deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-6503
Published: 2024-01-29
Description: The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://magos-securitas.com/txt/CVE-2023-6503.txt; https://wpscan.com/vulnerability/0d95de23-e8f6-4342-b19c-57cd22b2fee2/; https://magos-securitas.com/txt/CVE-2023-6503.txt
CVE: CVE-2023-6530
Published: 2024-01-29
Description: The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://research.cleantalk.org/cve-2023-6530-tj-shortcodes-stored-xss-poc/; https://wpscan.com/vulnerability/8e63bf7c-7827-4c4d-b0e3-66354b218bee/; https://research.cleantalk.org/cve-2023-6530-tj-shortcodes-stored-xss-poc/
CVE: CVE-2023-6633
Published: 2024-01-29
Description: The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/eb983d82-b894-41c5-b51f-94d4bba3ba39/; https://wpscan.com/vulnerability/eb983d82-b894-41c5-b51f-94d4bba3ba39/
CVE: CVE-2023-6946
Published: 2024-01-29
Description: The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://magos-securitas.com/txt/CVE-2023-6946; https://wpscan.com/vulnerability/54a00416-c7e3-44f3-8dd2-ed9e748055e6/; https://magos-securitas.com/txt/CVE-2023-6946
CVE: CVE-2023-7074
Published: 2024-01-29
Description: The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://magos-securitas.com/txt/CVE-2023-7074.txt; https://wpscan.com/vulnerability/7906c349-97b0-4d82-aef0-97a1175ae88e/; https://magos-securitas.com/txt/CVE-2023-7074.txt
CVE: CVE-2023-7089
Published: 2024-01-29
Description: The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3b8ba734-7764-4ab6-a7e2-8de55bd46bed/; https://wpscan.com/vulnerability/3b8ba734-7764-4ab6-a7e2-8de55bd46bed/
CVE: CVE-2023-7199
Published: 2024-01-29
Description: The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://wpscan.com/vulnerability/0c96a128-4473-41f5-82ce-94bba33ca4a3/; https://www.relevanssi.com/release-notes/premium-2-25-free-4-22-release-notes/; https://wpscan.com/vulnerability/0c96a128-4473-41f5-82ce-94bba33ca4a3/
CVE: CVE-2023-7200
Published: 2024-01-29
Description: The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/586cf0a5-515c-43ea-8c03-f2f47ed13c2c/; https://wpscan.com/vulnerability/586cf0a5-515c-43ea-8c03-f2f47ed13c2c/
CVE: CVE-2023-7204
Published: 2024-01-29
Description: The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://wpscan.com/vulnerability/65a8cf83-d6cc-4d4c-a482-288a83a69879/; https://wpscan.com/vulnerability/65a8cf83-d6cc-4d4c-a482-288a83a69879/
CVE: CVE-2024-1003
Published: 2024-01-29
Description: A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252272. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setLanguageCfg-72357294db1e4f8096b29d3f2592d1fc?pvs=4; https://vuldb.com/?ctiid.252272; https://vuldb.com/?id.252272
CVE: CVE-2024-1004
Published: 2024-01-29
Description: A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. This affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252273 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-loginAuth-cbde48da404049328cb698394b6c0641?pvs=4; https://vuldb.com/?ctiid.252273; https://vuldb.com/?id.252273
CVE: CVE-2024-1005
Published: 2024-01-29
Description: A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the file /runtime/log. The manipulation leads to files or directories accessible. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252274 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://note.zhaoj.in/share/M9ERphWTXUPj; https://vuldb.com/?ctiid.252274; https://vuldb.com/?id.252274
CVE: CVE-2024-1006
Published: 2024-01-29
Description: A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument Nod_User_Id/Nod_User_Token leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252275. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://note.zhaoj.in/share/vWuVlU2eg79t; https://vuldb.com/?ctiid.252275; https://vuldb.com/?id.252275
CVE: CVE-2024-1007
Published: 2024-01-29
Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown function of the file edit_profile.php. The manipulation of the argument txtfullname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252276.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.252276; https://vuldb.com/?id.252276; https://www.youtube.com/watch?v=1yesMwvWcL4
CVE: CVE-2024-1008
Published: 2024-01-29
Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Profile Page. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252277 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://vuldb.com/?ctiid.252277; https://vuldb.com/?id.252277; https://www.youtube.com/watch?v=z4gcLZCOcnc
CVE: CVE-2024-23441
Published: 2024-01-29
Description: Vba32 Antivirus v3.36.0 is vulnerable to a Denial of Service vulnerability by triggering the 0x2220A7 IOCTL code of the Vba32m64.sys driver.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://fluidattacks.com/advisories/rollins/; https://www.anti-virus.by/vba32; https://fluidattacks.com/advisories/rollins/
CVE: CVE-2024-23822
Published: 2024-01-29
Description: Thruk is a multibackend monitoring webinterface.  Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/sni/Thruk/commit/1aa9597cdf2722a69651124f68cbb449be12cc39; https://github.com/sni/Thruk/security/advisories/GHSA-4mrh-mx7x-rqjx; https://github.com/sni/Thruk/commit/1aa9597cdf2722a69651124f68cbb449be12cc39
CVE: CVE-2024-23826
Published: 2024-01-29
Description: spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS.  This vulnerability was fixed in the 2024.01.29 release.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/spbu-se/spbu_se_site/commit/5ad623eb[PII_REDACTED]046343c5785bc588d8a57d; https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwm; https://github.com/spbu-se/spbu_se_site/commit/5ad623eb[PII_REDACTED]046343c5785bc588d8a57d
CVE: CVE-2024-23827
Published: 2024-01-29
Description: Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the vulnerability into a remote code execution overwriting the config file app.ini. Version 2.0.0.beta.12 fixed the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-xvq9-4vpv-227m; https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-xvq9-4vpv-227m
CVE: CVE-2023-1705
Published: 2024-01-29
Description: Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality Bypass.This issue affects F|One SmartEdge Agent: before 1.7.0.230330-554.


CVSS Score: 8.4 (HIGH)
CWE: CWE-862, CWE-862
References: https://support.forcepoint.com/s/article/000042333; https://support.forcepoint.com/s/article/000042333
CVE: CVE-2023-40546
Published: 2024-01-29
Description: A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2024:1834; https://access.redhat.com/errata/RHSA-2024:1835; https://access.redhat.com/errata/RHSA-2024:1873
CVE: CVE-2023-40549
Published: 2024-01-29
Description: An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:1834; https://access.redhat.com/errata/RHSA-2024:1835; https://access.redhat.com/errata/RHSA-2024:1873
CVE: CVE-2023-40550
Published: 2024-01-29
Description: An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:1834; https://access.redhat.com/errata/RHSA-2024:1835; https://access.redhat.com/errata/RHSA-2024:1873
CVE: CVE-2023-40551
Published: 2024-01-29
Description: A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:1834; https://access.redhat.com/errata/RHSA-2024:1835; https://access.redhat.com/errata/RHSA-2024:1873
CVE: CVE-2024-0788
Published: 2024-01-29
Description: SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-level API parameters manipulation and Denial of Service vulnerabilities by triggering the 0x9C402140 IOCTL code of the saskutil64.sys driver.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-96
References: https://fluidattacks.com/advisories/brubeck/; https://www.superantispyware.com/professional-x-edition.html; https://fluidattacks.com/advisories/brubeck/
CVE: CVE-2024-1009
Published: 2024-01-29
Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Admin/login.php. The manipulation of the argument txtusername leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252278 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?ctiid.252278; https://vuldb.com/?id.252278; https://youtu.be/oL98TSjy89Q?si=_T6YkJZlbn7SJ4Gn
CVE: CVE-2024-1010
Published: 2024-01-29
Description: A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file edit-profile.php. The manipulation of the argument fullname/phone/date of birth/address/date of appointment leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-252279.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/jomskiller/Employee-Management-System---Stored-XSS; https://github.com/jomskiller/Employee-Management-System---Stored-XSS/; https://vuldb.com/?ctiid.252279
CVE: CVE-2024-1011
Published: 2024-01-29
Description: A vulnerability classified as problematic was found in SourceCodester Employee Management System 1.0. This vulnerability affects unknown code of the file delete-leave.php of the component Leave Handler. The manipulation of the argument id leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252280.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/jomskiller/Employee-Managemet-System---Broken-Access-Control; https://vuldb.com/?ctiid.252280; https://vuldb.com/?id.252280
CVE: CVE-2024-23828
Published: 2024-01-29
Description: Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-qcjq-7f7v-pvc8; https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-qcjq-7f7v-pvc8
CVE: CVE-2024-1016
Published: 2024-01-29
Description: A vulnerability was found in Solar FTP Server 2.1.1/2.1.2. It has been declared as problematic. This vulnerability affects unknown code of the component PASV Command Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-252286 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://packetstormsecurity.com/files/176675/Solar-FTP-Server-2.1.2-Denial-Of-Service.html; https://vuldb.com/?ctiid.252286; https://vuldb.com/?id.252286
CVE: CVE-2023-22836
Published: 2024-01-29
Description: In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may be visible to the rest of the stack’s tenants.
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://palantir.safebase.us/?tcuUid=f9bf67ef-be15-4f87-a526-bf6064e8f682; https://palantir.safebase.us/?tcuUid=f9bf67ef-be15-4f87-a526-bf6064e8f682
CVE: CVE-2023-30970
Published: 2024-01-29
Description: Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36, CWE-22
References: https://palantir.safebase.us/?tcuUid=69be99ef-ad24-4339-9017-c8bf70789c72; https://palantir.safebase.us/?tcuUid=69be99ef-ad24-4339-9017-c8bf70789c72
CVE: CVE-2024-1017
Published: 2024-01-29
Description: A vulnerability was found in Gabriels FTP Server 1.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation of the argument USERNAME leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-252287.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://packetstormsecurity.com/files/176714/Gabriels-FTP-Server-1.2-Denial-Of-Service.html; https://vuldb.com/?ctiid.252287; https://vuldb.com/?id.252287
CVE: CVE-2024-23940
Published: 2024-01-29
Description: Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable to a DLL hijacking/proxying vulnerability, which if exploited could allow an attacker to impersonate and modify a library to execute code on the system and ultimately escalate privileges on an affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://helpcenter.trendmicro.com/en-us/article/tmka-12134; https://helpcenter.trendmicro.com/ja-jp/article/tmka-12132; https://medium.com/@s1kr10s/av-when-a-friend-becomes-an-enemy-55f41aba42b1
CVE: CVE-2024-24134
Published: 2024-01-29
Description: Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update Menu section.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BurakSevben/2024_Online_Food_Menu_XSS/; https://github.com/BurakSevben/2024_Online_Food_Menu_XSS/
CVE: CVE-2024-24135
Published: 2024-01-29
Description: Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BurakSevben/2024_Product_Inventory_with_Export_to_Excel_XSS/; https://github.com/BurakSevben/2024_Product_Inventory_with_Export_to_Excel_XSS/
CVE: CVE-2023-51839
Published: 2024-01-29
Description: DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-327, CWE-327
References: https://github.com/DeviceFarmer/stf; https://github.com/DeviceFarmer/stf/issues/736; https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-51839.md
CVE: CVE-2023-51840
Published: 2024-01-29
Description: DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/doramart/DoraCMS; https://github.com/doramart/DoraCMS/issues/262; https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-51840.md
CVE: CVE-2023-51842
Published: 2024-01-29
Description: An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Ylianst/MeshCentral/tree/master; https://github.com/tianjk99/Cryptographic-Misuses/blob/main/Bug_MeshCentral.md; https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-51842.md
CVE: CVE-2024-1018
Published: 2024-01-29
Description: A vulnerability classified as problematic has been found in PbootCMS 3.2.5-20230421. Affected is an unknown function of the file /admin.php?p=/Area/index#tab=t2. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252288.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/1MurasaKi/PboostCMS_XSS/blob/main/README.md; https://vuldb.com/?ctiid.252288; https://vuldb.com/?id.252288
CVE: CVE-2024-22570
Published: 2024-01-29
Description: A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Num-Nine/CVE/issues/11; https://github.com/Num-Nine/CVE/issues/11
CVE: CVE-2024-24136
Published: 2024-01-29
Description: The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (XSS) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BurakSevben/2024_Math_Game_XSS; https://github.com/BurakSevben/2024_Math_Game_XSS
CVE: CVE-2024-24139
Published: 2024-01-29
Description: Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/Login_System_with_Email_Verification_SQL_Injection/; https://github.com/BurakSevben/Login_System_with_Email_Verification_SQL_Injection/
CVE: CVE-2024-24140
Published: 2024-01-29
Description: Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/Daily_Habit_Tracker_App_SQL_Injection; https://github.com/BurakSevben/Daily_Habit_Tracker_App_SQL_Injection
CVE: CVE-2024-24141
Published: 2024-01-29
Description: Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/BurakSevben/School-Task-Manager-System-SQLi-1; https://github.com/BurakSevben/School-Task-Manager-System-SQLi-1
CVE: CVE-2023-49038
Published: 2024-01-29
Description: Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/christopher-pace/CVE-2023-49038; https://github.com/christopher-pace/CVE-2023-49038