rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-35492 
Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-29T19:27:15.910Z
CVE-2024-35495 
An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.143947 allows attackers to observe device state via observing network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-30T00:00:00.000Z
CVE-2024-35498 
A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-06T00:00:00.000Z
CVE-2024-35504 
A cross-site scripting (XSS) vulnerability in the login page of FineSoft v8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL:errorname parameter after a failed login attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T15:01:10.677Z
CVE-2024-35510 
An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T19:35:21.599Z
CVE-2024-35511 
phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T20:35:52.644Z
CVE-2024-35512 
hmq v1.5.5 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. A remote attacker can trigger a broker crash by sending a specially crafted MQTT UNSUBSCRIBE packet with an illegal control character Topic. The failure to properly validate this field leads to a null pointer dereference, resulting in the immediate termination of the hmq process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-29T16:55:34.086Z
CVE-2024-35515 
Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-18T00:00:00.000Z
CVE-2024-35517 
Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Published: 2024-10-11T00:00:00.000Z
CVE-2024-35518 
Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Published: 2024-10-14T00:00:00.000Z
CVE-2024-35519 
Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Published: 2024-10-14T00:00:00.000Z
CVE-2024-35520 
Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Published: 2024-10-14T00:00:00.000Z
CVE-2024-35522 
Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operating_mode.cgi via the ap_mode parameter with ap_24g_manual set to 1 and ap_24g_manual_sec set to NotNone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Published: 2024-10-11T00:00:00.000Z
CVE-2024-35526 
An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-25T00:00:00.000Z
CVE-2024-35527 
An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-25T00:00:00.000Z
CVE-2024-35532 
An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service (DoS) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-35537 
TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS v5.0.0 was discovered to insecurely handle the RSA key pair, allowing attackers to possibly access sensitive information via decryption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-21T00:00:00.000Z
CVE-2024-35538 
Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-19T00:00:00.000Z
CVE-2024-35539 
Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequently.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-19T00:00:00.000Z
CVE-2024-35540 
A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-35545 
MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-26T00:00:00.000Z
CVE-2024-35548 
A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T20:25:46.745Z
CVE-2024-35550 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=rev.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:46.600Z
CVE-2024-35551 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:47.219Z
CVE-2024-35552 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=del&dataType=logo&dataTypeCN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:47.959Z
CVE-2024-35553 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=add&nohrefStr=close.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:48.665Z
CVE-2024-35554 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:49.270Z
CVE-2024-35555 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=newsWeb&fieldName=state&fieldName2=state&tabName=infoWeb&dataID=40.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:51.933Z
CVE-2024-35556 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:50.603Z
CVE-2024-35557 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:52.607Z
CVE-2024-35558 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=rev&nohrefStr=close.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:53.268Z
CVE-2024-35559 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=rev&nohrefStr=close.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:54.163Z
CVE-2024-35560 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=del&dataType=&dataTypeCN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:55.636Z
CVE-2024-35561 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:38:57.449Z
CVE-2024-35563 
CDG-Server-V5.6.2.126.139 and earlier was discovered to contain a SQL injection vulnerability via the permissionId parameter in CDGTempPermissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T16:37:29.791Z
CVE-2024-35570 
An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via uploading a crafted jsp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T18:29:28.395Z
CVE-2024-35571 
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:20:18.515Z
CVE-2024-35576 
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:28:46.578Z
CVE-2024-35578 
Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:30:12.354Z
CVE-2024-35579 
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:27:18.379Z
CVE-2024-35580 
Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:25:23.490Z
CVE-2024-35581 
A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Borrower Name input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T19:47:43.465Z
CVE-2024-35582 
A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Department input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T19:40:26.807Z
CVE-2024-35583 
A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Remarks input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T19:52:53.696Z
CVE-2024-35584 
SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from "X-Forwarded-For" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-35591 
An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T13:50:27.504Z
CVE-2024-35592 
An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T14:06:03.524Z
CVE-2024-35593 
An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T13:35:06.859Z
CVE-2024-35595 
An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T13:33:00.490Z
CVE-2024-35618 
PingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T14:50:43.899Z
CVE-2024-35621 
A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T15:40:26.625Z
CVE-2024-35627 
tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T19:10:43.016Z
CVE-2024-35628 WordPress Photo Gallery by 10Web plugin <= 1.8.25 - Broken Access Control vulnerability
Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.25.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Photo Gallery Team
product: Photo Gallery by 10Web
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Dhabaleshwar Das (Patchstack Alliance)
Published: 2024-06-11T14:29:55.643Z
CVE-2024-35629 WordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads – Recent Purchases allows PHP Remote File Inclusion.This issue affects Easy Digital Downloads – Recent Purchases: from n/a through 1.0.2.
Problem types: cwe_id: CWE-98
description: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: Wow-Company
product: Easy Digital Downloads – Recent Purchases
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: YC_Infosec (Patchstack Alliance)
Published: 2024-06-04T13:34:26.928Z
CVE-2024-35630 WordPress WP TripAdvisor Review Slider plugin <= 12.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LJ Apps WP TripAdvisor Review Slider allows Blind SQL Injection.This issue affects WP TripAdvisor Review Slider: from n/a through 12.6.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: LJ Apps
product: WP TripAdvisor Review Slider
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: Do Truong Giang (Patchstack Alliance)
Published: 2024-06-03T10:27:07.336Z
CVE-2024-35631 WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.45.7212.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Foliovision
product: FV Flowplayer Video Player
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Dimas Maulana (Patchstack Alliance)
Published: 2024-06-03T10:30:46.320Z
CVE-2024-35632 WordPress Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through 1.1.5.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: CRM Perks.
product: Integration for Contact Form 7 and Constant Contact
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Joshua Chan (Patchstack Alliance)
Published: 2024-06-03T11:49:26.419Z
CVE-2024-35633 WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF)
Affected products: vendor: Creative Themes
product: Blocksy Companion
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Yuchen Ji | Patchstack Bug Bounty Program
Published: 2024-06-03T10:04:57.329Z
CVE-2024-35634 Woocommerce – Recent Purchases plugin <= 1.0.1 -  File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wow-Company Woocommerce – Recent Purchases allows PHP Local File Inclusion.This issue affects Woocommerce – Recent Purchases: from n/a through 1.0.1.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Wow-Company
product: Woocommerce – Recent Purchases
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: YC_Infosec (Patchstack Alliance)
Published: 2024-06-04T13:36:40.403Z