rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-31390 WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability
: Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a through 1.7.2.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Soflyy
product: Breakdance
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Snicco (Patchstack Alliance)
Published: 2024-04-03T11:39:23.926Z
CVE-2024-31391 Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials
Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator.

This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0.

When asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for accessing Solr: including the "solr" and "admin" accounts for use by end-users, and a "k8s-oper" account which the operator uses for its own requests to Solr.
One common source of these operator requests is healthchecks: liveness, readiness, and startup probes are all used to determine Solr's health and ability to receive traffic.
By default, the operator configures the Solr APIs used for these probes to be exempt from authentication, but users may specifically request that authentication be required on probe endpoints as well.
Whenever one of these probes would fail, if authentication was in use, the Solr Operator would create a Kubernetes "event" containing the username and password of the "k8s-oper" account.

Within the affected version range, this vulnerability affects any solrcloud resource which (1) bootstrapped security through use of the `.solrOptions.security.authenticationType=basic` option, and (2) required authentication be used on probes by setting `.solrOptions.security.probesRequireAuth=true`.

Users are recommended to upgrade to Solr Operator version 0.8.1, which fixes this issue by ensuring that probes no longer print the credentials used for Solr requests.  Users may also mitigate the vulnerability by disabling authentication on their healthcheck probes using the setting `.solrOptions.security.probesRequireAuth=false`.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: Apache Software Foundation
product: Apache Solr Operator
default_status: unaffected
Credits: lang: en
value: Flip Hess
Published: 2024-04-12T15:00:26.569Z
CVE-2024-31392 
If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status This vulnerability affects Firefox for iOS < 124.
Problem types: description: Firefox on iOS would show pages with mixed content secure
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: Chaykin Artem
Published: 2024-04-03T15:19:14.608Z
CVE-2024-31393 
Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerability affects Firefox for iOS < 124.
Problem types: description: Javascript URLs would load when dragged to address bar
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: Muneaki Nishimura
Published: 2024-04-03T15:19:14.045Z
CVE-2024-31394 
Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may obtain arbitrary files on the server.
Problem types: description: Directory traversal
Affected products: vendor: appleple inc.
product: a-blog cms Ver.3.1.x series
vendor: appleple inc.
product: a-blog cms Ver.3.0.x series
vendor: appleple inc.
product: a-blog cms Ver.2.11.x series
vendor: appleple inc.
product: a-blog cms Ver.2.10.x series
vendor: appleple inc.
product: a-blog cms
Published: 2024-05-22T04:35:31.768Z
CVE-2024-31395 
Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may execute an arbitrary script on the web browser of the user who accessed the schedule management page.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: appleple inc.
product: a-blog cms Ver.3.1.x series
vendor: appleple inc.
product: a-blog cms Ver.3.0.x series
vendor: appleple inc.
product: a-blog cms Ver.2.11.x series
vendor: appleple inc.
product: a-blog cms Ver.2.10.x series
vendor: appleple inc.
product: a-blog cms
Published: 2024-05-22T04:35:37.216Z
CVE-2024-31396 
Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may execute an arbitrary command on the server.
Problem types: description: Code injection
Affected products: vendor: appleple inc.
product: a-blog cms Ver.3.1.x series
vendor: appleple inc.
product: a-blog cms Ver.3.0.x series
Published: 2024-05-22T04:35:42.765Z
CVE-2024-31397 
Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with the administrative privilege may be able to cause a denial-of-service (DoS) condition.
Problem types: description: Improper Handling of Extra Values
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2024-06-11T05:34:39.924Z
CVE-2024-31398 
Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product may obtain information on the list of users.
Problem types: description: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2024-06-11T05:20:51.967Z
CVE-2024-31399 
Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, processing a crafted mail may cause a denial-of-service (DoS) condition.
Problem types: description: Excessive Platform Resource Consumption within a Loop
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2024-06-11T05:34:34.564Z
CVE-2024-31400 
Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be left in forwarded mail.
Problem types: description: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2024-06-11T04:26:31.583Z
CVE-2024-31401 
Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the user who is logging in to the product.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2024-06-11T04:26:53.806Z
CVE-2024-31402 
Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared To-Dos.
Problem types: description: Incorrect Authorization
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2024-06-11T05:21:04.938Z
CVE-2024-31403 
Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo.
Problem types: description: Incorrect Authorization
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2024-06-11T04:27:01.971Z
CVE-2024-31404 
Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view the data of Scheduler.
Problem types: description: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2024-06-11T04:27:07.608Z
CVE-2024-31406 
Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-adjacent unauthenticated attacker with access to the device may perform unauthorized operations.
Problem types: description: Active debug code
Affected products: vendor: RoamWiFi Technology Co., Ltd.
product: RoamWiFi R10
Published: 2024-04-24T05:45:37.291Z
CVE-2024-31407 
Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software before version 24.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path
Affected products: vendor: n/a
product: Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-11-13T21:08:20.386Z
CVE-2024-31408 
OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbitrary OS command with root privileges by sending a specially crafted request.
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: AIPHONE CO., LTD.
product: IX-MV
vendor: AIPHONE CO., LTD.
product: IX-MV7-HB
vendor: AIPHONE CO., LTD.
product: IX-MV7-HBT
vendor: AIPHONE CO., LTD.
product: IX-MV7-HW
vendor: AIPHONE CO., LTD.
product: IX-MV7-HWT
vendor: AIPHONE CO., LTD.
product: IX-MV7-HW-JP
vendor: AIPHONE CO., LTD.
product: IX-MV7-B
vendor: AIPHONE CO., LTD.
product: IX-MV7-BT
vendor: AIPHONE CO., LTD.
product: IX-MV7-W
vendor: AIPHONE CO., LTD.
product: IX-MV7-WT
vendor: AIPHONE CO., LTD.
product: IX-DA
vendor: AIPHONE CO., LTD.
product: IX-DAU
vendor: AIPHONE CO., LTD.
product: IX-DB
vendor: AIPHONE CO., LTD.
product: IX-DBT
vendor: AIPHONE CO., LTD.
product: IX-EA
vendor: AIPHONE CO., LTD.
product: IX-EAT
vendor: AIPHONE CO., LTD.
product: IX-EAU
vendor: AIPHONE CO., LTD.
product: IX-DV
vendor: AIPHONE CO., LTD.
product: IX-DVT
vendor: AIPHONE CO., LTD.
product: IX-DVF
vendor: AIPHONE CO., LTD.
product: IX-DVF-P
vendor: AIPHONE CO., LTD.
product: IX-DVF-L
vendor: AIPHONE CO., LTD.
product: IX-DVM
vendor: AIPHONE CO., LTD.
product: IX-DU
vendor: AIPHONE CO., LTD.
product: IX-DVF-RA
vendor: AIPHONE CO., LTD.
product: IX-DVF-2RA
vendor: AIPHONE CO., LTD.
product: IX-BA
vendor: AIPHONE CO., LTD.
product: IX-BAU
vendor: AIPHONE CO., LTD.
product: IX-BB
vendor: AIPHONE CO., LTD.
product: IX-BBT
vendor: AIPHONE CO., LTD.
product: IX-FA
vendor: AIPHONE CO., LTD.
product: IX-SSA
vendor: AIPHONE CO., LTD.
product: IX-SS-2G
vendor: AIPHONE CO., LTD.
product: IX-SS-2GT
vendor: AIPHONE CO., LTD.
product: IX-SS-2G-N
vendor: AIPHONE CO., LTD.
product: IX-BU
vendor: AIPHONE CO., LTD.
product: IX-SSA-RA
vendor: AIPHONE CO., LTD.
product: IX-SSA-2RA
vendor: AIPHONE CO., LTD.
product: IX-RS-B
vendor: AIPHONE CO., LTD.
product: IX-RS-BT
vendor: AIPHONE CO., LTD.
product: IX-RS-W
vendor: AIPHONE CO., LTD.
product: IX-RS-WT
vendor: AIPHONE CO., LTD.
product: IXW-MA
vendor: AIPHONE CO., LTD.
product: IX-SPMIC
vendor: AIPHONE CO., LTD.
product: IXG-2C7
vendor: AIPHONE CO., LTD.
product: IXG-2C7-L
vendor: AIPHONE CO., LTD.
product: IXG-DM7
vendor: AIPHONE CO., LTD.
product: IXG-DM7-HID
vendor: AIPHONE CO., LTD.
product: IXG-DM7-HIDA
vendor: AIPHONE CO., LTD.
product: IXG-DM7-10K
vendor: AIPHONE CO., LTD.
product: IXG-MK
vendor: AIPHONE CO., LTD.
product: IXGW-GW
vendor: AIPHONE CO., LTD.
product: IXGW-TGW
vendor: AIPHONE CO., LTD.
product: IXGW-LC
Published: 2024-11-22T00:10:50.954Z
CVE-2024-31409 CyberPower PowerPanel business Incorrect Authorization
Certain MQTT wildcards are not blocked on the 
CyberPower PowerPanel

system, which might result in an attacker obtaining data from throughout the system after gaining access to any device.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: CyberPower
product: PowerPanel business
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Amir Preminger and Noam Moshe of Claroty Team82 Research reported these vulnerabilities to CISA.
Published: 2024-05-15T20:00:22.532Z
CVE-2024-31410 CyberPower PowerPanel business Use of Hard-coded Cryptographic Key
The devices which CyberPower PowerPanel manages use identical certificates based on a 
hard-coded cryptographic key. This can allow an attacker to impersonate 
any client in the system and send malicious data.
Problem types: cwe_id: CWE-321
description: CWE-321
Affected products: vendor: CyberPower
product: PowerPanel business
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Amir Preminger and Noam Moshe of Claroty Team82 Research reported these vulnerabilities to CISA.
Published: 2024-05-15T19:56:00.616Z
CVE-2024-31411 Apache StreamPipes: Potential remote code execution (RCE) via file upload
Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes.
Such a dangerous type might be an executable file that may lead to a remote code execution (RCE).
The unrestricted upload is only possible for authenticated and authorized users.
This issue affects Apache StreamPipes: through 0.93.0.

Users are recommended to upgrade to version 0.95.0, which fixes the issue.


Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Apache Software Foundation
product: Apache StreamPipes
default_status: unaffected
Credits: lang: en
value: L0ne1y
Published: 2024-07-17T09:22:08.507Z
CVE-2024-31412 
Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 Ver. 9.81 or lower. Opening a specially crafted project file may lead to information disclosure and/or the product being crashed.
Problem types: description: Out-of-bounds read
Affected products: vendor: OMRON Corporation
product: CX-Programmer
Published: 2024-05-01T12:52:13.173Z
CVE-2024-31413 
Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver. 4.61.1 or lower, and was updated through CX-One V4 auto update in January 2024 or prior) and Sysmac Studio SYSMAC-SE2[][][] (The version which was installed with a DVD ver. 1.56 or lower, and was updated through Sysmac Studio V1 auto update in January 2024 or prior). Opening a specially crafted project file may lead to arbitrary code execution.
Problem types: description: Free of pointer not at start of buffer
Affected products: vendor: OMRON Corporation
product: CX-One CX-One CXONE-AL[][]D-V4 
vendor: OMRON Corporation
product: Sysmac Studio SYSMAC-SE2[][][] 
Published: 2024-05-01T12:54:15.483Z
CVE-2024-31414 
The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton Foreseer software lacked proper input sanitization on the server-side, which could lead to injection and execution of malicious scripts when abused by bad actors.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Eaton
product: Foreseer
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Microsoft
Published: 2024-09-13T16:46:51.010Z
CVE-2024-31415 
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. However, the keys used for this encryption were insecurely stored, which could be abused to possibly change or remove the server configuration.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: Eaton
product: Foreseer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Joseph Yim
Published: 2024-09-13T16:48:12.280Z
CVE-2024-31416 
The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of these input fields were not checking the length and bounds of the entered value. The exploit of this security flaw by a bad actor may result in excessive memory consumption or integer overflow.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Eaton
product: Foreseer
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Credits: lang: en
value: Microsoft
Published: 2024-09-13T16:48:32.815Z
CVE-2024-31419 Cnv: information disclosure through the usage of vm-dump-metrics
An information disclosure flaw was found in OpenShift Virtualization. The DownwardMetrics feature was introduced to expose host metrics to virtual machine guests and is enabled by default. This issue could expose limited host metrics of a node to any guest in any namespace without being explicitly enabled by an administrator.
Problem types: cwe_id: CWE-497
description: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Virtualization 4
cpes: cpe:/a:redhat:container_native_virtualization:4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-04-03T14:00:04.329Z
CVE-2024-31420 Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes
A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Virtualization 4
cpes: cpe:/a:redhat:container_native_virtualization:4
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-04-03T14:01:07.124Z
CVE-2024-31421 WordPress Popup by Supsystic plugin <= 1.10.27 - Broken Access Control vulnerability
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.This issue affects Popup by Supsystic: from n/a through <= 1.10.27.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: supsystic
product: Popup by Supsystic
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Steven Julian | Patchstack Bug Bounty Program
Published: 2024-04-15T10:09:53.469Z
CVE-2024-31422 WordPress Favicon by RealFaviconGenerator plugin <= 1.3.29 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Philippe Bernard Favicon.This issue affects Favicon: from n/a through 1.3.29.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Philippe Bernard
product: Favicon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: FearZzZz (Patchstack Alliance)
Published: 2024-04-15T10:08:01.343Z
CVE-2024-31423 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH).This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.5.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Alex Volkov
product: WP Accessibility Helper (WAH)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2024-06-09T17:15:40.861Z