Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e associated identifier of this vulnerability is VDB-273555. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273555 - https://vuldb.com/?ctiid.273555 - https://vuldb.com/?submit.381325 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/N350R/setWizardCfg.md
CVE ID: CVE-2024-7463 State: PUBLISHED Published: 2024-08-05T00:31:04.075Z Last Updated: 2024-08-05T13:55:20.896Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: CP900 Problem Types: CWE-120 Description: A vulnerability classified as critical was found in TOTOLINK CP900 6.3c.566. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273556. NOTE: The vendor was contacted early about this disclosure but did not respond i
er of this vulnerability is VDB-273556. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273556 - https://vuldb.com/?ctiid.273556 - https://vuldb.com/?submit.381333 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP900/UploadCustomModule.md
CVE ID: CVE-2024-7464 State: PUBLISHED Published: 2024-08-05T01:00:06.527Z Last Updated: 2024-08-05T15:41:34.346Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: CP900 Problem Types: CWE-77 Description: A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Telnet Service. The manipulation of the argument telnet_enabled leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273557 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclos
d. The identifier VDB-273557 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273557 - https://vuldb.com/?ctiid.273557 - https://vuldb.com/?submit.381334 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP900/setTelnetCfg.md
CVE ID: CVE-2024-7465 State: PUBLISHED Published: 2024-08-05T01:31:04.318Z Last Updated: 2024-08-05T10:20:55.103Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: CP450 Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, was found in TOTOLINK CP450 4.1.0cu.747_B20191224. Affected is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-273558 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosur
. VDB-273558 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273558 - https://vuldb.com/?ctiid.273558 - https://vuldb.com/?submit.381340 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP450/loginauth.md
CVE ID: CVE-2024-7466 State: PUBLISHED Published: 2024-08-05T02:00:08.330Z Last Updated: 2024-08-05T13:50:54.531Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: PMWeb Problem Types: CWE-79 Description: A vulnerability has been found in PMWeb 7.2.00 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Application Firewall. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273559. NOTE: The vendor was contacted early about this disclosure but did not respond i
er of this vulnerability is VDB-273559. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273559 - https://vuldb.com/?ctiid.273559 - https://vuldb.com/?submit.381382 - https://mega.nz/file/nEcUTJxI#L2DCw4f4iwbXuErXlB1NRowprk1UZjWw6FtLgBgBpEA
CVE ID: CVE-2024-7467 State: PUBLISHED Published: 2024-08-05T02:31:03.618Z Last Updated: 2024-08-06T20:23:07.949Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Raisecom Products: MSG1200, MSG2100E, MSG2200, MSG2300 Problem Types: CWE-78 Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 and classified as critical. Affected by this issue is the function sslvpn_config_mod of the file /vpn/list_ip_network.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of
n. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273560. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273560 - https://vuldb.com/?ctiid.273560 - https://vuldb.com/?submit.385347 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/sQrromK7x42JbLgY/Command%20Injection%20Vulnerability%20in%20RAISECOM%20Gateway%20Devices-list_ip_network.php.pdf
CVE ID: CVE-2024-7468 State: PUBLISHED Published: 2024-08-05T03:00:09.370Z Last Updated: 2024-08-05T15:30:35.443Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Raisecom Products: MSG1200, MSG2100E, MSG2200, MSG2300 Problem Types: CWE-78 Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been classified as critical. This affects the function sslvpn_config_mod of the file /vpn/list_service_manage.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The ide
n. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273561 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273561 - https://vuldb.com/?ctiid.273561 - https://vuldb.com/?submit.385348 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/sQrromK7x42JbLgY/Command%20Injection%20Vulnerability%20in%20RAISECOM%20Gateway%20Devices-list_service_manage.php.pdf
CVE ID: CVE-2024-7469 State: PUBLISHED Published: 2024-08-05T03:31:04.492Z Last Updated: 2024-08-05T10:15:23.547Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Raisecom Products: MSG1200, MSG2100E, MSG2200, MSG2300 Problem Types: CWE-78 Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been declared as critical. This vulnerability affects the function sslvpn_config_mod of the file /vpn/list_vpn_web_custom.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-2
and injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273562 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273562 - https://vuldb.com/?ctiid.273562 - https://vuldb.com/?submit.385349 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/sQrromK7x42JbLgY/Command%20Injection%20Vulnerability%20in%20RAISECOM%20Gateway%20Devices-list_vpn_web_custom.php.pdf
CVE ID: CVE-2024-7470 State: PUBLISHED Published: 2024-08-05T04:00:09.079Z Last Updated: 2024-08-06T20:22:22.952Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Raisecom Products: MSG1200, MSG2100E, MSG2200, MSG2300 Problem Types: CWE-78 Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been rated as critical. This issue affects the function sslvpn_config_mod of the file /vpn/vpn_template_style.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated id
n. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273563. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273563 - https://vuldb.com/?ctiid.273563 - https://vuldb.com/?submit.385350 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/sQrromK7x42JbLgY/Command%20Injection%20Vulnerability%20in%20RAISECOM%20Gateway%20Devices-vpn_template_style.php.pdf
CVE ID: CVE-2024-7472 State: PUBLISHED Published: 2024-10-29T12:49:50.701Z Last Updated: 2025-10-15T12:49:50.209Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-93 Description: lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause lega
e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/dc1feec6-1efb-4538-9b56-ab25deb80948 - https://github.com/lunary-ai/lunary/commit/a39837d7c49936a0c435d241f37ca2ea7904d2cd
CVE ID: CVE-2024-7473 State: PUBLISHED Published: 2024-10-29T12:48:38.296Z Last Updated: 2024-11-03T18:27:26.689Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-639 Description: An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerability allows an authenticated user to update other users' prompts by manipulating the 'id' parameter in the request. The issue is fixed in version 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/afecd927-b5f6-44ba-9147-5c45091beda5 - https://
Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/afecd927-b5f6-44ba-9147-5c45091beda5 - https://github.com/lunary-ai/lunary/commit/88b55b01fcbab0fbbc5b8032a38d0345af98ecfa
CVE ID: CVE-2024-7474 State: PUBLISHED Published: 2024-10-29T12:46:34.965Z Last Updated: 2025-01-09T17:14:10.641Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-639 Description: In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating the 'id' parameter in the request URL. The application does not perform adequate checks on the 'id' parameter, allowing unauthorized access to external user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/95d8b993-3347-
al user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/95d8b993-3347-4ef5-a2b3-1f57219b7871 - https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5
CVE ID: CVE-2024-7475 State: PUBLISHED Published: 2024-10-29T12:45:53.136Z Last Updated: 2025-10-21T14:10:24.049Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-862 Description: An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization. This vulnerability can lead to manipulation of authentication processes, fraudulent login requests, and theft of user information. Appropriate access controls should be implemented to ensure that the SAML configuration can only be updated by authorized users. Additional Analyst
should be implemented to ensure that the SAML configuration can only be updated by authorized users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/78c824f7-3b6d-443d-bb76-0f8031c6c126 - https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5
CVE ID: CVE-2024-7476 State: PUBLISHED Published: 2025-03-20T10:09:59.839Z Last Updated: 2025-10-15T12:49:51.255Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-639 Description: A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/183761f7-d411-4332-af86-2ccfbcc5bd9f
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/183761f7-d411-4332-af86-2ccfbcc5bd9f - https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5
CVE ID: CVE-2024-7477 State: PUBLISHED Published: 2024-08-08T16:02:43.125Z Last Updated: 2024-08-09T18:21:58.052Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Avaya Products: Aura System Manager Problem Types: CWE-89 Description: A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary queries against the Avaya Aura System Manager database. Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer support. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.avaya.com/css/public/documents/101091159
CVE ID: CVE-2024-7479 State: PUBLISHED Published: 2024-09-25T10:34:08.097Z Last Updated: 2024-09-25T15:13:29.437Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: TeamViewer Products: Remote Full Client, Remote Host Problem Types: CWE-347 Description: Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows system to elevate their privileges and install drivers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trus
l drivers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1006/
CVE ID: CVE-2024-7480 State: PUBLISHED Published: 2024-08-08T16:04:25.989Z Last Updated: 2025-10-01T01:33:36.494Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Avaya Products: Aura System Manager Problem Types: CWE-266 Description: An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privileges to read arbitrary files on the system. Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer support. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.avaya.com/css/public/documents/101091159
CVE ID: CVE-2024-7481 State: PUBLISHED Published: 2024-09-25T10:33:12.452Z Last Updated: 2024-09-25T15:16:30.827Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: TeamViewer Products: Remote Full Client, Remote Host Problem Types: CWE-347 Description: Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows system to elevate their privileges and install drivers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/
stall drivers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1006/
CVE ID: CVE-2024-7484 State: PUBLISHED Published: 2024-08-06T01:49:56.901Z Last Updated: 2024-08-06T13:47:26.963Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: crmperks Products: CRM Perks Forms – WordPress Form Builder Problem Types: CWE-434 Description: The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional
above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/02c6ec97-50cc-4c61-9bb7-b94250d5dda3?source=cve - https://plugins.trac.wordpress.org/browser/crm-perks-forms/trunk/includes/front-form.php?rev=3003885#L3271 - https://plugins.trac.wordpress.org/changeset/3016768/crm-perks-forms
CVE ID: CVE-2024-7485 State: PUBLISHED Published: 2024-08-06T01:49:58.568Z Last Updated: 2024-08-06T13:40:06.025Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: kaizencoders Products: Traffic Manager Problem Types: CWE-79 Description: The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX function in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: -
arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f508f1-45a0-4cb4-9d67-51edd3d74abe?source=cve - https://plugins.trac.wordpress.org/browser/traffic-manager/trunk/traffic-manager.php?rev=1709967#L2745 - https://plugins.trac.wordpress.org/browser/traffic-manager/trunk/traffic-manager.php?rev=1709967#L2375
CVE ID: CVE-2024-7486 State: PUBLISHED Published: 2024-08-08T01:50:34.257Z Last Updated: 2024-08-08T14:00:17.788Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: codename065 Products: MultiPurpose Problem Types: CWE-502 Description: The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 via deserialization of untrusted input through the 'wpeden_post_meta' post meta. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme
. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e029bc15-8128-42d1-8874-b0689312cb35?source=cve - https://themes.trac.wordpress.org/browser/multipurpose/1.2.0/functions.php#L134
CVE ID: CVE-2024-7487 State: PUBLISHED Published: 2025-05-22T19:03:13.414Z Last Updated: 2025-05-22T19:23:58.211Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: WSO2 Products: WSO2 Identity Server, Client Attestation Filter, WSO2 Carbon Identity Client Attestation Met Data Mgt BE Problem Types: CWE-287 Description: An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed. Exploitation of this vulnerability could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authe
y could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authentication process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3348/
CVE ID: CVE-2024-7488 State: PUBLISHED Published: 2024-12-04T14:03:49.141Z Last Updated: 2025-10-21T14:09:32.523Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: RestApp Inc. Products: Online Ordering System Problem Types: CWE-190, CWE-1284 Description: Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allows Integer Attacks. This issue affects Online Ordering System: 8.2.1. NOTE: Vulnerability fixed in version 8.2.2 and does not exist before 8.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1877
CVE ID: CVE-2024-7489 State: PUBLISHED Published: 2024-10-12T05:39:40.549Z Last Updated: 2024-10-16T06:35:01.970Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: fatcatapps Products: Forms for Mailchimp by Optin Cat – Grow Your MailChimp List Problem Types: CWE-79 Description: The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form color parameters in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that