yahoo-inc/cve-impacts huggingface dataset:
CVE-2024-24841: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan's Art Add Customer for WooCommerce allows Stored XSS.This issue affects Add Customer for WooCommerce: from n/a through 1.7.
Key phrases: Stored XSS.This issue affects Add Customer for WooCommerce, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-24842: Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2.
Key phrases: deserialization of untrusted data
CVE-2024-24843: Cross-Site Request Forgery (CSRF) vulnerability in PowerPack Addons for Elementor PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a before 2.10.8.
Key phrases: cross-site request forgery (csrf)
CVE-2024-24845: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sewpafly Post Thumbnail Editor.This issue affects Post Thumbnail Editor: from n/a through 2.4.8.
Key phrases: exposure of sensitive information
CVE-2024-24846: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MightyThemes Mighty Addons for Elementor allows Reflected XSS.This issue affects Mighty Addons for Elementor: from n/a through 1.9.3.
Key phrases: Reflected XSS.This issue affects Mighty Addons for Elementor, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-24847: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgadbois CalculatorPro Calculators allows Reflected XSS.This issue affects CalculatorPro Calculators: from n/a through 1.1.7.
Key phrases: Reflected XSS.This issue affects CalculatorPro Calculators: from, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-24848: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MJS Software PT Sign Ups  Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups  Beautiful volunteer sign ups and management made easy: from n/a through 1.0.4.
Key phrases: Stored XSS.This issue affects PT Sign Ups  , cross-site scripting, stored xss
CVE-2024-24849: Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Key phrases: cross-site request forgery (csrf)
CVE-2024-2485: A vulnerability was found in Tenda AC18 15.03.05.05 and classified as critical. Affected by this issue is the function formSetSpeedWan of the file /goform/SetSpeedWan. The manipulation of the argument speed_dir leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256892. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-24855: A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
Key phrases: race condition, null pointer dereference issue, denial of service issue
CVE-2024-24857: A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.
Key phrases: race condition, integrity overflow, denial of service
CVE-2024-24858: A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.
Key phrases: race condition, broadcast abnormality issue, denial of service
CVE-2024-24859: A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.
Key phrases: race condition, denial of service
CVE-2024-2486: A vulnerability was found in Tenda AC18 15.03.05.05. It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256893 was assigned to this vulnerability.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2024-24860: A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
Key phrases: race condition, null pointer dereference issue, denial of service issue
CVE-2024-24861: A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to malfunction or denial of service issue.
Key phrases: race condition, return value overflow issue, denial of service issue
CVE-2024-24864: A race condition was found in the Linux kernel's media/dvb-core in dvbdmx_write()function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
Key phrases: race condition, null pointer dereference issue, denial of service
CVE-2024-24865: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan Scroll Triggered Box allows Stored XSS.This issue affects Scroll Triggered Box: from n/a through 2.3.
Key phrases: Stored XSS.This issue affects Scroll Triggered Box:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-24866: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Reflected XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24.
Key phrases: Reflected XSS.This issue affects Biteship: Plugin Ongkos, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-24867: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Osamaesh WP Visitor Statistics (Real Time Traffic).This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 6.9.4.
Key phrases: exposure of sensitive information
CVE-2024-24868: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69.
Key phrases: sql command, sql injection
CVE-2024-2487: A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName/mac leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256894 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-24870: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.10.
Key phrases: Stored XSS.This issue affects Advanced iFrame: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-24871: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy allows Stored XSS.This issue affects Blocksy: from n/a through 2.0.19.
Key phrases: Stored XSS.This issue affects Blocksy: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-24872: Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5.
Key phrases: cross-site request forgery (csrf)
CVE-2024-24875: Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.This issue affects Link Library: from n/a through 7.5.13.
Key phrases: cross-site request forgery (csrf)
CVE-2024-24876: Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12.
Key phrases: cross-site request forgery (csrf)
CVE-2024-24877: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected XSS.This issue affects Wonder Slider Lite: from n/a through 13.9.
Key phrases: Reflected XSS.This issue affects Wonder Slider Lite:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-24878: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Woo Plugins (by Webdados) Portugal CTT Tracking for WooCommerce allows Reflected XSS.This issue affects Portugal CTT Tracking for WooCommerce: from n/a through 2.1.
Key phrases: Reflected XSS.This issue affects Portugal CTT Tracking for, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-24879: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.5.13.
Key phrases: Reflected XSS.This issue affects Link Library: from, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-2488: A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIP leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256895. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-24880: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.2.
Key phrases: Stored XSS.This issue affects Apollo13 Framework Extensions:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-24881: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS  Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS  Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.5.2.
Key phrases: Reflected XSS.This issue affects WP SMS  Messaging, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-24884: Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft Contact Form 7 Connector.This issue affects Contact Form 7 Connector: from n/a through 1.2.2.
Key phrases: cross-site request forgery (csrf)
CVE-2024-24885: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in L Van To?n Woocommerce Vietnam Checkout allows Stored XSS.This issue affects Woocommerce Vietnam Checkout: from n/a through 2.0.7.
Key phrases: Stored XSS.This issue affects Woocommerce Vietnam Checkout:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-24886: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acowebs Product Labels For Woocommerce (Sale Badges) allows Stored XSS.This issue affects Product Labels For Woocommerce (Sale Badges): from n/a through 1.5.3.
Key phrases: Stored XSS.This issue affects Product Labels For Woocommerce, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-24887: Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery  Contact Form, Upload Form, Social Share and Voting Plugin for WordPress.This issue affects Photos and Files Contest Gallery  Contact Form, Upload Form, Social Share and Voting Plugin for WordPress: from n/a through 21.2.8.4.
Key phrases: cross-site request forgery (csrf)
CVE-2024-24888: Server-Side Request Forgery (SSRF) vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.2.25.
Key phrases: server-side request forgery (ssrf)
CVE-2024-24889: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Geek Code Lab All 404 Pages Redirect to Homepage allows Stored XSS.This issue affects All 404 Pages Redirect to Homepage: from n/a through 1.9.
Key phrases: Homepage: from n/a through 1.9, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-2489: A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetQosBand of the file /goform/SetNetControlList. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256896. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-24890: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/extends/ebpf.Probe/src/ioprobe/ioprobe.C.This issue affects gala-gopher: through 1.0.2.
Key phrases: Command Injection, improper neutralization of special elements, os command injection
CVE-2024-24892: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulnerability is associated with program files https://gitee.Com/openeuler/migration-tools/blob/master/index.Py.This issue affects migration-tools: from 1.0.0 through 1.0.1.
Key phrases: Command Injection, improper neutralization of special elements, command injection, improper privilege management, restful privilege elevation
CVE-2024-24897: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py.This issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0.
Key phrases: Command Injection, command injection
CVE-2024-24899: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.This issue affects aops-zeus: from 1.2.0 through 1.4.0.
Key phrases: Command Injection, improper neutralization of special elements, os command injection
CVE-2024-2490: A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256897 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-24900: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized devices added to policies. Exploitation may lead to information disclosure and unauthorized access to the system.
Key phrases: improper authorization, information disclosure, unauthorized access
CVE-2024-24901: Dell PowerScale OneFS 8.2.x through 9.6.0.x contain an insufficient logging vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability, causing audit messages lost and not recorded for a specific time period.
Key phrases: logging
CVE-2024-24903: Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change.
Key phrases: weak password recovery mechanism, unauthorized access
CVE-2024-24904: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
Key phrases: stored cross-site scripting, information disclosure, session theft, client-side request forgery
CVE-2024-24905: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
Key phrases: stored cross-site scripting, information disclosure, session theft, client-side request forgery
CVE-2024-24906: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
Key phrases: stored cross-site scripting, information disclosure, session theft, client-side request forgery
CVE-2024-24907: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
Key phrases: stored cross-site scripting, information disclosure, session theft, client-side request forgery
CVE-2024-2491: The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the *_html_tag* attribute of multiple widgets in all versions up to, and including, 2.7.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-24920: A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21710)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2024-24921: A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application is vulnerable to memory corruption while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21712)
Key phrases: execute code in the context of the current, memory corruption
CVE-2024-24922: A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21715)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2024-24923: A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000), Simcenter Femap (All versions < V2306.0001). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22055)
Key phrases: execute code in the context of the current, out of bounds read
CVE-2024-24924: A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22059)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2024-24925: A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted Catia MODEL files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-22060)
Key phrases: uninitialized pointer access, execute code
CVE-2024-24926: Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
Key phrases: deserialization of untrusted data
CVE-2024-24927: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme allows Reflected XSS.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
Key phrases: Reflected XSS.This issue affects Brooklyn | Creative Multi, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-24928: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arunas Liuiza Content Cards allows Stored XSS.This issue affects Content Cards: from n/a through 0.9.7.
Key phrases: Stored XSS.This issue affects Content Cards: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-24929: Cross-Site Request Forgery (CSRF) vulnerability in Ryan Duff, Peter Westwood WP Contact Form.This issue affects WP Contact Form: from n/a through 1.6.
Key phrases: cross-site request forgery (csrf)
CVE-2024-24930: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes.Com Buttons Shortcode and Widget allows Stored XSS.This issue affects Buttons Shortcode and Widget: from n/a through 1.16.
Key phrases: Stored XSS.This issue affects Buttons Shortcode and Widget, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-24931: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in swadeshswain Before After Image Slider WP allows Stored XSS.This issue affects Before After Image Slider WP: from n/a through 2.2.
Key phrases: Stored XSS.This issue affects Before After Image Slider, cross-site scripting, stored xss
CVE-2024-24932: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Djo VK Poster Group allows Reflected XSS.This issue affects VK Poster Group: from n/a through 2.0.3.
Key phrases: Reflected XSS.This issue affects VK Poster Group:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-24933: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prasidhda Malla Honeypot for WP Comment allows Reflected XSS.This issue affects Honeypot for WP Comment: from n/a through 2.2.3.
Key phrases: Reflected XSS.This issue affects Honeypot for WP Comment, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-24935: Cross-Site Request Forgery (CSRF) vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4.
Key phrases: cross-site request forgery (csrf)
CVE-2024-24936: In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed
Key phrases: access control
CVE-2024-24937: In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible
Key phrases: xss
CVE-2024-24938: In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
Key phrases: limited directory traversal
CVE-2024-24939: In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible
Key phrases: logging of environment variables containing secret values
CVE-2024-2494: A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.
Key phrases: perform a denial of service attack by causing, negative length, crash, daemon crash
CVE-2024-24940: In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives
Key phrases: path traversal
CVE-2024-24941: In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL
Key phrases: inappropriate url
CVE-2024-24942: In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
Key phrases: path traversal
CVE-2024-24943: In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image
Key phrases: dos, malicious svg image
CVE-2024-24945: A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Share Your Moments parameter at /travel-journal/write-journal.php.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2024-2495: Cryptographic key vulnerability encoded in the FriendlyWrt firmware affecting version 2022-11-16.51b3d35. This vulnerability could allow an attacker to compromise the confidentiality and integrity of encrypted data.
Key phrases: compromise the confidentiality and integrity of encrypted data, cryptographic key
CVE-2024-2496: A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.
Key phrases: null pointer dereference flaw, crash, denial of service, daemon crash
CVE-2024-24964: Improper access control vulnerability exists in the resident process of SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2. If this vulnerability is exploited, an arbitrary process may be executed with SYSTEM privilege by a user who can log in to the PC where the product's Windows client is installed.
Key phrases: improper access control
CVE-2024-24966: When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2024-2497: A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: code injection, disclosure
CVE-2024-24975: Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails tolimit the size of the code block that will be processed by the syntax highlighter, allowing an attacker to send avery large code block and crash the mobile app.
Key phrases: send avery large code block and crash the, uncontrolled resource consumption
CVE-2024-24976: A denial of service vulnerability exists in the OAS Engine File Data Source Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can cause the running program to stop. An attacker can send a sequence of requests to trigger this vulnerability.
Key phrases: denial of service
CVE-2024-24988: Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to sendmultiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.
Key phrases: sendmultiple times a very long string as an, resource consumption, crashing the server
CVE-2024-24989: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to  Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html .NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Key phrases: undisclosed requests
CVE-2024-24990: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to  Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Key phrases: undisclosed requests
CVE-2024-2500: The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-25002: Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device.
Key phrases: the device, command injection, full access
CVE-2024-25003: KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds checking and input sanitization. This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.
Key phrases: overwrite adjacent memory, stack-based buffer overflow, arbitrary code execution, stack based buffer overflow
CVE-2024-25004: KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.
Key phrases: overwrite adjacent memory, stack-based buffer overflow, arbitrary code execution, stack based buffer overflow
CVE-2024-25006: XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import.
Key phrases: administer styles, directory traversal
CVE-2024-25016: IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic.  IBM X-Force ID:  281279.
Key phrases: cause a denial of service due to incorrect, incorrect buffering logic
CVE-2024-25021: IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands.  IBM X-Force ID:  281320.
Key phrases: execute arbitrary commands, exploit a vulnerability to execute arbitrary commands
CVE-2024-25027: IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption.  IBM X-Force ID:  281607.
Key phrases: sensitive snapshot information, missing encryption
CVE-2024-25030: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be read by a local user.  IBM X-Force ID:  281677.
Key phrases: sensitive information, sensitive information log file, file read
CVE-2024-25046: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service by an authenticated user using a specially crafted query.  IBM X-Force ID:  282953.
Key phrases: denial of service
CVE-2024-25062: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
Key phrases: xmlvalidatepopelement use-after-free, use after free
CVE-2024-25063: Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker should not have access to.
Key phrases: gain access, gain access to certain URLs that the attacker, insufficient server-side validation
CVE-2024-25064: Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by changing parameter values.
Key phrases: server-side validation
CVE-2024-25065: Possible path traversal in Apache OFBiz allowing authentication bypass.Users are recommended to upgrade to version 18.12.12, that fixes the issue.
Key phrases: authentication bypass, upgrade to version 18.12.12, path traversal
CVE-2024-25075: An issue was discovered in Softing uaToolkit Embedded before 1.41.1. When a subscription with a very low MaxNotificationPerPublish parameter is created, a publish response is mishandled, leading to memory consumption. When that happens often enough, the device will be out of memory, i.e., a denial of service.
Key phrases: denial of service, memory consumption
CVE-2024-25080: WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer.
Key phrases: XSS via the image attachment viewer, xss
CVE-2024-25081: Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
Key phrases: command injection via crafted filenames
CVE-2024-25082: Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
Key phrases: command injection via crafted archives or compressed files
CVE-2024-25083: An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there is an attack vector through which the user is able to execute any program with elevated privileges.
Key phrases: attack vector, elevate privileges
CVE-2024-25089: Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes.
Key phrases: execute arbitrary code, execute arbitrary code via gRPC named pipes, grpc named pipes
CVE-2024-25091: Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks Browser prior to 2.2.95 (when using 'VirusChecker' or 'ThreatChecker' feature).  If data containing malware is saved in a specific file format (eml, dmg, vhd, iso, msi), malware may be taken outside the sandboxed environment.
Key phrases: protection mechanism failure issue
CVE-2024-25093: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Rating System allows Stored XSS.This issue affects GD Rating System: from n/a through 3.5.
Key phrases: Stored XSS.This issue affects GD Rating System:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-25094: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Jura & Nicolas Montigny PJ News Ticker allows Stored XSS.This issue affects PJ News Ticker: from n/a through 1.9.5.
Key phrases: Stored XSS.This issue affects PJ News Ticker:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-25096: Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.
Key phrases: Code Injection, improper control of generation of code, code injection
CVE-2024-25097: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issue affects TNC PDF viewer: from n/a through 2.8.0.
Key phrases: Stored XSS.This issue affects TNC PDF viewer:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-25098: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB oEmbed HTML5 Audio  with Cache Support allows Stored XSS.This issue affects PB oEmbed HTML5 Audio  with Cache Support: from n/a through 2.6.
Key phrases: Stored XSS.This issue affects PB oEmbed HTML5 Audio, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-25099: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David de Boer Paytium: Mollie payment forms & donations allows Stored XSS.This issue affects Paytium: Mollie payment forms & donations: from n/a through 4.4.2.
Key phrases: Stored XSS.This issue affects Paytium: Mollie payment, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-25100: Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program.This issue affects Coupon Referral Program: from n/a through 1.7.2.
Key phrases: deserialization of untrusted data
CVE-2024-25101: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik  Spam Blacklist allows Stored XSS.This issue affects Maspik  Spam Blacklist: from n/a through 0.10.6.
Key phrases: Stored XSS.This issue affects Maspik  Spam Blacklist, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-25102: This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. An attacker with local administrative privileges could exploit this to obtain the password of AppSamvid on the targeted system.Successful exploitation of this vulnerability could allow the attacker to take complete control of the application on the targeted system.
Key phrases: obtain the password, take complete control of the application on the
CVE-2024-25103: This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could exploit this by placing malicious DLLs on the targeted system.Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on the targeted system.
Key phrases: execute arbitrary code, execute arbitrary code on the targeted system
CVE-2024-25106: OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any authenticated user within an organization to remove any other user from that same organization, irrespective of their respective roles. This includes the ability to remove users with "Admin" and "Root" roles. By enabling any organizational member to unilaterally alter the user base, it opens the door to unauthorized access and can cause considerable disruptions in operations. The core of the vulnerability lies in the `remove_user_from_org` function in the user management system. This function is designed to allow organizational users to remove members from their organization. The function does not check if the user initiating the request has the appropriate administrative privileges to remove a user. Any user who is part of the organization, irrespective of their role, can remove any other user, including those with higher privileges. This vulnerability is categorized as an Authorization issue leading to Unauthorized User Removal. The impact is severe, as it compromises the integrity of user management within organizations. By exploiting this vulnerability, any user within an organization, without the need for administrative privileges, can remove critical users, including "Admins" and "Root" users. This could result in unauthorized system access, administrative lockout, or operational disruptions. Given that user accounts are typically created by "Admins" or "Root" users, this vulnerability can be exploited by any user who has been granted access to an organization, thereby posing a critical risk to the security and operational stability of the application. This issue has been addressed in release version 0.8.0. Users are advised to upgrade.
Key phrases: remove any other user from that same organization, remove members from their organization, unauthorized access, authorization issue, unauthorized user removal, operational disruptions, integrity
CVE-2024-25107: WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used when making the human-readable timestamp for inclusion on the wiki_creation column. This function uses interface messages to translate the names of months and days. It uses the `->text()` output mode, returning unescaped interface messages. Since the output is not escaped later, the unescaped interface message is included on the output, resulting in an XSS vulnerability. Exploiting this on-wiki requires the `(editinterface)` right. This vulnerability has been addressed in commit `267e763a0`. Users are advised to update their installations. There are no known workarounds for this vulnerability.
Key phrases: xss
CVE-2024-25108: Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: access far more functionality than users intended
CVE-2024-25109: ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.
Key phrases: manage wikis, cross site scripting attack vector, cross-site scripting
CVE-2024-25110: The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability.
Key phrases: use-after-free, remote code execution, use after free