deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9519
Published: 2024-10-10
Description: The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update the registration form role to administrator, which leads to privilege escalation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-266
References: https://plugins.trac.wordpress.org/browser/userplus/trunk/admin/admin-post-metaboxes.php?rev=1627771#L62; https://www.wordfence.com/threat-intel/vulnerabilities/id/1148b18d-7af1-41c6-bd7f-1b2d53cb44e6?source=cve
CVE: CVE-2024-9522
Published: 2024-10-10
Description: The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajax_masq_login' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288, CWE-306
References: https://plugins.trac.wordpress.org/browser/wp-users-masquerade/trunk/masquerade.php?rev=1703860#L162; https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4f0909-76f6-4d27-87b1-f6cd5f5cbbb7?source=cve
CVE: CVE-2024-9581
Published: 2024-10-10
Description: The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/shortcodes-anywhere/trunk/core/shortcodeEverywhere.class.php#L15; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e289b06-66c8-4d50-a8f7-e07c5ae8f7c8?source=cve
CVE: CVE-2024-9685
Published: 2024-10-10
Description: The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftb_test_action' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send a test message via the Telegram Bot API to all users configured in the settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/notification-for-telegram/tags/3.3/index.php#L202; https://plugins.trac.wordpress.org/changeset/3165615/notification-for-telegram; https://www.wordfence.com/threat-intel/vulnerabilities/id/abaebd3b-69ab-4e9b-a528-c9d846e62238?source=cve
CVE: CVE-2024-8477
Published: 2024-10-10
Description: The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.87. This is due to missing or incorrect nonce validation on the Init() function. This makes it possible for unauthenticated attackers to log out of a Brevo connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3165451/mailin/tags/3.1.88/page/page-home.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e070b422-9036-4362-832b-43fd4838f394?source=cve
CVE: CVE-2024-9022
Published: 2024-10-10
Description: The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/capture0x/Poll-Plugin-SQL-Injection-; https://packetstormsecurity.com/files/179414/WordPress-Poll-2.3.6-SQL-Injection.html; https://plugins.trac.wordpress.org/changeset/3157008/poll-wp/tags/2.4.0/admin/class-ts_poll_list.php?old=3144592&old_path=poll-wp%2Ftags%2F2.3.9%2Fadmin%2Fclass-ts_poll_list.php
CVE: CVE-2024-9067
Published: 2024-10-10
Description: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'delete_attachment' function in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/youzify/tags/1.3.0/includes/public/core/class-youzify-attachments.php#L1183; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3166404%40youzify&new=3166404%40youzify&sfp_email=&sfph_mail=#file885; https://www.wordfence.com/threat-intel/vulnerabilities/id/e099d8e2-6305-43fc-8807-a37791deb2ff?source=cve
CVE: CVE-2024-9074
Published: 2024-10-10
Description: The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/advanced-blocks-pro/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/f419d14a-90d1-445a-b629-c2e978c3ab81?source=cve
CVE: CVE-2024-9520
Published: 2024-10-10
Description: The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, to add, modify, or delete user meta and plugin options.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/userplus/trunk/admin/admin-ajax.php?rev=1627771#L186; https://plugins.trac.wordpress.org/browser/userplus/trunk/admin/admin-ajax.php?rev=1627771#L216; https://plugins.trac.wordpress.org/browser/userplus/trunk/admin/admin-ajax.php?rev=1627771#L225
CVE: CVE-2024-9156
Published: 2024-10-10
Description: The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/e95974f9-1f68-4181-89b0-3559d61cfa93/
CVE: CVE-2024-9780
Published: 2024-10-10
Description: ITS dissector crash in Wireshark 4.4.0 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.8 (HIGH)
CWE: CWE-456, CWE-909
References: https://gitlab.com/wireshark/wireshark/-/issues/20026; https://www.wireshark.org/security/wnpa-sec-2024-12.html
CVE: CVE-2024-9781
Published: 2024-10-10
Description: AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.8 (HIGH)
CWE: CWE-230
References: https://gitlab.com/wireshark/wireshark/-/issues/20114; https://www.wireshark.org/security/wnpa-sec-2024-13.html
CVE: CVE-2024-6747
Published: 2024-10-10
Description: Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201, CWE-200
References: https://checkmk.com/werk/17145
CVE: CVE-2024-7049
Published: 2024-10-10
Description: In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-488
References: https://huntr.com/bounties/ee9e3532-8ef1-4599-bb59-b8e2ba43a1fc
CVE: CVE-2024-9796
Published: 2024-10-10
Description: The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/2ddd6839-6bcb-4bb8-97e0-1516b8c2b99b/
CVE: CVE-2024-9798
Published: 2024-10-10
Description: The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-312, CWE-312
References: https://github.com/zowe/api-layer
CVE: CVE-2024-9802
Published: 2024-10-10
Description: The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://github.com/zowe/api-layer
CVE: CVE-2024-22068
Published: 2024-10-10
Description: Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This issue affects ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series: V4.00.10 and earlier.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-269, CWE-521
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]778130472
CVE: CVE-2024-45115
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45116
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially crafted link or submitting a form, malicious scripts may be executed within the context of the victim's browser and have high impact on confidentiality and integrity. Exploitation of this issue requires user interaction.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45117
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the system outside of the intended directories via PHP filter chain and also can have a low-availability impact on the service. Exploitation of this issue does not require user interaction and scope is changed.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45118
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have high impact on integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45119
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45120
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this vulnerability to alter a condition between the check and the use of a resource, having a low impact on integrity. Exploitation of this issue requires user interaction.
CVSS Score: 3.1 (LOW)
CWE: CWE-367
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45121
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45122
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45123
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45124
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45125
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to have a low impact on integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45127
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45128
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity and availability. Exploitation of this issue does not require user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45129
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45130
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45131
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality and integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45132
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect confidentiality. Exploitation of this issue does not require user interaction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45133
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction.
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45134
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45135
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An admin attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45148
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorized access without proper credentials. Exploitation of this issue does not require user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-45149
Published: 2024-10-10
Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE: CVE-2024-8977
Published: 2024-10-10
Description: An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.
CVSS Score: 8.2 (HIGH)
CWE: CWE-918, CWE-918
References: https://gitlab.com/gitlab-org/gitlab/-/issues/491060; https://hackerone.com/reports/2697456
CVE: CVE-2024-9596
Published: 2024-10-10
Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. It was possible for an unauthenticated attacker to determine the GitLab version number for a GitLab instance.
CVSS Score: 3.7 (LOW)
CWE: CWE-540
References: https://gitlab.com/gitlab-org/gitlab/-/issues/493355
CVE: CVE-2024-9623
Published: 2024-10-10
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/459995
CVE: CVE-2024-48902
Published: 2024-10-10
Description: In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-9201
Published: 2024-10-10
Description: The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_order’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-seur-plugin