rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-12356 Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: BeyondTrust
product: Remote Support
default_status: unaffected
vendor: BeyondTrust
product: Privileged Remote Access
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-12-17T04:29:07.883Z
CVE-2024-12357 SourceCodester Best House Rental Management System index.php file inclusion
A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-73
description: File Inclusion
Affected products: vendor: SourceCodester
product: Best House Rental Management System
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: 0xOlV0 (VulDB User)
Published: 2024-12-09T04:31:09.257Z
CVE-2024-12358 WeiYe-Jing datax-web add os command injection
A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipulation of the argument glueSource leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: WeiYe-Jing
product: datax-web
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: jxp. (VulDB User)
Published: 2024-12-09T04:31:11.396Z
CVE-2024-12359 code-projects Admin Dashboard vendor_management.php cross site scripting
A vulnerability was found in code-projects Admin Dashboard 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /vendor_management.php. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting product names.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: code-projects
product: Admin Dashboard
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: salt9487 (VulDB User)
Published: 2024-12-09T05:00:13.606Z
CVE-2024-12360 code-projects Online Class and Exam Scheduling System class_update.php sql injection
A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been rated as critical. This issue affects some unknown processing of the file class_update.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Online Class and Exam Scheduling System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: T123 (VulDB User)
Published: 2024-12-09T05:00:17.841Z
CVE-2024-12362 InvoicePlane invoices.php download path traversal
A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The manipulation of the argument invoice leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: n/a
product: InvoicePlane
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: Dan_AC (VulDB User)
Published: 2024-12-16T10:00:18.068Z
CVE-2024-12363 Insufficient permissions in the TeamViewer Patch & Asset Management component
Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: TeamViewer
product: Patch & Asset Management
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2024-12-11T09:32:04.370Z
CVE-2024-12364 SQLi in Mavi Yeşil Software's Guest Tracking Software
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection.

This issue affects Guest Tracking Software. 

NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Mavi Yeşil Software
product: Guest Tracking Software
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Pınar TAŞĞIN
Published: 2025-06-27T16:13:51.955Z
CVE-2024-12365 W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain the plugin's nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: boldgrid
product: W3 Total Cache
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
baseScore: 8.5
baseSeverity: HIGH
Credits: lang: en
value: Villu Orav
Published: 2025-01-14T07:05:40.307Z
CVE-2024-12366 CVE-2024-12366
PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM.
Problem types: description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Sinaptik AI
product: PandasAI
Published: 2025-02-11T12:42:11.882Z
CVE-2024-12367 Information Disclosure in Vegagrup Software's Vega Master
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing.

This issue affects Vega Master: from v.1.12.35 through 20250916. 

NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Vegagrup Software
product: Vega Master
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Credits: lang: en
value: Yunus ÖRNEK
Published: 2025-09-16T07:46:32.825Z
CVE-2024-12368 
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Odoo
product: Odoo Community
default_status: unaffected
vendor: Odoo
product: Odoo Enterprise
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: eng
value: Rafael Fedler
Published: 2025-02-25T18:10:12.109Z
CVE-2024-12369 Elytron-oidc-client: oidc authorization code injection
A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.
Problem types: cwe_id: CWE-345
description: Insufficient Verification of Data Authenticity
Affected products: default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: This issue was discovered by Olivier Rivat (Red Hat).
Published: 2024-12-09T20:53:09.260Z
CVE-2024-12370 WP Hotel Booking <= 2.1.5 - Missing Authorization
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to add rooms with custom prices.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: thimpress
product: WP Hotel Booking
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Thanh Nam Tran
Published: 2025-01-17T08:25:38.307Z
CVE-2024-12371 Rockwell Automation PowerMonitor™ 1000 Remote Code Execution
A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.
Affected products: vendor: Rockwell Automation
product: PM1k 1408-BC3A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-BC3A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TS3A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TS3A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM3A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM3A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR1A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR2A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM1A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM2A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR1A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR2A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM1A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM2A-ENT
default_status: unaffected
Published: 2024-12-18T15:23:37.736Z
CVE-2024-12372 Rockwell Automation PowerMonitor™ 1000 Denial of Service
A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.
Affected products: vendor: Rockwell Automation
product: PM1k 1408-BC3A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-BC3A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TS3A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TS3A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM3A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM3A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR1A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR2A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM1A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM2A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR1A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR2A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM1A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM2A-ENT
default_status: unaffected
Published: 2024-12-18T15:28:25.266Z
CVE-2024-12373 Rockwell Automation PowerMonitor™ 1000 Denial of Service
A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, potentially causing denial-of-service.
Affected products: vendor: Rockwell Automation
product: PM1k 1408-BC3A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-BC3A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TS3A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TS3A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM3A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM3A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR1A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR2A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM1A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM2A-485
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR1A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-TR2A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM1A-ENT
default_status: unaffected
vendor: Rockwell Automation
product: PM1k 1408-EM2A-ENT
default_status: unaffected
Published: 2024-12-18T15:38:50.826Z
CVE-2024-12374 Stored XSS in automatic1111/stable-diffusion-webui
A stored cross-site scripting (XSS) vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript in the victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: automatic1111
product: automatic1111/stable-diffusion-webui
Published: 2025-03-20T10:08:49.639Z
CVE-2024-12375 Local File Inclusion in automatic1111/stable-diffusion-webui
A local file inclusion vulnerability was identified in automatic1111/stable-diffusion-webui, affecting version git 82a973c. This vulnerability allows an attacker to read arbitrary files on the system by sending a specially crafted request to the application.
Problem types: cwe_id: CWE-36
description: CWE-36 Absolute Path Traversal
Affected products: vendor: automatic1111
product: automatic1111/stable-diffusion-webui
Published: 2025-03-20T10:10:02.746Z
CVE-2024-12376 Server Side Request Forgery in lm-sys/fastchat
A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: lm-sys
product: lm-sys/fastchat
Published: 2025-03-20T10:10:28.790Z
CVE-2024-12378 On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.
On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Arista Networks
product: CloudVision Portal
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-05-08T19:05:22.320Z
CVE-2024-12379 Allocation of Resources Without Limits or Throttling in GitLab
A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [sim4n6](https://hackerone.com/sim4n6) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2025-02-12T15:02:32.062Z
CVE-2024-12380 Generation of Error Message Containing Sensitive Information in GitLab
An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information.
Problem types: cwe_id: CWE-209
description: CWE-209: Generation of Error Message Containing Sensitive Information
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [sigitsetiawansss](https://hackerone.com/sigitsetiawansss) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2025-03-13T05:56:14.642Z
CVE-2024-12381 
Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-843
description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2024-12-11T17:52:05.116Z
CVE-2024-12382 
Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2024-12-11T17:52:05.545Z
CVE-2024-12383 Binary MLM Woocommerce <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'bmw_display_pv_set_page' function and insufficient input sanitization and output escaping of the 'product_points' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: letscms
product: Binary MLM For WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Colin Xu
Published: 2025-01-07T05:23:56.899Z