rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-52320 Planet Technology Planet WGS-804HPT Command Injection
The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Planet Technology
product: Planet WGS-804HPT
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tomer Goldschmidt of Claroty Research - Team82 reported this vulnerability to CISA.
Published: 2024-12-06T17:21:44.801Z
CVE-2024-52321 
Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files containing sensitive information may be retrieved by a remote unauthenticated attacker.
Problem types: cwe_id: CWE-497
description: Exposure of sensitive system information to an unauthorized control sphere
Affected products: vendor: Sharp Corporation
product: home 5G HR02
vendor: Sharp Corporation
product: Wi-Fi STATION SH-52B
vendor: Sharp Corporation
product: Wi-Fi STATION SH-54C
vendor: Sharp Corporation
product: Wi-Fi STATION SH-05L
vendor: Sharp Corporation
product: PocketWifi 809SH
vendor: Sharp Corporation
product: Speed Wi-Fi NEXT W07
Published: 2024-12-23T00:18:08.358Z
CVE-2024-52322 WebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions
WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Specifically WebService::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
Problem types: cwe_id: CWE-338
description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
cwe_id: CWE-331
description: CWE-331 Insufficient Entropy
Affected products: vendor: LOCALSHOP
product: WebService::Xero
default_status: unaffected
Credits: lang: en
value: Robert Rothenberg (RRWO)
Published: 2025-04-05T16:19:16.490Z
CVE-2024-52323 Sensitive Data Exposure
Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: ManageEngine
product: Analytics Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-11-27T09:54:07.999Z
CVE-2024-52324 Ruijie Reyee OS Use of Inherently Dangerous Function
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands.
Problem types: cwe_id: CWE-242
description: CWE-242
Affected products: vendor: Ruijie
product: Reyee OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tomer Goldschmidt and Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA.
Published: 2024-12-06T18:25:06.031Z
CVE-2024-52325 ECOVACS robot lawnmowers and vacuums command injection
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: ECOVACS
product: GOAT G1
default_status: unknown
vendor: ECOVACS
product: GOAT G1-800
default_status: unknown
vendor: ECOVACS
product: DEEBOT X2S
default_status: unknown
vendor: ECOVACS
product: DEEBOT X5 PRO
default_status: unknown
vendor: ECOVACS
product: DEEBOT X5 PRO PLUS
default_status: unknown
vendor: ECOVACS
product: DEEBOT T30 OMNI
default_status: unknown
vendor: ECOVACS
product: DEEBOT T30S
default_status: unknown
vendor: ECOVACS
product: GOAT G1-2000
default_status: unknown
vendor: ECOVACS
product: GOAT GX-600
default_status: unknown
vendor: ECOVACS
product: DEEBOT X2  OMNI
default_status: unknown
vendor: ECOVACS
product: DEEBOT X2 COMBO
default_status: unknown
vendor: ECOVACS
product: DEEBOT X5 PRO ULTRA
default_status: unknown
CVSS v3.1: baseScore: 9.6
baseSeverity: CRITICAL
version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-01-23T15:56:30.185Z
CVE-2024-52327 ECOVACS lawnmower and vacuum cloud service live video PIN bypass
The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.
Problem types: cwe_id: CWE-603
description: CWE-603 Use of Client-Side Authentication
cwe_id: CWE-807
description: CWE-807 Reliance on Untrusted Inputs in a Security Decision
Affected products: vendor: ECOVACS
product: ECOVACS HOME
default_status: unknown
vendor: ECOVACS
product: cloud service
default_status: unknown
CVSS v3.1: baseScore: 6.5
baseSeverity: MEDIUM
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: 2025-01-23T16:39:27.516Z
CVE-2024-52328 ECOVACS lawnmowers and vacuums insecurely store audio warning files
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: ECOVACS
product: Unspecified robots
default_status: unknown
CVSS v3.1: baseScore: 2.3
baseSeverity: LOW
version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Published: 2025-01-23T16:35:23.197Z
CVE-2024-52329 ECOVACS HOME mobile app plugins do not properly validate TLS certificates
ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: ECOVACS
product: ECOVACS HOME
default_status: unknown
CVSS v3.1: baseScore: 7.4
baseSeverity: HIGH
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2025-01-23T16:36:06.533Z
CVE-2024-52330 ECOVACS lawnmowers and vacuums do not properly validate TLS certificates
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: ECOVACS
product: DEEBOT X5 PRO PLUS
default_status: unknown
vendor: ECOVACS
product: DEEBOT X5 PRO
default_status: unknown
vendor: ECOVACS
product: DEEBOT X2S
default_status: unknown
vendor: ECOVACS
product: DEEBOT X2  OMNI
default_status: unknown
vendor: ECOVACS
product: DEEBOT X1 TURBO
default_status: unknown
vendor: ECOVACS
product: DEEBOT X1
default_status: unknown
vendor: ECOVACS
product: DEEBOT X1S PRO
default_status: unknown
vendor: ECOVACS
product: DEEBOT X1e OMNI
default_status: unknown
vendor: ECOVACS
product: DEEBOT T10 PLUS
default_status: unknown
vendor: ECOVACS
product: DEEBOT T10 OMNI
default_status: unknown
vendor: ECOVACS
product: DEEBOT X5 PRO ULTRA
default_status: unknown
vendor: ECOVACS
product: Mate X
default_status: unknown
vendor: ECOVACS
product: DEEBOT X2 PRO
default_status: unknown
vendor: ECOVACS
product: DEEBOT X2 COMBO
default_status: unknown
vendor: ECOVACS
product: DEEBOT X1 OMNI
default_status: unknown
vendor: ECOVACS
product: DEEBOT X1 PRO OMNI
default_status: unknown
vendor: ECOVACS
product: DEEBOT X1 PLUS
default_status: unknown
vendor: ECOVACS
product: DEEBOT X1S PRO PLUS
default_status: unknown
vendor: ECOVACS
product: DEEBOT T10 TURBO
default_status: unknown
vendor: ECOVACS
product: DEEBOT T10
default_status: unknown
CVSS v3.1: baseScore: 7.4
baseSeverity: HIGH
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2025-01-23T16:36:50.128Z
CVE-2024-52331 ECOVACS lawnmowers and vacuums deterministic firmware encryption key
ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
cwe_id: CWE-1391
description: CWE-1391 Use of Weak Credentials
cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: ECOVACS
product: Unspecified robots
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2025-01-23T16:37:31.290Z
CVE-2024-52332 igb: Fix potential invalid memory access in igb_init_module()
In the Linux kernel, the following vulnerability has been resolved:

igb: Fix potential invalid memory access in igb_init_module()

The pci_register_driver() can fail and when this happened, the dca_notifier
needs to be unregistered, otherwise the dca_notifier can be called when
igb fails to install, resulting to invalid memory access.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2025-01-11T12:25:21.014Z
CVE-2024-52333 
An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: OFFIS
product: DCMTK
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Emmanuel Tacheau of Cisco Talos.
Published: 2025-01-13T14:10:57.919Z
CVE-2024-52334 
A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwords properly.
This could allow an attacker to recover the original passwords and might gain unauthorized access.
Problem types: cwe_id: CWE-261
description: CWE-261: Weak Encoding for Password
Affected products: vendor: Siemens
product: syngo.plaza VB30E
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2026-02-10T09:58:33.733Z
CVE-2024-52335 
A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF05). The affected application do not properly sanitize input data before sending it to the SQL server. This could allow an attacker with access to the application could use this vulnerability to execute malicious SQL commands to compromise the whole database.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: syngo.plaza VB30E
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2024-12-06T13:14:16.935Z
CVE-2024-52336 Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root
A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management
Affected products: default_status: unaffected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::sap
cpe:/a:redhat:enterprise_linux:9::sap_hana
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/a:redhat:enterprise_linux:9::nfv
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::sap
cpe:/a:redhat:enterprise_linux:9::sap_hana
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/a:redhat:enterprise_linux:9::nfv
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Matthias Gerstner (SUSE Security Team) for reporting this issue.
Published: 2024-11-26T15:21:13.518Z
CVE-2024-52338 Apache Arrow R package: Arbitrary code execution when loading a malicious data file
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it 
reads Arrow IPC, Feather or Parquet data from untrusted sources (for 
example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow 
implementations or bindings unless those bindings are specifically used via the R package (for example, an R application that embeds a Python interpreter and uses PyArrow to read files from untrusted sources is still vulnerable if the arrow R package is an affected version). It is recommended that users of the arrow R package upgrade to 17.0.0 or later. Similarly, it
 is recommended that downstream libraries upgrade their dependency 
requirements to arrow 17.0.0 or later. If using an affected
version of the package, untrusted data can read into a Table and its internal to_data_frame() method can be used as a workaround (e.g., read_parquet(..., as_data_frame = FALSE)$to_data_frame()).


This issue affects the Apache Arrow R package: from 4.0.0 through 16.1.0.


Users are recommended to upgrade to version 17.0.0, which fixes the issue.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Arrow R package
default_status: unaffected
Published: 2024-11-28T16:31:44.087Z
CVE-2024-52339 WordPress Mage Front End Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maximilian Ruthe Mage Front End Forms mage-forms allows Stored XSS.This issue affects Mage Front End Forms: from n/a through <= 1.1.4.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Maximilian Ruthe
product: Mage Front End Forms
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-11-18T22:15:57.283Z
CVE-2024-52340 WordPress Photographer Connections plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MartyThornley Photographer Connections photographer-connections allows Stored XSS.This issue affects Photographer Connections: from n/a through <= 1.3.1.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MartyThornley
product: Photographer Connections
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-11-18T22:14:42.784Z
CVE-2024-52341 WordPress OS Our Team plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Our Team os-our-team allows Stored XSS.This issue affects OS Our Team: from n/a through <= 1.7.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Offshorent Solutions Pvt Ltd
product: OS Our Team
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-11-18T22:02:51.491Z
CVE-2024-52342 WordPress OS BXSlider plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS BXSlider os-bxslider allows Stored XSS.This issue affects OS BXSlider: from n/a through <= 2.6.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Offshorent Solutions Pvt Ltd
product: OS BXSlider
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-11-18T22:01:36.489Z
CVE-2024-52343 WordPress OS Pricing Tables plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Pricing Tables os-pricing-tables allows Stored XSS.This issue affects OS Pricing Tables: from n/a through <= 1.2.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Offshorent Solutions Pvt Ltd
product: OS Pricing Tables
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-11-18T22:00:17.057Z
CVE-2024-52344 WordPress Provide Forex Signals plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeies Pvt Ltd Provide Forex Signals provide-forex-signals allows Stored XSS.This issue affects Provide Forex Signals: from n/a through <= 1.0.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Codeies Pvt Ltd
product: Provide Forex Signals
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-11-18T21:59:12.849Z
CVE-2024-52345 WordPress ra_qrcode plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RobertoAlicata ra_qrcode ra-qrcode allows Stored XSS.This issue affects ra_qrcode: from n/a through <= 2.1.0.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: RobertoAlicata
product: ra_qrcode
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-11-18T21:57:24.765Z