
CVE: CVE-2024-1737
Published: 2024-07-23
Description: Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.
This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2024/07/23/1; http://www.openwall.com/lists/oss-security/2024/07/31/2; https://kb.isc.org/docs/cve-2024-1737
CVE: CVE-2024-1975
Published: 2024-07-23
Description: If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.
This issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2024/07/23/1; http://www.openwall.com/lists/oss-security/2024/07/31/2; https://kb.isc.org/docs/cve-2024-1975
CVE: CVE-2024-40060
Published: 2024-07-23
Description: go-chart v2.1.1 was discovered to contain an infinite loop via the drawCanvas() function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://gist.github.com/F3iG0n9/4d0d7c863eea6874eeeb26a3073aa5f8; https://gist.github.com/F3iG0n9/4d0d7c863eea6874eeeb26a3073aa5f8
CVE: CVE-2024-41319
Published: 2024-07-23
Description: TOTOLINK A6000R V1.0.1-B20[PII_REDACTED] was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://gist.github.com/yanggao017/40efb889800ae2691c38086ebf80c037; https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_7_webcmd/README.md; https://gist.github.com/yanggao017/40efb889800ae2691c38086ebf80c037
CVE: CVE-2024-41655
Published: 2024-07-23
Description: TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6`  and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-624, CWE-1333
References: https://github.com/danocmx/node-tf2-item-format/commit/5cffcc16a9261d6a937bda72bfe6830e02e31eec; https://github.com/danocmx/node-tf2-item-format/releases/tag/v5.9.14; https://github.com/danocmx/node-tf2-item-format/security/advisories/GHSA-8h55-q5qq-p685
CVE: CVE-2024-4076
Published: 2024-07-23
Description: Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.
This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.openwall.com/lists/oss-security/2024/07/23/1; http://www.openwall.com/lists/oss-security/2024/07/31/2; https://kb.isc.org/docs/cve-2024-4076
CVE: CVE-2024-6783
Published: 2024-07-23
Description: A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as `Object.prototype.staticClass` or `Object.prototype.staticStyle` to execute arbitrary JavaScript code.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.herodevs.com/vulnerability-directory/cve-2024-6783; https://github.com/advisories/GHSA-g3ch-rx76-35fx; https://www.herodevs.com/vulnerability-directory/cve-2024-6783---vue-client-side-xss
CVE: CVE-2024-39702
Published: 2024-07-23
Description: In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks. An attacker could cause excessive resource usage during proxy operations via crafted requests, potentially leading to a denial of service with relatively few incoming requests. This vulnerability only exists in the OpenResty fork in the openresty/luajit2 GitHub repository. The LuaJIT/LuaJIT repository. is unaffected.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-407
References: https://openresty.org/en/ann[PII_REDACTED].html; https://openresty.org/en/ann[PII_REDACTED].html
CVE: CVE-2024-41663
Published: 2024-07-23
Description: Canarytokens help track activity and actions on a network.  A Cross-Site Scripting vulnerability was identified in the "Cloned Website" Canarytoken, whereby the Canarytoken's creator can attack themselves. The creator of a slow-redirect Canarytoken can insert Javascript into the destination URL of their slow redirect token. When the creator later browses the management page for their own Canarytoken, the Javascript executes. This is a self-XSS. An attacker could create a Canarytoken with this self-XSS, and send the management link to a victim. When they click on it, the Javascript would execute. However, no sensitive information (ex. session information) will be disclosed to the malicious actor. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after `sha-097d91a`.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/thinkst/canarytokens/security/advisories/GHSA-xj9h-3j9c-c95h; https://github.com/thinkst/canarytokens/security/advisories/GHSA-xj9h-3j9c-c95h
CVE: CVE-2024-6714
Published: 2024-07-23
Description: An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-73
References: https://bugs.launchpad.net/ubuntu/+source/provd/+bug/2071574; https://github.com/canonical/ubuntu-desktop-provision/commit/8d9086de0f82894ff27a9e429ff4f[PII_REDACTED]2; https://www.cve.org/CVERecord?id=CVE-2024-6714
CVE: CVE-2024-41178
Published: 2024-07-23
Description: Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. 

On certain error conditions, the logs may contain the OIDC token passed to  AssumeRoleWithWebIdentity https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html . This allows someone with access to the logs to impersonate that identity, including performing their own calls to AssumeRoleWithWebIdentity, until the OIDC token expires. Typically OIDC tokens are valid for up to an hour, although this will vary depending on the issuer.

Users are recommended to use a different AWS authentication mechanism, disable logging or upgrade to version 0.10.2, which fixes this issue.

Details:

When using AWS WebIdentityTokens with the object_store crate, in the event of a failure and automatic retry, the underlying reqwest error, including the full URL with the credentials, potentially in the parameters, is written to the logs. 

Thanks to Paul Hatcherian for reporting this vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://www.openwall.com/lists/oss-security/2024/07/23/3; https://lists.apache.org/thread/3t0povdppnt2czv6crlsqhvyko93kcrg; http://www.openwall.com/lists/oss-security/2024/07/23/3
CVE: CVE-2024-41664
Published: 2024-07-23
Description: Canarytokens help track activity and actions on a network. Prior to `sha-8ea5315`, Canarytokens.org was vulnerable to a blind SSRF in the Webhook alert feature. When a Canarytoken is created, users choose to receive alerts either via email or via a webhook. If a webhook is supplied when a  Canarytoken is first created, the site will make a test request to the supplied URL to ensure it accepts alert notification HTTP requests. No safety checks were performed on the URL, leading to a Server-Side Request Forgery vulnerability. The SSRF is Blind because the content of the response is not displayed to the creating user; they are simply told whether an error occurred in making the test request. Using the Blind SSRF, it was possible to map out open ports for IPs inside the Canarytokens.org infrastructure. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after `sha-097d91a`.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://github.com/thinkst/canarytokens/security/advisories/GHSA-g6h5-pf7p-qmvj; https://github.com/thinkst/canarytokens/security/advisories/GHSA-g6h5-pf7p-qmvj
CVE: CVE-2020-11639
Published: 2024-07-23
Description: An attacker could exploit the vulnerability by
injecting garbage data or specially crafted data. Depending on the data injected each process might be
affected differently. The process could crash or cause communication issues on the affected node, effectively causing a denial-of-service attack. The attacker could tamper with the data transmitted, causing
the product to store wrong information or act on wrong data or display wrong information.


This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2.




For an attack to be successful, the attacker must have local access to a node in the system and be able to
start a specially crafted application that disrupts the communication.
An attacker who successfully exploited the vulnerability would be able to manipulate the data in such
way as allowing reads and writes to the controllers or cause Windows processes in 800xA for MOD 300
and AdvaBuild to crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-924
References: https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200[PII_REDACTED]8[PII_REDACTED][PII_REDACTED]96[PII_REDACTED]; https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200[PII_REDACTED]8[PII_REDACTED][PII_REDACTED]96[PII_REDACTED]
CVE: CVE-2020-11640
Published: 2024-07-23
Description: AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the
command queue can use it to launch an attack by running any executable on the AdvaBuild node. The
executables that can be run are not limited to AdvaBuild specific executables. 

Improper Privilege Management vulnerability in ABB Advant MOD 300 AdvaBuild.This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200[PII_REDACTED]8[PII_REDACTED][PII_REDACTED]96[PII_REDACTED]; https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200[PII_REDACTED]8[PII_REDACTED][PII_REDACTED]96[PII_REDACTED]
CVE: CVE-2024-41661
Published: 2024-07-23
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-50094. Reason: This candidate is a duplicate of CVE-2023-50094. Notes: All CVE users should reference CVE-2023-50094 instead of this candidate.
CVE: CVE-2024-41665
Published: 2024-07-23
Description: Ampache, a web based audio/video streaming application and file manager, has a stored cross-site scripting (XSS) vulnerability in versions prior to 6.6.0. This vulnerability exists in the "Playlists - Democratic - Configure Democratic Playlist" feature. An attacker with Content Manager permissions can set the Name field to `<svg onload=alert(8)>`. When any administrator or user accesses the Democratic functionality, they will be affected by this stored XSS vulnerability. The attacker can exploit this vulnerability to obtain the cookies of any user or administrator who accesses the `democratic.php` file. Version 6.6.0 contains a patch for the issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ampache/ampache/security/advisories/GHSA-cp44-89r2-fxph; https://github.com/ampache/ampache/security/advisories/GHSA-cp44-89r2-fxph
CVE: CVE-2024-41668
Published: 2024-07-23
Description: The cBioPortal for Cancer Genomics provides visualization, analysis, and download of large-scale cancer genomics data sets. When running a publicly exposed proxy endpoint without authentication, cBioPortal could allow someone to perform a Server Side Request Forgery (SSRF) attack. Logged in users could do the same on private instances. A fix has been released in version 6.0.12. As a workaround, one might be able to disable `/proxy` endpoint entirely via, for example, nginx.
CVSS Score: 8.3 (HIGH)
CWE: CWE-918
References: https://github.com/cBioPortal/cbioportal/commit/ea8642fdbda2d61d2ab34b9da7a1594680bbbcd5; https://github.com/cBioPortal/cbioportal/pull/10884; https://github.com/cBioPortal/cbioportal/releases/tag/v6.0.12
CVE: CVE-2024-0981
Published: 2024-07-23
Description: Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerability. Importantly, if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not affected by this issue. The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981; https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981
CVE: CVE-2024-38164
Published: 2024-07-23
Description: An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38164; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38164
CVE: CVE-2024-38176
Published: 2024-07-23
Description: An improper restriction of excessive authentication attempts in GroupMe allows a unauthenticated attacker to elevate privileges over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-307
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38176; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38176
CVE: CVE-2024-41656
Published: 2024-07-23
Description: Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page. Self-hosted Sentry users may be impacted in case of untrustworthy Integration platform integrations sending external issues from their side to Sentry. A patch has been released in Sentry 24.7.1. For Sentry SaaS customers, no action is needed. This has been patched on July 23, and even prior to the fix, the exploitation was not possible due to the strict Content Security Policy deployed on sentry.io site. For self-hosted users, the maintainers of Sentry strongly recommend upgrading Sentry to the latest version. If it is not possible, one could enable CSP on one's self-hosted installation with `CSP_REPORT_ONLY = False` (enforcing mode). This will mitigate the risk of cross-site scripting.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/getsentry/self-hosted/releases/tag/24.7.1; https://github.com/getsentry/sentry/commit/5c679521f1539eabfb81287bfc30f34dbecd373e; https://github.com/getsentry/sentry/pull/74648
CVE: CVE-2024-6750
Published: 2024-07-24
Description: The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862, CWE-862
References: https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169; https://www.wordfence.com/threat-intel/vulnerabilities/id/36b58a4f-0761-4775-9010-9c77d4019c44?source=cve; https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE: CVE-2024-6751
Published: 2024-07-24
Description: The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169; https://www.wordfence.com/threat-intel/vulnerabilities/id/d7aceccc-7004-42f2-b085-eade9c45141c?source=cve; https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE: CVE-2024-6752
Published: 2024-07-24
Description: The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169; https://www.wordfence.com/threat-intel/vulnerabilities/id/39b9e8a0-96bb-4b36-b4e8-ec9e3f137835?source=cve; https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE: CVE-2024-6753
Published: 2024-07-24
Description: The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169; https://www.wordfence.com/threat-intel/vulnerabilities/id/3c268a6d-dfb4-4a9d-802e-80e5c1c53ca2?source=cve; https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE: CVE-2024-6754
Published: 2024-07-24
Description: The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169; https://www.wordfence.com/threat-intel/vulnerabilities/id/72934d2f-fd52-46d1-8cf9-9a20968899f7?source=cve; https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE: CVE-2024-6755
Published: 2024-07-24
Description: The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘wpw_auto_poster_quick_delete_multiple’ function in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to delete arbitrary posts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169; https://www.wordfence.com/threat-intel/vulnerabilities/id/d9b1044d-6858-498f-9b89[PII_REDACTED]58?source=cve; https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE: CVE-2024-6756
Published: 2024-07-24
Description: The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. An attacker can use CVE-2024-6754 to exploit with subscriber-level access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169; https://www.wordfence.com/threat-intel/vulnerabilities/id/24e00c0d-08ff-4c68-a1dd-77b513545efd?source=cve; https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169