deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43032
Published: 2024-08-23
Description: autMan v2.9.6 allows attackers to bypass authentication via a crafted web request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/hdbjlizhe/fanli/releases/tag/2.9.6
CVE: CVE-2024-44381
Published: 2024-08-23
Description: D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/GroundCTL2MajorTom/pocs/blob/main/dlink_DI8004W.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-44382
Published: 2024-08-23
Description: D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in the jhttpd upgrade_filter_asp function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/GroundCTL2MajorTom/pocs/blob/main/dlink_DI8004W.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-44386
Published: 2024-08-23
Description: Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function fromSetIpBind.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://github.com/GroundCTL2MajorTom/pocs/blob/main/tenda_FH1206_buffer_overflow2.md
CVE: CVE-2024-32501
Published: 2024-08-23
Description: A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://centreon.com; https://thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3744
CVE: CVE-2024-33852
Published: 2024-08-23
Description: A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3744
CVE: CVE-2024-33853
Published: 2024-08-23
Description: A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3744
CVE: CVE-2024-33854
Published: 2024-08-23
Description: A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3744
CVE: CVE-2024-39841
Published: 2024-08-23
Description: A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3744
CVE: CVE-2024-41841
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41842
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41843
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41844
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41845
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41846
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41847
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41848
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41849
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. An low-privileged attacker could leverage this vulnerability to slightly affect the integrity of the page. Exploitation of this issue requires user interaction and scope is changed.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41875
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41876
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE: CVE-2024-41877
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html
CVE: CVE-2024-41878
Published: 2024-08-23
Description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html
CVE: CVE-2024-42531
Published: 2024-08-23
Description: Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets with a specific set of URLs that can be used to redirect the camera feed. NOTE: the vendor's perspective is that the Anonymous120386 sample code can establish RTSP protocol communictaion, but cannot obtain video or audio data; thus, there is no risk.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://ezviz.com; https://github.com/Anonymous120386/Anonymous
CVE: CVE-2024-42918
Published: 2024-08-23
Description: itsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbitrary code via a crafted payload to the SCHOOLNAME, EMAILADDRES, CONTACTNO, COMPANYNAME and COMPANYCONTACTNO parameters in controller.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/n00bS3cLe4rner/CVE-s/blob/main/CVE-2024-42918.md; https://packetstormsecurity.com; https://github.com/n00bS3cLe4rner/CVE-s/blob/main/CVE-2024-42918.md
CVE: CVE-2024-43794
Published: 2024-08-23
Description: OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is available in 1.3.19 and 2.16.0 for this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/opensearch-project/security-dashboards-plugin/commit/fc4f6a27c0c80881be9e8ed6b9259a25c3fa0e13; https://github.com/opensearch-project/security-dashboards-plugin/security/advisories/GHSA-3fph-6cqp-5mfc
CVE: CVE-2024-44387
Published: 2024-08-23
Description: Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the functino formWrlExtraGet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-121
References: https://github.com/GroundCTL2MajorTom/pocs/blob/main/tenda_FH1206_buffer_overflow1.md
CVE: CVE-2024-44390
Published: 2024-08-23
Description: Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function formWrlsafeset.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/GroundCTL2MajorTom/pocs/blob/main/tenda_FH1206_buffer_overflow8.md
CVE: CVE-2024-7427
Published: 2024-08-23
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Network Node Manager i (NNMi) could allow Cross-Site Scripting (XSS).This issue affects Network Node Manager i (NNMi): 2022.11, 2023.05, 23.4, 24.2.
CWE: CWE-79
References: https://portal.microfocus.com/s/article/KM000033018?language=en_US
CVE: CVE-2024-7428
Published: 2024-08-23
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in OpenText™ Network Node Manager i (NNMi) allows URL Redirector Abuse.This issue affects Network Node Manager i (NNMi): 2022.11, 2023.05, 23.4, 24.2.
CWE: CWE-601
References: https://portal.microfocus.com/s/article/KM000033015?language=en_US
CVE: CVE-2024-42852
Published: 2024-08-23
Description: Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Hebing123/cve/issues/64
CVE: CVE-2024-42992
Published: 2024-08-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-7954
Published: 2024-08-23
Description: The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-95, CWE-1286
References: https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html; https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/; https://vulncheck.com/advisories/spip-porte-plume
CVE: CVE-2024-42845
Published: 2024-08-23
Description: An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary code via loading a crafted DICOM file.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://github.com/invesalius/invesalius3; https://github.com/invesalius/invesalius3/releases; https://github.com/partywavesec/invesalius3_vulnerabilities/tree/main/CVE-2024-42845
CVE: CVE-2024-42914
Published: 2024-08-23
Description: A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-74
References: https://github.com/soursec/CVEs/tree/main/CVE-2024-42914; https://github.com/trquoccuong/ArrowCMS/
CVE: CVE-2024-45187
Published: 2024-08-23
Description: Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server
CVSS Score: 7.1 (HIGH)
CWE: CWE-613, CWE-266
References: https://research.jfrog.com/vulnerabilities/mage-ai-deleted-users-rce-jfsa-2[PII_REDACTED]02/
CVE: CVE-2024-45188
Published: 2024-08-23
Description: Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://research.jfrog.com/vulnerabilities/mage-ai-file-content-request-remote-arbitrary-file-leak-jfsa-2[PII_REDACTED]03/
CVE: CVE-2024-45189
Published: 2024-08-23
Description: Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://research.jfrog.com/vulnerabilities/mage-ai-git-content-request-remote-arbitrary-file-leak-jfsa-2[PII_REDACTED]04/
CVE: CVE-2024-45190
Published: 2024-08-23
Description: Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-35, CWE-35
References: https://research.jfrog.com/vulnerabilities/mage-ai-pipeline-interaction-request-remote-arbitrary-file-leak-jfsa-2[PII_REDACTED]05/
CVE: CVE-2024-37392
Published: 2024-08-23
Description: A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SMS message, which gets executed when the SMS is viewed and specially interacted in web-GUI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.smseagle.eu/security-advisory/resolved-xss-in-smseagle-software-cve-2024-37392/
CVE: CVE-2024-40111
Published: 2024-08-23
Description: A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/10BVQKYo2H1-Nx3FOGteL2xww4lbZ3xlS/view?usp=sharing; https://github.com/w3bn00b3r/Stored-Cross-Site-Scripting-XSS---Automad-2.0.0-alpha.4/
CVE: CVE-2024-38207
Published: 2024-08-23
Description: Microsoft Edge (HTML-based) Memory Corruption Vulnerability
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-843, CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38207
CVE: CVE-2023-0926
Published: 2024-08-24
Description: The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permissions or greater to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/samiahmedsiddiqui/custom-permalinks/pull/96; https://plugins.trac.wordpress.org/changeset/3138206/custom-permalinks/trunk/admin/class-custom-permalinks-post-types-table.php; https://plugins.trac.wordpress.org/changeset/3138206/custom-permalinks/trunk/admin/class-custom-permalinks-taxonomies-table.php
CVE: CVE-2023-6987
Published: 2024-08-24
Description: The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This required WP_DEBUG to be enabled in order to be exploited.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3139143/string-locator/tags/2.6.6/includes/Extension/SQL/views/editor/sql.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/18e0140e-ac24-48c6-aea0-bb0da203a817?source=cve
CVE: CVE-2024-7568
Published: 2024-08-24
Description: The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin. CVE-2024-7864 appears to be a duplicate of this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3139340%40favicon-generator&new=3139340%40favicon-generator&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb3ad80-3510-4018-91af-b733ef62e28f?source=cve
CVE: CVE-2024-2254
Published: 2024-08-24
Description: The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/rt-easy-builder-advanced-addons-for-elementor/trunk/modules/elementor/widgets/pricing-table/template.php#L19; https://www.wordfence.com/threat-intel/vulnerabilities/id/a5fb289e-bd38-42ea-86a4-7816b59bd0b2?source=cve
CVE: CVE-2024-6631
Published: 2024-08-24
Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions, such as updating plugin settings.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3119956/imagerecycle-pdf-image-compression/tags/3.1.15/class/class-image-otimizer.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f330bf36-0a39-40d6-a075-c87fdb9dc2da?source=cve
CVE: CVE-2024-8120
Published: 2024-08-24
Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This makes it possible for unauthenticated attackers to update plugin settings along with performing other actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3119956/imagerecycle-pdf-image-compression/tags/3.1.15/class/class-image-otimizer.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a06bba7f-0259-4b87-b3fe-6ad8318fda7d?source=cve
CVE: CVE-2024-6499
Published: 2024-08-24
Description: The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/maxbuttons/trunk/assets/libraries/font-awesome-5/convert.php; https://plugins.trac.wordpress.org/changeset/3140369/maxbuttons/tags/9.8.0/assets/libraries/font-awesome-5/convert.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd0694c-ea7e-4cf8-a8d8-82a2b02fecdf?source=cve