yahoo-inc/cve-impacts huggingface dataset:
CVE-2024-29773: Cross-Site Request Forgery (CSRF) vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint allows Cross-Site Scripting (XSS).This issue affects BizPrint: from n/a through 4.5.5.
Key phrases: Cross-Site Scripting (XSS).This issue affects, cross-site request forgery (csrf), cross-site scripting (xss)
CVE-2024-29774: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.2.9.
Key phrases: Reflected XSS.This issue affects WP Directory Kit:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29775: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vinoth06. Frontend Dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through 2.2.1.
Key phrases: Stored XSS.This issue affects Frontend Dashboard: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29776: Cross Site Scripting (XSS) vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
Key phrases: cross site scripting (xss)
CVE-2024-29777: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Reflected XSS.This issue affects Forminator: from n/a through 1.29.0.
Key phrases: Reflected XSS.This issue affects Forminator: from n, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-2978: A vulnerability classified as critical has been found in Tenda F1203 2.0.1.6. This affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258147. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29788: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podlove Podlove Web Player allows Stored XSS.This issue affects Podlove Web Player: from n/a through 5.7.1.
Key phrases: Stored XSS.This issue affects Podlove Web Player:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29789: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Walter Pinem OneClick Chat to Order allows Stored XSS.This issue affects OneClick Chat to Order: from n/a through 1.0.5.
Key phrases: Order: from n/a through 1.0.5, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-2979: A vulnerability classified as critical was found in Tenda F1203 2.0.1.6. This vulnerability affects the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258148. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29790: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Squirrly SEO Plugin by Squirrly SEO allows Reflected XSS.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.3.16.
Key phrases: Reflected XSS.This issue affects SEO Plugin by Squirrly, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29791: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit allows Reflected XSS.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through 2.01.
Key phrases: Reflected XSS.This issue affects Bulk NoIndex & NoFollow, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29792: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.93.
Key phrases: Reflected XSS.This issue affects Unlimited Elements For Elementor, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29793: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailChimp Forms by MailMunch allows Stored XSS.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.2.
Key phrases: Stored XSS.This issue affects MailChimp Forms by MailMunch, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29794: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Conversios Conversios.Io allows Reflected XSS.This issue affects Conversios.Io: from n/a through 6.9.1.
Key phrases: Reflected XSS.This issue affects Conversios, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29795: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more allows Stored XSS.This issue affects Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more: from n/a through 4.5.24.
Key phrases: Stored XSS.This issue affects Media Cloud for Amazon, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29796: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hot Themes Hot Random Image allows Stored XSS.This issue affects Hot Random Image: from n/a through 1.8.1.
Key phrases: Stored XSS.This issue affects Hot Random Image:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29797: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Darko Grid Shortcodes allows Stored XSS.This issue affects Grid Shortcodes: from n/a through 1.1.
Key phrases: Stored XSS.This issue affects Grid Shortcodes: from, improper neutralization of input during web page generation, cross-site scripting, stored xss, grid shortcodes
CVE-2024-29798: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Appsmav Gratisfaction allows Stored XSS.This issue affects Gratisfaction: from n/a through 4.3.4.
Key phrases: Stored XSS.This issue affects Gratisfaction: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29799: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epsiloncool WP Fast Total Search allows Stored XSS.This issue affects WP Fast Total Search: from n/a through 1.59.211.
Key phrases: Stored XSS.This issue affects WP Fast Total Search, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-2980: A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). This issue affects the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258149 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29801: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Petri Damstn Fullscreen Galleria allows Stored XSS.This issue affects Fullscreen Galleria: from n/a through 1.6.11.
Key phrases: Stored XSS.This issue affects Fullscreen Galleria: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29802: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.3.
Key phrases: Stored XSS.This issue affects Football Pool: from, improper neutralization of input during web page generation, cross-site scripting, stored xss, football pool
CVE-2024-29803: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mehanoid.Pro FlatPM allows Stored XSS.This issue affects FlatPM: from n/a before 3.1.05.
Key phrases: Stored XSS.This issue affects FlatPM: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29804: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Fancy Comments WordPress allows Stored XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.14.
Key phrases: Stored XSS.This issue affects Fancy Comments WordPress:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29805: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShopUp Shipping with Venipak for WooCommerce allows Reflected XSS.This issue affects Shipping with Venipak for WooCommerce: from n/a through 1.19.5.
Key phrases: Reflected XSS.This issue affects Shipping with Venipak for, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29806: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Reservation Diary ReDi Restaurant Reservation allows Reflected XSS.This issue affects ReDi Restaurant Reservation: from n/a through 24.0128.
Key phrases: Reflected XSS.This issue affects ReDi Restaurant Reservation:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29807: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive DearFlip allows Stored XSS.This issue affects DearFlip: from n/a through 2.2.26.
Key phrases: Stored XSS.This issue affects DearFlip: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29808: The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Key phrases: allowing arbitrary JavaScript, be inserted and executed, reflected cross site scripting
CVE-2024-29809: The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Key phrases: allowing arbitrary JavaScript, be inserted and executed, reflected cross site scripting
CVE-2024-2981: A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408). Affected is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258150 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29810: The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Key phrases: allowing arbitrary JavaScript, be inserted and executed, reflected cross site scripting
CVE-2024-29811: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftLab Radio Player allows Stored XSS.This issue affects Radio Player: from n/a through 2.0.73.
Key phrases: Stored XSS.This issue affects Radio Player: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29812: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReviewX allows Stored XSS.This issue affects ReviewX: from n/a through 1.6.22.
Key phrases: Stored XSS.This issue affects ReviewX: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29813: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CartFlows Inc. Funnel Builder by CartFlows allows Stored XSS.This issue affects Funnel Builder by CartFlows: from n/a through 2.0.1.
Key phrases: Stored XSS.This issue affects Funnel Builder by CartFlows, cross-site scripting, stored xss
CVE-2024-29814: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Exchange Rates Widget allows Stored XSS.This issue affects Exchange Rates Widget: from n/a through 1.4.0.
Key phrases: Stored XSS.This issue affects Exchange Rates Widget:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29815: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aminur Islam WP Change Email Sender allows Stored XSS.This issue affects WP Change Email Sender: from n/a before 1.3.0.
Key phrases: Stored XSS.This issue affects WP Change Email Sender, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29816: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in htdat Woo Viet allows Stored XSS.This issue affects Woo Viet: from n/a through 1.5.2.
Key phrases: Stored XSS.This issue affects Woo Viet: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29817: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SERVIT Software Solutions affiliate-toolkit allows Stored XSS.This issue affects affiliate-toolkit: from n/a through 3.4.5.
Key phrases: Stored XSS.This issue affects affiliate-toolkit:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29818: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker allows Stored XSS.This issue affects WP Poll Maker: from n/a through 3.1.
Key phrases: Stored XSS.This issue affects WP Poll Maker:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29819: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront Notification Bar allows Stored XSS.This issue affects WPFront Notification Bar: from n/a through 3.3.2.
Key phrases: Stored XSS.This issue affects WPFront Notification Bar:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-2982: A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258151. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: command injection, disclosure
CVE-2024-29820: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedNao PDF Builder for WPForms allows Stored XSS.This issue affects PDF Builder for WPForms: from n/a through 1.2.88.
Key phrases: Stored XSS.This issue affects PDF Builder for WPForms, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-2983: A vulnerability was found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this issue is the function formSetClientState of the file /goform/SetClientState. The manipulation of the argument deviceId/limitSpeed/limitSpeedUp leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258152. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29832: The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue.Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.
Key phrases: allowing arbitrary JavaScript, be inserted and executed, cross site scripting
CVE-2024-29833: The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.
Key phrases: remove script tags can be bypassed by using, cross site scripting payload
CVE-2024-29834: This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. An authenticated user with produce permission can create subscriptions and update subscription properties on partitioned topics, even though this should be limited to users with consume permissions. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be slightly different. Additionally, the vulnerability allows an authenticated user to read, create, modify, and delete namespace properties in any namespace in any tenant. In Pulsar, namespace properties are reserved for user provided metadata about the namespace.This issue affects Apache Pulsar versions from 2.7.1 to 2.10.6, from 2.11.0 to 2.11.4, from 3.0.0 to 3.0.3, from 3.1.0 to 3.1.3, and from 3.2.0 to 3.2.1. 3.0 Apache Pulsar users should upgrade to at least 3.0.4.3.1 and 3.2 Apache Pulsar users should upgrade to at least 3.2.2.Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
Key phrases: perform unauthorized operations on partitioned topics, read, impact analysis
CVE-2024-2984: A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been classified as critical. This affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258153 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-2985: A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258154 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29858: In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
CVE-2024-29859: In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
Key phrases: file upload
CVE-2024-2986: A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects the function formSetSpeedWan of the file /goform/SetSpeedWan. The manipulation of the argument speed_dir leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258155. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29862: The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state.
Key phrases: tcp packets
CVE-2024-29864: Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.
Key phrases: execute arbitrary code, execute arbitrary code via command injection into exported
CVE-2024-29865: Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.
Key phrases: the LDAP login form, self-xss
CVE-2024-29866: Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System privileges.
Key phrases: incorrect access control
CVE-2024-2987: A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258156. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29870: SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter./sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted query to the server and extract all the data from it.
Key phrases: send a specially crafted query to the server, sql injection
CVE-2024-29871: SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, 'id' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted query to the server and extract all the data from it.
Key phrases: send a specially crafted query to the server, sql injection
CVE-2024-29872: SQL injection vulnerability in Sentrifugo 3.2, through/sentrifugo/index.php/empscreening/add, 'agencyids' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted query to the server and extract all the data from it.
Key phrases: send a specially crafted query to the server, sql injection
CVE-2024-29873: SQL injection vulnerability in Sentrifugo 3.2, through/sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted query to the server and extract all the data from it.
Key phrases: send a specially crafted query to the server, sql injection
CVE-2024-29874: SQL injection vulnerability in Sentrifugo 3.2, through/sentrifugo/index.php/default/reports/activeuserrptpdf, 'sort_name' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted query to the server and extract all the data from it.
Key phrases: send a specially crafted query to the server, sql injection
CVE-2024-29875: SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted query to the server and extract all the data from it.
Key phrases: send a specially crafted query to the server, sql injection
CVE-2024-29876: SQL injection vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/reports/activitylogreport, 'sortby' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted query to the server and extract all the data from it.
Key phrases: send a specially crafted query to the server, sql injection
CVE-2024-29877: Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/expenses/expensecategories/edit, 'expense_category_name' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted URL to the victim and steal their session data.
Key phrases: send a specially crafted URL to the victim, cross-site scripting (xss)
CVE-2024-29878: Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted URL to the victim and steal their session data.
Key phrases: send a specially crafted URL to the victim, cross-site scripting (xss)
CVE-2024-29879: Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/index/getdepartments/format/html,  'business_id' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted URL to the victim and steal their session data.
Key phrases: send a specially crafted URL to the victim, cross-site scripting (xss)
CVE-2024-2988: A vulnerability classified as critical was found in Tenda FH1203 2.0.1.6. Affected by this vulnerability is the function fromSetRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument entrys leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29880: In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process
Key phrases: obtain permissions
CVE-2024-29881: TinyMCE is an open source rich text editor.  A cross-site scripting (XSS) vulnerability was discovered in TinyMCEs content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.
Key phrases: cross-site scripting (xss)
CVE-2024-29882: SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting). This vulnerability is fixed in 5.0.210 and 6.0.121.
Key phrases: xss
CVE-2024-29883: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the `(createwiki)` user right regardless of the settings one sets on a given wiki request. This may expose information to users who are not supposed to be able to access it.
Key phrases: expose information
CVE-2024-29886: Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6.
Key phrases: rainbow
CVE-2024-29887: Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.
Key phrases: man in the middle
CVE-2024-29888: Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.
CVE-2024-2989: A vulnerability, which was classified as critical, has been found in Tenda FH1203 2.0.1.6. Affected by this issue is the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-258158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29890: DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart type with the ability to pass custom javascript code that would later be executed in an unprotected sandbox on subsequent requests to that chart. The problem was fixed in the datalens-ui version `0.1449.0`. Restricting access to the API for creating or modifying charts (`/charts/api/charts/v1/`) would mitigate the issue.
Key phrases: unprotected sandbox
CVE-2024-29891: ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed image in the browser, where a session in ZITADEL needs to be active for this exploit to work. The exploit could only be reproduced if the victim was using Firefox. Chrome, Safari as well as Edge did not execute the code. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.
Key phrases: gain access, missing check, execute code
CVE-2024-29892: ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.
CVE-2024-29893: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically,  it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
Key phrases: denial-of-service attack vector, crash
CVE-2024-29896: Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.
Key phrases: external malicious scripts, malicious injected resources, integrity
CVE-2024-29897: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the farm to access suppressed wiki requests by going to the request's entry on Special:RequestWikiQueue on the wiki where they have these rights. The same vulnerability was present briefly on the REST API before being quickly corrected in commit `6bc0685`. To our knowledge, the vulnerable commits of the REST API are not running in production anywhere. This vulnerability is fixed in 23415c17ffb4832667c06abcf1eadadefd4c8937.
CVE-2024-29898: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the `(read)` permission. This vulnerability is fixed in 8f8442ed5299510ea3e58416004b9334134c149c.
CVE-2024-2990: A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. This affects the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258159. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29900: Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.
Key phrases: sensitive information
CVE-2024-29901: The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
Key phrases: expired session
CVE-2024-29904: CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later. 
Key phrases: dos
CVE-2024-29906: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
Key phrases: Stored XSS.This issue affects WordPress Meta Data and, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29907: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Active Websight SEO Backlink Monitor allows Reflected XSS.This issue affects SEO Backlink Monitor: from n/a through 1.5.0.
Key phrases: Reflected XSS.This issue affects SEO Backlink Monitor:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29908: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kienso Co-marquage service-public.Fr allows Stored XSS.This issue affects Co-marquage service-public.Fr: from n/a through 0.5.71.
Key phrases: Stored XSS.This issue affects Co-marquage service, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29909: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille Verrier Travelers' Map allows Stored XSS.This issue affects Travelers' Map: from n/a through 2.2.0.
Key phrases: Stored XSS.This issue affects Travelers' Map:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-2991: A vulnerability has been found in Tenda FH1203 2.0.1.6 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258160. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: command injection, disclosure
CVE-2024-29910: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alordiel Dropdown Multisite selector allows Stored XSS.This issue affects Dropdown Multisite selector: from n/a through 0.9.2.
Key phrases: Stored XSS.This issue affects Dropdown Multisite selector:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29911: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1.
Key phrases: Stored XSS.This issue affects Master Addons for Elementor, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29912: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baptiste Plac iCalendrier allows Stored XSS.This issue affects iCalendrier: from n/a through 1.80.
Key phrases: Stored XSS.This issue affects iCalendrier: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29913: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through 2.1.3.
Key phrases: Stored XSS.This issue affects Tutor LMS Elementor Addons, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29914: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MotoPress Stratum allows Stored XSS.This issue affects Stratum: from n/a through 1.3.15.
Key phrases: Stored XSS.This issue affects Stratum: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29915: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Reflected XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.0.9.
Key phrases: Reflected XSS.This issue affects Podlove Podcast Publisher:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29916: The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the key derivation function relies only on a UID. This affects, for example, Saflok MT, and the Confidant, Quantum, RT, and Saffire series.
Key phrases: unlock arbitrary doors, unlock arbitrary doors at a property via forged, unsaflok
CVE-2024-29917: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Compact WP Audio Player allows Stored XSS.This issue affects Compact WP Audio Player: from n/a through 1.9.9.
Key phrases: Stored XSS.This issue affects Compact WP Audio Player, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29918: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Reflected XSS.This issue affects Survey Maker: from n/a through 4.0.6.
Key phrases: Reflected XSS.This issue affects Survey Maker: from, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29919: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Photo Gallery Team Photo Gallery by Ays allows Reflected XSS.This issue affects Photo Gallery by Ays: from n/a through 5.5.2.
Key phrases: Reflected XSS.This issue affects Photo Gallery by Ays, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-2992: A vulnerability was found in Tenda FH1203 2.0.1.6 and classified as critical. This issue affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258161 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-29920: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moveaddons Move Addons for Elementor allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through 1.2.9.
Key phrases: Stored XSS.This issue affects Move Addons for Elementor, cross-site scripting, stored xss
CVE-2024-29921: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic Photo Gallery by Supsystic allows Stored XSS.This issue affects Photo Gallery by Supsystic: from n/a through 1.15.16.
Key phrases: Stored XSS.This issue affects Photo Gallery by Supsystic, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29922: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quantum Cloud Slider Hero allows Stored XSS.This issue affects Slider Hero: from n/a through 8.6.1.
Key phrases: Stored XSS.This issue affects Slider Hero: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29923: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Reflected XSS.This issue affects PropertyHive: from n/a through 2.0.8.
Key phrases: Reflected XSS.This issue affects PropertyHive: from n, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29924: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Premium Packages allows Reflected XSS.This issue affects Premium Packages: from n/a through 5.8.2.
Key phrases: Reflected XSS.This issue affects Premium Packages: from, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29925: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate allows Stored XSS.This issue affects Post Grid, Slider & Carousel Ultimate: from n/a through 1.6.6.
Key phrases: Stored XSS.This issue affects Post Grid, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29926: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder allows Stored XSS.This issue affects WC Builder: from n/a through 1.0.18.
Key phrases: Stored XSS.This issue affects WC Builder: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29927: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasTheme WishSuite allows Stored XSS.This issue affects WishSuite: from n/a through 1.3.7.
Key phrases: Stored XSS.This issue affects WishSuite: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-29928: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issue affects Advanced Sermons: from n/a through 3.1.
Key phrases: Reflected XSS.This issue affects Advanced Sermons: from, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-29929: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM  Frontend Manager for WooCommerce allows Stored XSS.This issue affects WCFM  Frontend Manager for WooCommerce: from n/a through 6.7.8.
Key phrases: Stored XSS.This issue affects WCFM  Frontend Manager, improper neutralization of input during web page generation, cross-site scripting, stored xss