deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56169
Published: 2024-12-18
Description: A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintain a backup cache of the remote RPKI data. This can be employed as a fallback in case a new fetch fails or yields incorrect files. However, the product currently uses its cache merely as a bandwidth saving tool (because fetching is performed through deltas). If a fetch fails midway or yields incorrect files, there is no viable fallback. This leads to incomplete route origin validation data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-354
References: https://github.com/NICMx/FORT-validator/issues/82; https://nicmx.github.io/FORT-validator/CVE.html
CVE: CVE-2024-56170
Published: 2024-12-18
Description: A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients are supposed to verify. Assuming everything else is correct, the most recent version of a manifest should be prioritized over other versions, to prevent replays, accidental or otherwise. Manifests contain the manifestNumber and thisUpdate fields, which can be used to gauge the relevance of a given manifest, when compared to other manifests. The former is a serial-like sequential number, and the latter is the date on which the manifest was created. However, the product does not compare the up-to-dateness of the most recently fetched manifest against the cached manifest. As such, it's prone to a rollback to a previous version if it's served a valid outdated manifest. This leads to outdated route origin validation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: https://nicmx.github.io/FORT-validator/CVE.html
CVE: CVE-2024-10892
Published: 2024-12-18
Description: The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/ff1f5b84-a8cf-4574-a713-53d35739c6cb/
CVE: CVE-2024-21546
Published: 2024-12-18
Description: Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/ImHades101/338a06816ef97262ba632af9c78b78ca; https://github.com/UniSharp/laravel-filemanager/commit/8170760c0ae316d77b9363cd4c76ab68d3f63f0b; https://security.snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-7210316
CVE: CVE-2024-21547
Published: 2024-12-18
Description: Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\\. An attacker could read any file on the server by exploiting the normalization of \ into /.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/chuajianshen/baa71db588cfc038fb5d65624a47be81; https://github.com/spatie/browsershot/commit/dfc3635b83dd980e5c39f8f8c73e87723b99ca01; https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8501858
CVE: CVE-2024-21548
Published: 2024-12-18
Description: Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects.**Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://github.com/oven-sh/bun/commit/a234e067a5dc7837602df3fb5489e826920cc65a; https://github.com/oven-sh/bun/pull/14119; https://security.snyk.io/vuln/SNYK-JS-BUN-8499549
CVE: CVE-2024-4464
Published: 2024-12-18
Description: Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_28
CVE: CVE-2024-56173
Published: 2024-12-18
Description: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from JavaScript in an SVG document.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]0973-Configured-Commerce-Security-Advisory-COM-2024-01
CVE: CVE-2024-56174
Published: 2024-12-18
Description: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]0973-Configured-Commerce-Security-Advisory-COM-2024-01
CVE: CVE-2024-56175
Published: 2024-12-18
Description: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]0973-Configured-Commerce-Security-Advisory-COM-2024-01
CVE: CVE-2024-11295
Published: 2024-12-18
Description: The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.29 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3205648/simple-page-access-restriction; https://www.wordfence.com/threat-intel/vulnerabilities/id/ed92806e-5d75-4a23-a588-821e9ada1b32?source=cve
CVE: CVE-2024-12287
Published: 2024-12-18
Description: The Biagiotti Membership plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, such as administrators, granted they have access to an email.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://themeforest.net/item/biagiotti-beauty-and-cosmetics-shop/24645919; https://www.wordfence.com/threat-intel/vulnerabilities/id/12f319df-41eb-484a-8fca-af6ae76f4179?source=cve
CVE: CVE-2024-1610
Published: 2024-12-18
Description: In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-1284
References: https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]048840704
CVE: CVE-2024-39703
Published: 2024-12-18
Description: In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://threatq.freshdesk.com/helpdesk/tickets/10367; https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-01; https://www.threatq.com/vulnerability-management/
CVE: CVE-2024-47397
Published: 2024-12-18
Description: Weak authentication issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier. If this vulnerability is exploited, the authentication may be bypassed with an undocumented specific string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1390
References: https://jvn.jp/en/vu/JVNVU91084137/; https://www.fxc.jp/news/20241213
CVE: CVE-2024-53688
Published: 2024-12-18
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to execute an arbitrary OS command using a crafted HTTP request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU91084137/; https://www.fxc.jp/news/20241213
CVE: CVE-2024-54457
Published: 2024-12-18
Description: Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to enable telnet service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1242
References: https://jvn.jp/en/vu/JVNVU91084137/; https://www.fxc.jp/news/20241213
CVE: CVE-2024-11614
Published: 2024-12-18
Description: An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset.
CVSS Score: 7.4 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2025:0208; https://access.redhat.com/errata/RHSA-2025:0209; https://access.redhat.com/errata/RHSA-2025:0210
CVE: CVE-2024-12340
Published: 2024-12-18
Description: The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3205250/animation-addons-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0136e2-97f5-4368-a805-0f60d1b8ad11?source=cve
CVE: CVE-2024-12454
Published: 2024-12-18
Description: The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.23/includes/admin/settings/views/view-settings-tab-general.php#L437; https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.23/includes/admin/settings/views/view-settings-tab-general.php#L451; https://plugins.trac.wordpress.org/browser/slicewp/trunk/includes/admin/settings/functions-actions-settings.php#L14
CVE: CVE-2024-12554
Published: 2024-12-18
Description: The Peter’s Custom Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing nonce validation on the cas_register_post() function. This makes it possible for unauthenticated attackers to blacklist emails via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/peters-custom-anti-spam-image/trunk/custom_anti_spam.php#L1081; https://plugins.trac.wordpress.org/changeset/3208894/; https://wordpress.org/plugins/peters-custom-anti-spam-image/#developers
CVE: CVE-2024-47104
Published: 2024-12-18
Description: IBM i 7.4 and 7.5 is vulnerable to an authenticated user gaining elevated privilege to a physical file. A user with authority to a view can alter the based-on physical file security attributes without having object management rights to the physical file. A malicious actor can use the elevated privileges to perform actions restricted by their view privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-732
References: https://www.ibm.com/support/pages/node/7179158
CVE: CVE-2024-11291
Published: 2024-12-18
Description: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3206206/paid-member-subscriptions; https://www.wordfence.com/threat-intel/vulnerabilities/id/e207f1a3-2ca5-46d1-91a9[PII_REDACTED]6c?source=cve
CVE: CVE-2024-11912
Published: 2024-12-18
Description: The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and including, 3.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://travelerwp.com/traveler-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/febd1ff3-3a1a-49c2-b210-9e72051e3172?source=cve
CVE: CVE-2024-11926
Published: 2024-12-18
Description: The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartnerCreateServiceRental',  'st_delete_order_item', '_st_partner_approve_booking', 'save_order_item', and '__userDenyEachInfo' functions in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify posts, delete posts and pages, approve arbitrary orders, insert orders with arbitrary prices, and deny user information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://travelerwp.com/traveler-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d21c7537-8437-43aa-ab52-9e14d27a6e7f?source=cve
CVE: CVE-2024-49677
Published: 2024-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Bootstrap Buttons bootstrap-buttons allows Reflected XSS.This issue affects Bootstrap Buttons: from n/a through <= 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bootstrap-buttons/vulnerability/wordpress-bootstrap-buttons-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-4995
Published: 2024-12-18
Description: Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-757, CWE-922
References: https://cert.pl/en/posts/2024/12/CVE-2024-4995/; https://cert.pl/posts/2024/12/CVE-2024-4995/; https://wapro.pl/
CVE: CVE-2024-4996
Published: 2024-12-18
Description: Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Wapro ERP installations. This issue affects Wapro ERP Desktop versions before 8.90.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://cert.pl/en/posts/2024/12/CVE-2024-4995/; https://cert.pl/posts/2024/12/CVE-2024-4995/; https://wapro.pl/
CVE: CVE-2024-51646
Published: 2024-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saoshyant1994 Saoshyant Element saoshyant-element allows Reflected XSS.This issue affects Saoshyant Element: from n/a through <= 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/saoshyant-element/vulnerability/wordpress-saoshyant-element-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52485
Published: 2024-12-18
Description: Missing Authorization vulnerability in Yudiz Solutions Ltd. WP Menu Image wp-menu-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Menu Image: from n/a through <= 2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-menu-image/vulnerability/wordpress-wp-menu-image-plugin-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54270
Published: 2024-12-18
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axeptio Axeptio axeptio-sdk-integration allows PHP Local File Inclusion.This issue affects Axeptio: from n/a through <= 2.5.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/axeptio-sdk-integration/vulnerability/wordpress-axeptio-plugin-2-5-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-54350
Published: 2024-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hjyl hmd hmd allows Stored XSS.This issue affects hmd: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/hmd/vulnerability/wordpress-hmd-theme-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-55975
Published: 2024-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rohit Urane Dr Affiliate dr-affiliate allows SQL Injection.This issue affects Dr Affiliate: from n/a through <= 1.2.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/dr-affiliate/vulnerability/wordpress-dr-affiliate-plugin-1-2-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-55983
Published: 2024-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PowerFormBuilder PowerFormBuilder power-forms-builder allows SQL Injection.This issue affects PowerFormBuilder: from n/a through <= 1.0.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/power-forms-builder/vulnerability/wordpress-powerformbuilder-plugin-1-0-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-55984
Published: 2024-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susheelhbti Saksh Escrow System saksh-escrow-system allows SQL Injection.This issue affects Saksh Escrow System: from n/a through <= 2.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/saksh-escrow-system/vulnerability/wordpress-saksh-escrow-system-plugin-2-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-55985
Published: 2024-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ydesignservices YDS Support Ticket System yds-support-ticket-system allows SQL Injection.This issue affects YDS Support Ticket System: from n/a through <= 1.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/yds-support-ticket-system/vulnerability/wordpress-yds-support-ticket-system-plugin-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-55997
Published: 2024-12-18
Description: Missing Authorization vulnerability in webchunky Order Delivery & Pickup Location Date Time order-delivery-pickup-location-date-time-free-version allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery & Pickup Location Date Time: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/order-delivery-pickup-location-date-time-free-version/vulnerability/wordpress-order-delivery-pickup-location-date-time-plugin-1-1-0-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-56008
Published: 2024-12-18
Description: Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Spreadr Woocommerce: from n/a through <= 1.0.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/spreadr-for-woocomerce/vulnerability/wordpress-spreadr-woocommerce-plugin-1-0-4-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-56010
Published: 2024-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Device Detector device-detector allows Reflected XSS.This issue affects Device Detector: from n/a through <= 4.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/device-detector/vulnerability/wordpress-device-detector-plugin-4-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-56016
Published: 2024-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maartenhemmes Image Mapper image-mapper allows Reflected XSS.This issue affects Image Mapper: from n/a through <= 0.2.5.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/image-mapper/vulnerability/wordpress-image-mapper-plugin-0-2-5-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-56058
Published: 2024-12-18
Description: Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a through <= 2.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/vrpconnector/vulnerability/wordpress-vrpconnector-plugin-2-0-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-56059
Published: 2024-12-18
Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through <= 0.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://patchstack.com/database/Wordpress/Plugin/partners/vulnerability/wordpress-partners-plugin-0-2-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-34990
Published: 2024-12-18
Description: A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23, CWE-94
References: https://fortiguard.com/psirt/FG-IR-23-144
CVE: CVE-2024-48889
Published: 2024-12-18
Description: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiManager version 7.6.0, version 7.4.4 and below, version 7.2.7 and below, version 7.0.12 and below, version 6.4.14 and below and FortiManager Cloud version 7.4.4 and below, version 7.2.7 to 7.2.1, version 7.0.12 to 7.0.1 may allow an authenticated remote attacker to execute unauthorized code via FGFM crafted requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-425