Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3906 State: PUBLISHED Published: 2024-04-17T10:31:05.641Z Last Updated: 2024-08-01T20:26:57.104Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC500 Problem Types: CWE-121 Description: A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has been declared as critical. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-261142 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about thi
may be used. VDB-261142 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261142 - https://vuldb.com/?ctiid.261142 - https://vuldb.com/?submit.313801 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/formQuickIndex.md
CVE ID: CVE-2024-3907 State: PUBLISHED Published: 2024-04-17T11:00:06.424Z Last Updated: 2024-08-01T20:26:57.130Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC500 Problem Types: CWE-121 Description: A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has been rated as critical. This issue affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261143. NOTE: The vendor was contacted early about this disclosure but did
ated identifier of this vulnerability is VDB-261143. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261143 - https://vuldb.com/?ctiid.261143 - https://vuldb.com/?submit.313802 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/formSetCfm.md
CVE ID: CVE-2024-3908 State: PUBLISHED Published: 2024-04-17T11:31:04.525Z Last Updated: 2024-08-01T20:26:57.152Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tenda Products: AC500 Problem Types: CWE-77 Description: A vulnerability classified as critical has been found in Tenda AC500 2.0.1.9(1307). Affected is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261144. NOTE: The vendor was contacted early about this disclosure but did not respond in any
this vulnerability is VDB-261144. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261144 - https://vuldb.com/?ctiid.261144 - https://vuldb.com/?submit.313803 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/formWriteFacMac.md
CVE ID: CVE-2024-3909 State: PUBLISHED Published: 2024-04-17T11:31:05.865Z Last Updated: 2024-08-01T20:26:57.136Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC500 Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda AC500 2.0.1.9(1307). Affected by this vulnerability is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261145 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclo
ed. The identifier VDB-261145 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261145 - https://vuldb.com/?ctiid.261145 - https://vuldb.com/?submit.313804 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/formexeCommand.md
CVE ID: CVE-2024-3910 State: PUBLISHED Published: 2024-04-17T12:00:05.651Z Last Updated: 2024-08-01T20:26:57.124Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC500 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda AC500 2.0.1.9(1307). Affected by this issue is the function fromDhcpListClient of the file /goform/DhcpListClient. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261146 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about
nd may be used. VDB-261146 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261146 - https://vuldb.com/?ctiid.261146 - https://vuldb.com/?submit.313805 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC500/fromDhcpListClient_page.md
CVE ID: CVE-2024-3911 State: PUBLISHED Published: 2024-04-23T12:14:29.188Z Last Updated: 2025-08-27T21:23:00.831Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Welotec Products: SMART EMS, VPN Security Suite Problem Types: CWE-1021 Description: An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-023
CVE ID: CVE-2024-3912 State: PUBLISHED Published: 2024-06-14T09:29:00.161Z Last Updated: 2024-08-01T20:26:57.193Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: DSL-N17U, DSL-N55U_C1, DSL-N55U_D1, DSL-N66U, DSL-N12U_C1, DSL-N12U_D1, DSL-N14U, DSL-N14U_B1, DSL-N16, DSL-AC51, DSL-AC750, DSL-AC52U, DSL-AC55U, DSL-AC56U, DSL-N10_C1, DSL-N10_D1, DSL-N10P_C1, DSL-N12E_C1, DSL-N16P, DSL-N16U, DSL-AC52, DSL-AC55 Problem Types: CWE-434 Description: Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device. Additi
nauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7875-872d3-1.html - https://www.twcert.org.tw/en/cp-139-7876-396bd-2.html
CVE ID: CVE-2024-3913 State: PUBLISHED Published: 2024-08-13T12:30:33.535Z Last Updated: 2025-01-29T06:04:51.452Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Phoenix Contact Products: CHARX SEC-3000 (1139022), CHARX SEC-3050 (1139018), CHARX SEC-3100 (1139012), CHARX SEC-3150 (1139012) Problem Types: CWE-552 Description: An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-022
CVE ID: CVE-2024-3914 State: PUBLISHED Published: 2024-04-17T17:27:30.842Z Last Updated: 2025-02-13T17:53:16.144Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/330759272 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CW
org/issues/330759272 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCWPUBGTBNT4EW32YNZMRIPB3Y4R6XL6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEP5NJUWMDRLDQUKU4LFDUHF5PCYAPIO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - https://lists.fedorapr
rchives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/
CVE ID: CVE-2024-3915 State: PUBLISHED Published: 2024-05-09T20:03:32.468Z Last Updated: 2024-08-01T20:26:56.925Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Swift Ideas Products: Swift Framework Problem Types: CWE-862 Missing Authorization Description: The Swift Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sf_edit_directory_item() function in all versions up to, and including, 2.7.31. This makes it possible for unauthenticated attackers to update arbitrary posts with arbitrary content. Unfortunately, we did not receive a response from the vendor to send over the vulnerability
sts with arbitrary content. Unfortunately, we did not receive a response from the vendor to send over the vulnerability details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/855055d5-362e-4a92-9e9d-97eab328dcc3?source=cve - https://swiftideas.com/swift-framework/
CVE ID: CVE-2024-3916 State: PUBLISHED Published: 2024-05-09T20:03:27.152Z Last Updated: 2024-08-01T20:26:57.045Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Swift Ideas Products: Swift Framework Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Swift Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 2.7.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and ab
ng on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unfortunately, we did not receive a response from the vendor to send over the vulnerability details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57103f8e-0874-4e56-8571-254607ada21c?source=cve - https://swiftideas.com/swift-framework/
CVE ID: CVE-2024-3917 State: PUBLISHED Published: 2024-05-23T06:00:02.910Z Last Updated: 2024-08-01T20:26:57.082Z Vendors: Unknown Products: Pet Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/88162016-9fc7-4194-9e81-44c50991f6e9/
CVE ID: CVE-2024-3918 State: PUBLISHED Published: 2024-05-23T06:00:03.093Z Last Updated: 2025-03-28T20:35:31.614Z Vendors: Unknown Products: Pet Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/2074d0f5-4165-4130-9391-37cb21e8aa1b/
CVE ID: CVE-2024-3919 State: PUBLISHED Published: 2024-07-13T06:00:05.011Z Last Updated: 2024-08-01T20:26:56.962Z Vendors: Unknown Products: OpenPGP Form Encryption for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4e38c7d9-5b6a-4dfc-8f22-3ff3056
DP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4e38c7d9-5b6a-4dfc-8f22-3ff30565ce43/
CVE ID: CVE-2024-3920 State: PUBLISHED Published: 2024-05-23T06:00:03.279Z Last Updated: 2024-08-09T18:54:30.448Z Vendors: Unknown Products: Flattr Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2fb28c77-3c35-4a2f-91ed-823d0d011048/
CVE ID: CVE-2024-3921 State: PUBLISHED Published: 2024-05-29T06:00:02.135Z Last Updated: 2024-08-09T19:56:19.963Z Vendors: Unknown Products: Gianism Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3c114e14-9113-411d-91f3-2e2daeb40739/
CVE ID: CVE-2024-3922 State: PUBLISHED Published: 2024-06-13T02:05:22.878Z Last Updated: 2024-08-01T20:26:57.135Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: wedevs Products: Dokan Pro Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already
e existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9de41de-f2f7-4b16-8ec9-d30bbd3d8786?source=cve - https://dokan.co/docs/wordpress/changelog/
CVE ID: CVE-2024-3923 State: PUBLISHED Published: 2024-05-09T20:03:35.785Z Last Updated: 2024-08-01T20:26:57.146Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: justinbusa Products: Beaver Builder – WordPress Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_target parameter in all versions up to, and including, 2.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access o
nt input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/99960ff7-62e1-4c44-ae8e-ebda3e075781?source=cve - https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/tags/2.8.0.7/modules/button/includes/frontend.php#L14 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078825%40beaver-builder-lite-version%2Ftrunk&old=3062187%40be
rdpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078825%40beaver-builder-lite-version%2Ftrunk&old=3062187%40beaver-builder-lite-version%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3924 State: PUBLISHED Published: 2024-05-30T14:59:43.416Z Last Updated: 2024-08-01T20:26:57.025Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: huggingface Products: huggingface/text-generation-inference Problem Types: CWE-94 Description: A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the `autodocs.yml` workflow file. The vulnerability arises from the insecure handling of the `github.head_ref` user input, which is used to dynamically construct a command for installing a software package. An attacker can exploit this by forking the repository, creating a branch with a malici
r installing a software package. An attacker can exploit this by forking the repository, creating a branch with a malicious payload as the name, and then opening a pull request to the base repository. Successful exploitation could lead to arbitrary code execution within the context of the GitHub Actions runner. This issue affects versions up to and including v2.0.0 and was fixed in version 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/8af92fc2-0103-4d29-bb28-c3893154c422 - https://github.com/huggingface/text-generation-inference/commit/88702d876383f7200eccf67e28ba00500dc804bb
CVE ID: CVE-2024-3925 State: PUBLISHED Published: 2024-06-12T07:32:52.972Z Last Updated: 2024-08-01T20:26:57.129Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 5.6.7 due
e to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 5.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/263dd246-32ed-4efc-b7a6-ee6c9d305f89?source=cve - https://wordpress.org/plugins/bdthemes-element-pack-lite/#developers
CVE ID: CVE-2024-3926 State: PUBLISHED Published: 2024-05-22T14:32:39.251Z Last Updated: 2024-08-01T20:26:57.124Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes value in widgets in all versions up to, and including, 5.6.1
e to Stored Cross-Site Scripting via the custom_attributes value in widgets in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f931cf8e-01dd-4f0b-ac86-6e0654fd1597?source=cve - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/5.6.0/modules/creative-b
4fd1597?source=cve - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/5.6.0/modules/creative-button/widgets/creative-button.php#L648 - https://plugins.trac.wordpress.org/changeset/3066178
CVE ID: CVE-2024-3927 State: PUBLISHED Published: 2024-05-22T06:50:33.584Z Last Updated: 2024-08-01T20:26:57.120Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: bdthemes Products: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Problem Types: CWE-424 Improper Protection of Alternate Path Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administ
versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3a703fc4-6c61-442e-a637-515e9f501575?source=cve - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/contact-form/module.php#L102 - https://plugins.trac.wordpress.org/changeset/3089154
CVE ID: CVE-2024-3928 State: PUBLISHED Published: 2024-04-17T23:31:05.432Z Last Updated: 2024-08-01T20:26:57.269Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dromara Products: open-capacity-platform Problem Types: CWE-200 Description: A vulnerability was found in Dromara open-capacity-platform 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /actuator/heapdump of the component auth-server. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB