Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8941 State: PUBLISHED Published: 2024-09-24T11:50:58.074Z Last Updated: 2024-09-24T13:27:40.219Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Scriptcase Products: Scriptcase Problem Types: CWE-22 Description: Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a path used in the POST parameter “field_file” by a web application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
POST parameter “field_file” by a web application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase
CVE ID: CVE-2024-8942 State: PUBLISHED Published: 2024-09-24T11:51:49.722Z Last Updated: 2024-09-24T13:26:07.233Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Scriptcase Products: Scriptcase Problem Types: CWE-79 Description: Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting (XSS), due to the lack of input validation, affecting the “id_form_msg_title” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vuln
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase
CVE ID: CVE-2024-8943 State: PUBLISHED Published: 2024-10-08T08:33:18.812Z Last Updated: 2024-10-08T14:18:50.585Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: latepoint Products: LatePoint Plugin Problem Types: CWE-288 Description: The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Note that logging in as a WordPress user is only pos
site, such as an administrator, if they have access to the user id. Note that logging in as a WordPress user is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. The vulnerability is partially patched in version 5.0.12 and fully patched in version 5.0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bac8c35b-2afa-4347-b86e-2f16db19a4d3?source=cve - https://wpdocs.latepoint.com/changelog/
CVE ID: CVE-2024-8944 State: PUBLISHED Published: 2024-09-17T18:00:08.222Z Last Updated: 2024-09-25T13:51:21.636Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Hospital Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in code-projects Hospital Management System 1.0. This affects an unknown part of the file check_availability.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2777
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277761 - https://vuldb.com/?ctiid.277761 - https://vuldb.com/?submit.408871 - https://github.com/65241/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2024-8945 State: PUBLISHED Published: 2024-09-17T18:00:12.619Z Last Updated: 2024-09-18T13:33:10.332Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: CodeCanyon Products: RISE Ultimate Project Manager Problem Types: CWE-89 Description: A vulnerability has been found in CodeCanyon RISE Ultimate Project Manager 3.7.0 and classified as critical. This vulnerability affects unknown code of the file /index.php/dashboard/save. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP V
the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277762 - https://vuldb.com/?ctiid.277762 - https://vuldb.com/?submit.409096 - https://bytium.com/sql-injection-vulnerability-identified-in-rise-crm/
CVE ID: CVE-2024-8946 State: PUBLISHED Published: 2024-09-17T18:31:04.213Z Last Updated: 2024-09-17T20:14:27.949Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: MicroPython Problem Types: CWE-122 Description: A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mp_vfs_umount of the file extmod/vfs.c of the component VFS Unmount Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 29943546343c92334e8518695a11fc0e2ceea68b. It is recommended to apply a patch to fix this
used. The name of the patch is 29943546343c92334e8518695a11fc0e2ceea68b. It is recommended to apply a patch to fix this issue. In the VFS unmount process, the comparison between the mounted path string and the unmount requested string is based solely on the length of the unmount string, which can lead to a heap buffer overflow read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277764 - https://vuldb.com/?ctiid.277764 - https://vuldb.com/?submit.409312 - https://github.com/micropython/micropython/issues/13006 - https://github.com/micropython/micropython/issues/13006#issuecomment-1820309455 - https://github.com/micropython/micropython/commit/2994354634
ropython/micropython/issues/13006#issuecomment-1820309455 - https://github.com/micropython/micropython/commit/29943546343c92334e8518695a11fc0e2ceea68b
CVE ID: CVE-2024-8947 State: PUBLISHED Published: 2024-09-17T18:31:06.916Z Last Updated: 2024-09-17T20:11:29.093Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: MicroPython Problem Types: CWE-416 Description: A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c0
difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277765 - https://vuldb.com/?ctiid.277765 - https://vuldb.com/?submit.409316 - https://github.com/micropython/micropython/issues/13283 - https://github.com/micropython/micropython/issues/13283#issuecomment-1918479709 - https://github.com/micropython/micropython/commit/4bed6
m/micropython/micropython/issues/13283#issuecomment-1918479709 - https://github.com/micropython/micropython/commit/4bed614e707c0644c06e117f848fa12605c711cd - https://github.com/micropython/micropython/releases/tag/v1.23.0
CVE ID: CVE-2024-8948 State: PUBLISHED Published: 2024-09-17T18:50:17.599Z Last Updated: 2024-09-17T20:07:19.189Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: MicroPython Problem Types: CWE-122 Description: A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 908ab1ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply a patch to fix this issue. In micropython objint componen
ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply a patch to fix this issue. In micropython objint component, converting zero from int to bytes leads to heap buffer-overflow-write at mpz_as_bytes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277766 - https://vuldb.com/?ctiid.277766 - https://vuldb.com/?submit.409317 - https://github.com/micropython/micropython/issues/13041 - https://github.com/micropython/micropython/commit/908ab1ceca15ee6fd0ef82ca4cba770a3ec41894
CVE ID: CVE-2024-8949 State: PUBLISHED Published: 2024-09-17T19:00:12.065Z Last Updated: 2024-09-17T20:05:10.142Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-282 Description: A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. This affects an unknown part of the file /classes/Master.php of the component Cart Content Handler. The manipulation of the argument cart_id/id leads to improper ownership management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277767 - https://vuldb.com/?ctiid.277767 - https://vuldb.com/?submit.409459 - https://github.com/gurudattch/CVEs/edit/main/Sourcecodester-Online-Eyewear-shop-webiste-Broken-access-control.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8950 State: PUBLISHED Published: 2024-12-25T12:16:38.613Z Last Updated: 2024-12-26T18:12:33.466Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Arne Informatics Products: Piramit Automation Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arne Informatics Piramit Automation allows Blind SQL Injection.This issue affects Piramit Automation: before 27.09.2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1898
CVE ID: CVE-2024-8951 State: PUBLISHED Published: 2024-09-17T20:00:08.078Z Last Updated: 2024-09-18T13:01:51.656Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Resort Reservation System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Resort Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_fee.php. The manipulation of the argument toview leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277777 - https://vuldb.com/?ctiid.277777 - https://vuldb.com/?submit.409586 - https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-Resort-Reservation-system-XSS.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8952 State: PUBLISHED Published: 2025-03-20T10:10:59.130Z Last Updated: 2025-03-20T15:52:34.147Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: composiohq Products: composiohq/composio Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/d1acdd38-10d7-45df-9df0-9fc71f0e1c
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/d1acdd38-10d7-45df-9df0-9fc71f0e1c2a
CVE ID: CVE-2024-8953 State: PUBLISHED Published: 2025-03-20T10:10:56.507Z Last Updated: 2025-03-20T18:10:22.095Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: composiohq Products: composiohq/composio Problem Types: CWE-627 Description: In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c
CVE ID: CVE-2024-8954 State: PUBLISHED Published: 2025-03-20T10:10:15.583Z Last Updated: 2025-10-15T12:50:43.444Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: composiohq Products: composiohq/composio Problem Types: CWE-304 Description: In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the `x-api-key` header, thereby gaining unauthorized access to the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f1e0fdce-00d7-4261-a466-923062800b
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f1e0fdce-00d7-4261-a466-923062800b12
CVE ID: CVE-2024-8955 State: PUBLISHED Published: 2025-03-20T10:09:27.940Z Last Updated: 2025-10-15T12:50:43.991Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: composiohq Products: composiohq/composio Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/13bc0399-2d9b-449e-95f2-6e9a7e39383d
CVE ID: CVE-2024-8956 State: PUBLISHED Published: 2024-09-17T19:59:27.205Z Last Updated: 2025-11-22T12:09:58.681Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: PTZOptics Products: PT30X-SDI, PT30X-NDI Problem Types: CWE-306 Description: PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individ
itive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ptzoptics.com/firmware-changelog/ - https://vulncheck.com/advisories/ptzoptics-insufficient-auth
CVE ID: CVE-2024-8957 State: PUBLISHED Published: 2024-09-17T20:08:25.588Z Last Updated: 2025-11-22T01:49:25.254Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: PTZOptics Products: PT30X-SDI, PT30X-NDI Problem Types: CWE-78 Description: PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
ttacker can execute arbitrary OS commands on affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ptzoptics.com/firmware-changelog/ - https://vulncheck.com/advisories/ptzoptics-command-injection
CVE ID: CVE-2024-8958 State: PUBLISHED Published: 2025-03-20T10:11:16.677Z Last Updated: 2025-03-20T13:12:51.449Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: composiohq Products: composiohq/composio Problem Types: CWE-434 Description: In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions. Due to improper validation of file paths, an attacker can read and write files anywhere on the server, potentially leading to privilege escalation or remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e152b094-0593-428e-b813-068d2390ce68
CVE ID: CVE-2024-8959 State: PUBLISHED Published: 2024-10-24T11:34:08.743Z Last Updated: 2024-10-24T20:36:57.842Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: litonice13 Products: WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer Problem Types: CWE-79 Description: The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web s
aping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68094545-0e2a-429d-95b7-bfa86eca1caa?source=cve - https://wordpress.org/plugins/adminify/#developers - https://wpadminify.com/changelogs - https://plugins.trac.wordpress.org/changeset/3165558/
CVE ID: CVE-2024-8960 State: PUBLISHED Published: 2024-11-09T02:32:04.295Z Last Updated: 2024-11-09T15:44:03.681Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codelessthemes Products: Cowidgets – Elementor Addons Problem Types: CWE-79 Description: The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Addit
ccess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fac90d55-9ae2-48a8-b82b-fe1626556c7b?source=cve - https://plugins.trac.wordpress.org/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/class-widgets-loader.php#L324 - https://wordpress.org/plugins/cowidgets-elementor-addons/#developers
CVE ID: CVE-2024-8961 State: PUBLISHED Published: 2024-11-15T06:48:03.358Z Last Updated: 2024-11-15T18:09:24.598Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Description: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomore_items_text’ parameter in all versions up to, and including, 6.0.7 due to insufficient input sanitization and output escaping. This makes it possible for auth
up to, and including, 6.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45ef20aa-18e3-4ad8-a94e-76e29de5b562?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php - https://plugins.trac.wordpress.org/changeset/3176312/
CVE ID: CVE-2024-8962 State: PUBLISHED Published: 2024-12-04T11:08:26.540Z Last Updated: 2024-12-04T14:09:08.636Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpbits Products: WPBITS Addons For Elementor Page Builder Problem Types: CWE-79 Description: The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the
h Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f735f05d-8178-46bd-894d-49ccfb31d304?source=cve - https://wordpress.org/plugins/wpbits-addons-for-elementor/#developers - https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/elementor-config.php#L721 - https://plugins.trac.wordpress.org/changeset/3200392/
CVE ID: CVE-2024-8963 State: PUBLISHED Published: 2024-09-19T17:14:49.386Z Last Updated: 2025-10-21T22:55:44.119Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Ivanti Products: CSA (Cloud Services Appliance) Problem Types: CWE-22 Description: Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963
CVE ID: CVE-2024-8964 State: PUBLISHED Published: 2024-10-08T07:32:27.666Z Last Updated: 2024-10-08T13:25:09.555Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sirv Products: Image Optimizer, Resizer and CDN – Sirv Problem Types: CWE-79 Description: The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG
thor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39b2435f-32a3-4158-a734-c21a0cab15be?source=cve - https://wordpress.org/plugins/sirv/#developers - https://plugins.trac.wordpress.org/changeset/3162079/