rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-1602 Stored XSS leading to RCE in parisneo/lollms-webui
parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within the user's browser context, enabling the attacker to send a request to the `/execute_code` endpoint and establish a reverse shell to the attacker's host. The issue affects various components of the application, including the handling of user input and model output.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: parisneo
product: parisneo/lollms-webui
Published: 2024-04-10T17:08:02.423Z
CVE-2024-1603 confirmed
paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: paddlepaddle
product: paddlepaddle/paddle
Published: 2024-03-23T18:24:29.431Z
CVE-2024-1604 Incorrect authorization in BMC Control-M
Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate.







Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: BMC
product: Control-M
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Maksymilian Kubiak [Afine Team]
lang: en
value: Dawid Małecki [Afine Team]
Published: 2024-03-18T09:59:35.514Z
CVE-2024-1605 DLL side-loading in BMC Control-M
BMC Control-M  branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL)  from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. 





Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: BMC
product: Control-M
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Maksymilian Kubiak [Afine Team]
lang: en
value: Dawid Małecki [Afine Team]
Published: 2024-03-18T09:59:49.339Z
CVE-2024-1606 HTML injection in BMC Control-M
Lack of input sanitization in BMC Control-M  branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated  web pages via injection of  HTML code. This might lead to a successful phishing attack for example by tricking users into using a hyperlink pointing to a website controlled by an attacker.

Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.200. 


Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page
Affected products: vendor: BMC
product: Control-M
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Maksymilian Kubiak [Afine Team]
lang: en
value: Dawid Małecki [Afine Team]
Published: 2024-03-18T10:00:05.221Z
CVE-2024-1608 OPPO Usercenter Credit sdk
In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction.
Problem types: description: Escalation of Privilege
Affected products: vendor: OPPO
product: Usercenter Credit sdk
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-02-20T09:09:13.528Z
CVE-2024-1609 OPPO Store APP has a WebView component privilege escalation vulnerability.
In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: OPPO
product: OPPP Store
default_status: unaffected
Published: 2024-12-25T03:14:43.216Z
CVE-2024-1610 OPPO Store app include remote account token hijacking and sensitive information leakage
In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: OPPO
product: OPPO Store APP
default_status: unaffected
Published: 2024-12-18T06:18:48.588Z
CVE-2024-1618 Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard
A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affects the DFServ.exe file. An attacker with local user privileges could exploit this vulnerability to replace the legitimate DFServ.exe service executable with a malicious file of the same name and located in a directory that has a higher priority than the legitimate directory. Thus, when the service starts, it will run the malicious file instead of the legitimate executable, allowing the attacker to execute arbitrary code, gain unauthorized access to the compromised system or stop the service from running.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: Faronics
product: Deep Freeze Server Standard
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Rafael Pedrero
Published: 2024-03-12T15:04:05.067Z
CVE-2024-1619 
Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially force an administrator to click on a malicious link to perform unauthorized actions.
Problem types: cwe_id: CWE-74
description: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Kaspersky
product: Kaspersky Security for Linux Mail Server 8
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Adrian Tiron
lang: en
value: Bogdan Tiron
Published: 2024-02-29T09:22:03.588Z
CVE-2024-1621 uniFLOW Online device registration susceptible to compromise
The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on the tenant. Those tenants utilising email login in combination with Microsoft Safe Links or similar are impacted. This vulnerability may allow the attacker to register themselves against a genuine user in the system and allow malicious users with similar access and capabilities via the app to the existing genuine user.
Problem types: cwe_id: CWE-940
description: CWE-940: Improper Verification of Source of a Communication Channel
Affected products: vendor: NT-ware
product: uniFLOW Online
default_status: unaffected
Published: 2024-09-02T19:53:10.487Z
CVE-2024-1622 Routinator terminates when RTR connection is reset too quickly after opening
Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening.
Problem types: cwe_id: CWE-253
description: CWE-253 Incorrect Check of Function Return Value
Affected products: vendor: NLnet Labs
product: Routinator
default_status: affected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: Yohei Nishimura, Atsushi Enomoto, Ruka Miyachi; Internet Multifeed Co., Japan
Published: 2024-02-26T13:35:51.909Z
CVE-2024-1623 Insufficient session timeout vulnerability in Sagemcom router
Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Sagemcom
product: FAST3686 V2 Vodafone
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2024-03-14T12:47:40.629Z
CVE-2024-1624 OS Command Injection vulnerability affecting documentation server on certain Releases of 3DEXPERIENCE, SIMULIA Abaqus, SIMULIA Isight and CATIA Composer
An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x, SIMULIA Abaqus from Release 2022 through Release 2024, SIMULIA Isight from Release 2022 through Release 2024 and CATIA Composer from Release R2023 through Release R2024. A specially crafted HTTP request can lead to arbitrary command execution.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dassault Systèmes
product: Documentation server
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Published: 2024-03-01T15:47:43.521Z
CVE-2024-1625 IDOR Vulnerability in lunary-ai/lunary
An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails to verify if the project ID provided in the request belongs to the requesting user's organization. As a result, an attacker can delete projects belonging to any organization by sending a crafted DELETE request with the target project's ID. This issue affects the project deletion functionality implemented in the projects.delete route.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: lunary-ai
product: lunary-ai/lunary
Published: 2024-04-10T17:07:55.385Z
CVE-2024-1626 IDOR Vulnerability in lunary-ai/lunary
An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, within the project update endpoint. The vulnerability allows authenticated users to modify the name of any project within the system without proper authorization checks, by directly referencing the project's ID in the PATCH request to the '/v1/projects/:projectId' endpoint. This issue arises because the endpoint does not verify if the provided project ID belongs to the currently authenticated user, enabling unauthorized modifications across different organizational projects.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: lunary-ai
product: lunary-ai/lunary
Published: 2024-04-16T00:00:14.496Z
CVE-2024-1628 OS command injection vulnerabilities in GE HealthCare ultrasound devices
OS command injection vulnerabilities in GE HealthCare ultrasound devices
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: GE HealthCare
product: Venue
default_status: unaffected
vendor: GE HealthCare
product: Venue Go
default_status: unaffected
vendor: GE HealthCare
product: Venue Fit
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ e
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ He
default_status: unaffected
vendor: GE HealthCare
product: Vivid E
default_status: unaffected
vendor: GE HealthCare
product: Vivid S
default_status: unaffected
vendor: GE HealthCare
product: Vivid T
default_status: unaffected
vendor: GE HealthCare
product: Vivid iq
default_status: unaffected
vendor: GE HealthCare
product: Voluson Expert 16
default_status: unaffected
vendor: GE HealthCare
product: Voluson Expert 18
default_status: unaffected
vendor: GE HealthCare
product: Voluson Expert 22
default_status: unaffected
vendor: GE HealthCare
product: Voluson SWIFT
default_status: unaffected
vendor: GE HealthCare
product: Invenia ABUS 2.0
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ E10
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ E10s
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ Fortis
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Andrea Palanca and Gabriele Quagliarella of Nozomi Networks
Published: 2024-05-14T16:04:57.780Z
CVE-2024-1629 Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component
Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: GE HealthCare
product: Venue
default_status: unaffected
vendor: GE HealthCare
product: Venue Go
default_status: unaffected
vendor: GE HealthCare
product: Venue Fit
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ e
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ He
default_status: unaffected
vendor: GE HealthCare
product: Vivid E
default_status: unaffected
vendor: GE HealthCare
product: Vivid S
default_status: unaffected
vendor: GE HealthCare
product: Vivid T
default_status: unaffected
vendor: GE HealthCare
product: Vivid iq
default_status: unaffected
vendor: GE HealthCare
product: Voluson Expert 16
default_status: unaffected
vendor: GE HealthCare
product: Voluson Expert 18
default_status: unaffected
vendor: GE HealthCare
product: Voluson Expert 22
default_status: unaffected
vendor: GE HealthCare
product: Voluson SWIFT
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ E10
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ E10s
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ Fortis
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Andrea Palanca and Gabriele Quagliarella of Nozomi Networks
Published: 2024-05-14T16:32:43.530Z
CVE-2024-1630 Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: GE HealthCare
product: Venue
default_status: unaffected
vendor: GE HealthCare
product: Venue Go
default_status: unaffected
vendor: GE HealthCare
product: Venue Fit
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ e
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ He
default_status: unaffected
vendor: GE HealthCare
product: Vivid E
default_status: unaffected
vendor: GE HealthCare
product: Vivid T
default_status: unaffected
vendor: GE HealthCare
product: Vivid iq
default_status: unaffected
vendor: GE HealthCare
product: Voluson Expert 16
default_status: unaffected
vendor: GE HealthCare
product: Voluson Expert 18
default_status: unaffected
vendor: GE HealthCare
product: Voluson Expert 22
default_status: unaffected
vendor: GE HealthCare
product: Voluson SWIFT
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ E10
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ E10s
default_status: unaffected
vendor: GE HealthCare
product: LOGIQ Fortis
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Andrea Palanca and Gabriele Quagliarella of Nozomi Networks
Published: 2024-05-14T16:55:56.853Z
CVE-2024-1631 agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`
Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness. However, a recent change broke this guarantee and uses an insecure seed for key pair generation. Since the private key of this identity (535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe) is compromised, one could lose funds associated with the principal on ledgers or lose access to a canister where this principal is the controller. 

Problem types: cwe_id: CWE-321
description: CWE-321: Use of Hard-coded Cryptographic Key
cwe_id: CWE-330
description: CWE-330: Use of Insufficiently Random Values
Affected products: vendor: Internet Computer
product: agent-js
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-02-21T02:12:38.403Z
CVE-2024-1632 Incorrect access control in the Sitefinity backend
Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Progress Software Corporation
product: Sitefinity
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-02-28T12:04:45.869Z
CVE-2024-1633 FIP Header Integer Overflow
During the secure boot, bl2 (the second stage of
the bootloader) loops over images defined in the table “bl2_mem_params_descs”.
For each image, the bl2 reads the image length and destination from the image’s
certificate. Because of the way of reading from the image, which base on 32-bit unsigned integer value, it can result to an integer overflow. An attacker can bypass memory range restriction and write data out of buffer bounds, which could result in bypass of secure boot.

 Affected git version from c2f286820471ed276c57e603762bd831873e5a17 until (not 

Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Renesas
product: rcar_gen3_v2.5
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Tomer.Fichman@cymotive.com
Published: 2024-02-19T16:42:29.949Z
CVE-2024-1634 Scheduling Plugin – Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsb_disconnect_settings' function in all versions up to, and including, 3.5.10. This makes it possible for unauthenticated attackers to disconnect the plugin from the startbooking service and remove connection data.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: startbooking
product: Scheduling Plugin – Online Booking for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-06-18T02:37:12.621Z
CVE-2024-1636 Potential Cross-Site Scripting (XSS) in the page editing area
Potential Cross-Site Scripting (XSS) in the page editing area.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Progress Software Corporation
product: Sitefinity
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-02-28T12:05:23.082Z