rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-1109 Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: eteubert
product: Podlove Podcast Publisher
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-02-07T11:02:39.482Z
CVE-2024-1110 Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: eteubert
product: Podlove Podcast Publisher
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-02-07T11:02:38.853Z
CVE-2024-1111 SourceCodester QR Code Login System add-user.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Login System 1.0. Affected by this issue is some unknown functionality of the file add-user.php. The manipulation of the argument qr-code leads to cross site scripting. The attack may be launched remotely. VDB-252470 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: QR Code Login System
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: mikel22 (VulDB User)
Published: 2024-01-31T19:00:06.546Z
CVE-2024-1112 Buffer Overflow Vulnerability in Resource Hacker
Heap-based buffer overflow vulnerability in Resource Hacker, developed by Angus Johnson, affecting version 3.6.0.92. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Angus Johnson
product: Resource Hacker
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Rafael Pedrero
Published: 2024-01-31T13:17:59.316Z
CVE-2024-1113 openBI Unity.php uploadUnity unrestricted upload
A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/controller/Unity.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252471.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: n/a
product: openBI
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: glzjin (VulDB User)
Published: 2024-01-31T19:31:03.971Z
CVE-2024-1114 openBI Screen.php dlfile access control
A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/controller/Screen.php. The manipulation of the argument fileUrl leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252472.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Controls
Affected products: vendor: n/a
product: openBI
CVSS v3.1: version: 3.1
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: glzjin (VulDB User)
Published: 2024-01-31T19:31:05.018Z
CVE-2024-1115 openBI Setting.php dlfile os command injection
A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252473 was assigned to this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: n/a
product: openBI
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: glzjin (VulDB User)
Published: 2024-01-31T20:00:05.046Z
CVE-2024-1116 openBI Upload.php index unrestricted upload
A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application/plugins/controller/Upload.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-252474 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: n/a
product: openBI
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: glzjin (VulDB User)
Published: 2024-01-31T20:00:06.237Z
CVE-2024-1117 openBI Screen.php index code injection
A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /application/index/controller/Screen.php. The manipulation of the argument fileurl leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252475.
Problem types: cwe_id: CWE-94
description: CWE-94 Code Injection
Affected products: vendor: n/a
product: openBI
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: glzjin (VulDB User)
Published: 2024-01-31T20:31:04.310Z
CVE-2024-1118 Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection
The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: chemiker
product: Podlove Subscribe button
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Lucio Sá
Published: 2024-02-07T11:02:39.957Z
CVE-2024-1119 Order Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data Export
The Order Tip for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_tips_to_csv() function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to export the plugin's order fees.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: railmedia
product: Order Tip for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Francesco Carlucci
Published: 2024-03-20T06:48:26.874Z
CVE-2024-1120 NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure
The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the download_tools_settings() function in all versions up to, and including, 2.17.0. This makes it possible for unauthenticated attackers to export system information that can aid attackers in an attack.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: djeet
product: Finale Lite – Sales Countdown Timer & Discount for WooCommerce
default_status: unaffected
vendor: xlplugins
product: NextMove Lite – Thank You Page for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Francesco Carlucci
Published: 2024-03-01T09:31:40.619Z
CVE-2024-1121 Advanced Forms for ACF <= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export
The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_json_file() function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: philkurth
product: Advanced Forms for ACF
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Francesco Carlucci
Published: 2024-02-05T21:21:51.919Z
CVE-2024-1122 Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export
The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: arraytics
product: Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Francesco Carlucci
Published: 2024-02-09T04:31:53.959Z
CVE-2024-1123 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_frontend_event_submission() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary posts. This can also be exploited by unauthenticated attackers when the allow_submission_by_anonymous_user setting is enabled.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: metagauss
product: EventPrime – Events Calendar, Bookings and Tickets
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-03-09T07:01:09.193Z
CVE-2024-1124 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: metagauss
product: EventPrime – Events Calendar, Bookings and Tickets
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-03-09T07:01:04.693Z
CVE-2024-1125 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: metagauss
product: EventPrime – Events Calendar, Bookings and Tickets
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-03-09T07:01:10.355Z
CVE-2024-1126 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_attendees_email_by_event_id() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to to retrieve the attendees list for any event.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: metagauss
product: EventPrime – Events Calendar, Bookings and Tickets
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-03-13T15:27:16.554Z
CVE-2024-1127 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the booking_export_all() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all event booking which can contain PII.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: metagauss
product: EventPrime – Events Calendar, Bookings and Tickets
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-03-13T15:26:44.282Z
CVE-2024-1128 Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting
Problem types: cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: themeum
product: Tutor LMS – eLearning and online course solution
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Pedro Paniago
Published: 2024-02-20T18:56:22.265Z
CVE-2024-1129 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_starred() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as starred.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: webaways
product: NEX-Forms – Ultimate Forms Plugin for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Francesco Carlucci
Published: 2024-02-01T04:31:54.943Z
CVE-2024-1130 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_read() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as read.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: webaways
product: NEX-Forms – Ultimate Forms Plugin for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Francesco Carlucci
Published: 2024-02-01T04:31:55.418Z
CVE-2024-1133 Tutor LMS <= 2.6.0 - Missing Authorization
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with subscriber access or higher, to interact with questions in courses in which they are not enrolled including private courses.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: themeum
product: Tutor LMS – eLearning and online course solution
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Pedro Paniago
Published: 2024-02-20T18:56:49.287Z
CVE-2024-1134 SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as well as others in all versions up to, and including, 7.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: rainbowgeek
product: SEOPress – On-site SEO & Analytics
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Daffa
Published: 2024-05-24T05:30:53.488Z
CVE-2024-1135 HTTP Request Smuggling in benoitc/gunicorn
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests
Affected products: vendor: benoitc
product: benoitc/gunicorn
Published: 2024-04-16T00:00:14.938Z
CVE-2024-1136 Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass
The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented URL check in the wpsm_coming_soon_redirect function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to view a site with maintenance mode or coming-soon mode enabled to view the site's content.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: wpshopmart
product: Coming Soon Page & Maintenance Mode
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-02-28T08:33:13.484Z
CVE-2024-1137 TIBCO ActiveSpaces Information Leak Vulnerability
The Proxy and Client components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition contain a vulnerability that theoretically allows an Active Spaces client to passively observe data traffic to other clients. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition: versions 4.4.0 through 4.9.0.


Problem types: description: This impact of this vulnerability includes the theoretical possibility of bypassing table access controls.  The attacker cannot actively make queries, but may observe the results of queries by other clients, even though the attacker does not have permission to access that data.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveSpaces - Enterprise Edition
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-03-12T17:31:19.481Z