CVE-2024-51528

CVE-2024-51528

Título es
CVE-2024-51528

Mar, 05/11/2024 – 10:21

Tipo
CWE-532

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2024-51528

Descripción en
Vulnerability of improper log printing in the Super Home Screen module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.

05/11/2024
05/11/2024
Vector CVSS:3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Gravedad 3.1 (CVSS 3.1 Base Score)
4.00

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
MEDIUM

Referencias

  • https://consumer.huawei.com/en/support/bulletin/2024/11/

    • Enviar en el boletín
    Off

    CVE-2024-51527

    CVE-2024-51527

    Título es
    CVE-2024-51527

    Mar, 05/11/2024 – 10:21

    Tipo
    CWE-264

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-51527

    Descripción en
    Permission control vulnerability in the Gallery app
    Impact: Successful exploitation of this vulnerability may affect service confidentiality.

    05/11/2024
    05/11/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    5.10

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://consumer.huawei.com/en/support/bulletin/2024/11/

    • Enviar en el boletín
    Off

    CVE-2024-9878

    CVE-2024-9878

    Título es
    CVE-2024-9878

    Mar, 05/11/2024 – 10:21

    Tipo
    CWE-79

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-9878

    Descripción en
    The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

    05/11/2024
    05/11/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.40

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://packetstormsecurity.com/files/179357/WordPress-Photo-Gallery-1.8.26-Cross-Site-Scripting.html

  • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3180567%40photo-gallery/trunk&old=3171538%40photo-gallery/trunk#file12

  • https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa1192b-34f5-4b71-8fff-14f2d4ac4aca?source=cve

    • Enviar en el boletín
    Off

    CVE-2024-7429

    CVE-2024-7429

    Título es
    CVE-2024-7429

    Mar, 05/11/2024 – 10:21

    Tipo
    CWE-284

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-7429

    Descripción en
    The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin's settings.

    05/11/2024
    05/11/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://plugins.trac.wordpress.org/browser/zotpress/trunk/lib/admin/admin.php#L40

  • https://plugins.trac.wordpress.org/changeset/3153348/zotpress/trunk/lib/admin/admin.php

  • https://www.wordfence.com/threat-intel/vulnerabilities/id/1f38676b-270f-4b0f-bc98-a14a26b86a50?source=cve

    • Enviar en el boletín
    Off

    CVE-2024-10319

    CVE-2024-10319

    Título es
    CVE-2024-10319

    Mar, 05/11/2024 – 11:15

    Tipo
    CWE-200

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-10319

    Descripción en
    The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the render function in widgets/content-toggle/layout/frontend.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.

    05/11/2024
    05/11/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://plugins.trac.wordpress.org/changeset/3179221/xpro-elementor-addons

  • https://www.wordfence.com/threat-intel/vulnerabilities/id/382a46c2-9fec-4642-93b0-c06b9ed1c086?source=cve

    • Enviar en el boletín
    Off

    CVE-2024-9178

    CVE-2024-9178

    Título es
    CVE-2024-9178

    Mar, 05/11/2024 – 11:15

    Tipo
    CWE-79

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-9178

    Descripción en
    The XT Floating Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

    05/11/2024
    05/11/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.40

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://plugins.trac.wordpress.org/browser/woo-floating-cart-lite/trunk/xt-framework/includes/customizer/class-customizer.php#L1012

  • https://plugins.trac.wordpress.org/changeset/3181762/

  • XT Floating Cart for WooCommerce



  • https://www.wordfence.com/threat-intel/vulnerabilities/id/921be7ff-3d38-4b69-8a1f-a64d5aabd2dd?source=cve

    • Enviar en el boletín
    Off

    CVE-2024-51514

    CVE-2024-51514

    Título es
    CVE-2024-51514

    Mar, 05/11/2024 – 09:15

    Tipo
    CWE-20

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-51514

    Descripción en
    Vulnerability of pop-up windows belonging to no app in the VPN module
    Impact: Successful exploitation of this vulnerability may affect service confidentiality.

    05/11/2024
    05/11/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

    Gravedad 3.1 (CVSS 3.1 Base Score)
    5.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://consumer.huawei.com/en/support/bulletin/2024/11/

    • Enviar en el boletín
    Off

    CVE-2024-51513

    CVE-2024-51513

    Título es
    CVE-2024-51513

    Mar, 05/11/2024 – 09:15

    Tipo
    CWE-20

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-51513

    Descripción en
    Vulnerability of processes not being fully terminated in the VPN module
    Impact: Successful exploitation of this vulnerability will affect power consumption.

    05/11/2024
    05/11/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    5.50

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://consumer.huawei.com/en/support/bulletin/2024/11/

    • Enviar en el boletín
    Off

    CVE-2024-51512

    CVE-2024-51512

    Título es
    CVE-2024-51512

    Mar, 05/11/2024 – 09:15

    Tipo
    CWE-20

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-51512

    Descripción en
    Vulnerability of parameter type not being verified in the WantAgent module
    Impact: Successful exploitation of this vulnerability may affect availability.

    05/11/2024
    05/11/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.20

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://consumer.huawei.com/en/support/bulletin/2024/11/

    • Enviar en el boletín
    Off

    CVE-2024-51511

    CVE-2024-51511

    Título es
    CVE-2024-51511

    Mar, 05/11/2024 – 09:15

    Tipo
    CWE-20

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-51511

    Descripción en
    Vulnerability of parameter type not being verified in the WantAgent module
    Impact: Successful exploitation of this vulnerability may affect availability.

    05/11/2024
    05/11/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.20

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://consumer.huawei.com/en/support/bulletin/2024/11/

    • Enviar en el boletín
    Off