Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1088 State: PUBLISHED Published: 2024-03-05T01:56:01.564Z Last Updated: 2024-08-01T18:26:30.487Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: rajkakadiya Products: Password Protected Store for WooCommerce Problem Types: CWE-284 Improper Access Control Description: The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive data including post titles and content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - htt
g post titles and content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae1e8fd-4d1b-4590-a141-f93d6347c0f2?source=cve - https://wordpress.org/plugins/password-protected-woo-store/
CVE ID: CVE-2024-1089 State: PUBLISHED Published: 2024-02-20T18:56:36.652Z Last Updated: 2024-08-01T18:26:30.499Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-862 Missing Authorization Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optimizeAllOn function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify image optimization settings. Additional Analyst Notes: - CISA
tackers, with subscriber-level access and above, to modify image optimization settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff16906-2516-4b3c-8217-e3fb24924e27?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-1090 State: PUBLISHED Published: 2024-02-20T18:56:50.676Z Last Updated: 2025-04-22T16:26:52.393Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-862 Missing Authorization Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stopOptimizeAll function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify image optimization settings. Additional Analyst Notes: - CI
attackers, with subscriber-level access and above, to modify image optimization settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fae909-5564-4e0a-9114-edd0e45865e5?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-1091 State: PUBLISHED Published: 2024-02-20T18:56:26.298Z Last Updated: 2024-08-01T18:26:30.491Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-862 Missing Authorization Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reinitialize function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to remove all plugin data. Additional Analyst Notes: - CISA ADP Vulnrich
ackers, with subscriber-level access and above, to remove all plugin data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb8b08c-a028-48bd-acad-c00313fe06b8?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-1092 State: PUBLISHED Published: 2024-02-05T21:21:53.970Z Last Updated: 2024-09-03T15:38:09.934Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themeisle Products: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Problem Types: CWE-284 Improper Access Control Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the feedzy dashboard in all versions up to, and including, 4.4.1. This makes it possible for authenticated attackers, with contr
zy dashboard in all versions up to, and including, 4.4.1. This makes it possible for authenticated attackers, with contributor access or higher, to create, edit or delete feed categories created by them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98053141-fe97-4bd4-b820-b6cca3426109?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3030538%40feedzy-rss-feeds%2Ftrunk&old=3028200%40feedzy-rss-feeds%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1093 State: PUBLISHED Published: 2024-03-05T01:56:03.764Z Last Updated: 2024-08-01T18:26:30.607Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: simon99 Products: Change Memory Limit Problem Types: CWE-862 Missing Authorization Description: The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_logic() function hooked via admin_init in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to update the memory limit. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.
the memory limit. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eee7344d-5459-4558-a557-d8c5935ecc30?source=cve - https://plugins.trac.wordpress.org/browser/change-memory-limit/trunk/change-mem-limit.php#L104
CVE ID: CVE-2024-1094 State: PUBLISHED Published: 2024-06-14T04:36:54.514Z Last Updated: 2024-08-01T18:26:30.510Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: arraytics Products: WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin Problem Types: CWE-862 Missing Authorization Description: The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant use
function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/76fe8746-582e-49a5-b0c1-19d2aaef44df?source=cve - https://plugins.trac.wordpress.org/changeset/3101489/timetics/trunk/core/staffs/hooks.php
CVE ID: CVE-2024-1095 State: PUBLISHED Published: 2024-03-05T01:55:59.364Z Last Updated: 2024-08-26T18:35:45.129Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: razib_ Products: Build & Control Block Patterns – Boost up Gutenberg Editor Problem Types: CWE-862 Missing Authorization Description: The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the settings_export() function in all versions up to, and including, 1.3.5.4. This makes it possible for unauthenticated attackers to export the plugin's settings. Additional Analyst Notes: - CISA ADP Vul
akes it possible for unauthenticated attackers to export the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38f09a45-2b11-47c7-af16-c7f9c3a46e0e?source=cve - https://plugins.trac.wordpress.org/browser/control-block-patterns/trunk/classes/Settings/SettingsPage.php#L166
CVE ID: CVE-2024-1096 State: PUBLISHED Published: 2024-02-13T14:53:20.381Z Last Updated: 2024-08-27T14:23:40.543Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Filseclab Products: Twister Antivirus Problem Types: CWE-476 Description: Twister Antivirus v8.17 is vulnerable to a Denial of Service vulnerability by triggering the 0x80112067, 0x801120CB 0x801120CC 0x80112044, 0x8011204B, 0x8011204F, 0x80112057, 0x8011205B, 0x8011205F, 0x80112063, 0x8011206F, 0x80112073, 0x80112077, 0x80112078, 0x8011207C and 0x80112080 IOCTL codes of the fildds.sys driver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidatta
.sys driver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/holiday/ - http://www.filseclab.com/en-us/products/twister.htm
CVE ID: CVE-2024-1097 State: PUBLISHED Published: 2024-11-15T10:57:11.234Z Last Updated: 2024-11-15T21:04:04.691Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: craigk5n Products: craigk5n/webcalendar Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report, potentially leading to the theft of user accounts and cookies. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
leading to the theft of user accounts and cookies. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6dd501f6-6047-4ddb-8b14-f0fc53cdc28e
CVE ID: CVE-2024-1098 State: PUBLISHED Published: 2024-01-31T11:31:04.316Z Last Updated: 2025-05-29T15:04:07.376Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Rebuild Problem Types: CWE-200 Description: A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic. This issue affects the function QiniuCloud.getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to information disclosure. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252455. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
fier of this vulnerability is VDB-252455. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252455 - https://vuldb.com/?ctiid.252455 - https://www.yuque.com/mailemonyeyongjuan/tha8tr/ouiw375l0m8mw5ls
CVE ID: CVE-2024-1099 State: PUBLISHED Published: 2024-01-31T11:31:05.389Z Last Updated: 2024-08-23T19:26:33.667Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Rebuild Problem Types: CWE-79 Description: A vulnerability was found in Rebuild up to 3.5.5. It has been classified as problematic. Affected is the function getFileOfData of the file /filex/read-raw. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252456. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
this vulnerability is VDB-252456. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252456 - https://vuldb.com/?ctiid.252456 - https://www.yuque.com/mailemonyeyongjuan/tha8tr/dcilugg0htp973nx
CVE ID: CVE-2024-1100 State: PUBLISHED Published: 2024-05-30T11:49:59.216Z Last Updated: 2024-08-01T18:26:30.488Z Vendors: Vadi Corporate Information Systems Products: DIGIKENT GIS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vadi Corporate Information Systems DIGIKENT GIS allows SQL Injection.This issue affects DIGIKENT GIS: through 2.23.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0589
CVE ID: CVE-2024-1102 State: PUBLISHED Published: 2024-04-25T16:24:30.245Z Last Updated: 2025-11-11T15:53:53.730Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat JBoss Enterprise Application Platform, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single
t JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7 Problem Types: CWE-523 Description: A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1677 - https://access.redhat.com/errata/RHSA-2024:3580 - https://access.redhat.com/errata/RHSA-2024:3581 - https://access.redhat.com/errata/RHSA-2024:3583 - https://access.redhat.com/security/cve/CVE-2024-1102 - https://bugzil
https://access.redhat.com/errata/RHSA-2024:3583 - https://access.redhat.com/security/cve/CVE-2024-1102 - https://bugzilla.redhat.com/show_bug.cgi?id=2262060 - https://github.com/jberet/jsr352/issues/452
CVE ID: CVE-2024-1103 State: PUBLISHED Published: 2024-01-31T15:00:06.875Z Last Updated: 2025-06-17T21:29:19.659Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Real Estate Management System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file profile.php of the component Feedback Form. The manipulation of the argument Your Feedback with the input <img src=x onerror=alert(document.cookie)> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may
leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252458 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252458 - https://vuldb.com/?ctiid.252458 - https://docs.google.com/document/d/18M55HRrxHQ9Jhph6CwWF-d5epAKtOSHt/edit?usp=drive_link&ouid=105609487033659389545&rtpof=true&sd=true
CVE ID: CVE-2024-1104 State: PUBLISHED Published: 2024-02-22T11:33:51.073Z Last Updated: 2024-08-14T15:52:08.246Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Areal Topkapi Products: Webserv2 Problem Types: CWE-307 Description: An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.areal-topkapi.com/en/services/security-bulletins
CVE ID: CVE-2024-1106 State: PUBLISHED Published: 2024-02-27T08:30:30.863Z Last Updated: 2024-10-27T22:15:34.648Z Vendors: Unknown Products: Shariff Wrapper Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0672f8af-33e2-459c-ac8a-7351247a8a26/
CVE ID: CVE-2024-1107 State: PUBLISHED Published: 2024-06-27T13:01:50.247Z Last Updated: 2025-09-12T06:33:18.613Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Talya Informatics Products: Travel APPS Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel APPS: before v17.0.68. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0809
CVE ID: CVE-2024-1108 State: PUBLISHED Published: 2024-02-21T03:03:23.872Z Last Updated: 2024-08-01T18:26:30.498Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: desertsnowman Products: Plugin Groups Problem Types: CWE-862 Missing Authorization Description: The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_init() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to change the settings of the plugin, which can also cause a denial of service due to a misconfiguration. Additional Analyst Notes: - CISA ADP Vulnrichment:
which can also cause a denial of service due to a misconfiguration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8298f1fb-3165-40e3-9192-805a07c14cae?source=cve - https://plugins.trac.wordpress.org/changeset/3036754/plugin-groups/trunk/classes/class-plugin-groups.php
CVE ID: CVE-2024-1109 State: PUBLISHED Published: 2024-02-07T11:02:39.482Z Last Updated: 2024-08-01T18:26:30.508Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: eteubert Products: Podlove Podcast Publisher Problem Types: CWE-862 Missing Authorization Description: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program C
t the plugin's tracking data and podcast information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7b25b66-e9d1-448d-8367-cce4c0dec635?source=cve - https://github.com/podlove/podlove-publisher/commit/0ac83d1955aa964a358833b1b5ce790fff45b3f4 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032008%40podlove-podcasting-plugin-for-wordpress&new=3032008%40podlove-podcasting-plugin-for-wordpress&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1110 State: PUBLISHED Published: 2024-02-07T11:02:38.853Z Last Updated: 2025-05-15T19:42:51.787Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: eteubert Products: Podlove Podcast Publisher Problem Types: CWE-862 Missing Authorization Description: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfenc
settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9cf461-572c-4be8-96e6-659acf3208f3?source=cve - https://github.com/podlove/podlove-publisher/commit/7873ff520631087e2f10737860cdcd64d53187ba - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032008%40podlove-podcasting-plugin-for-wordpress&new=3032008%40podlove-podcasting-plugin-for-wordpress&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1111 State: PUBLISHED Published: 2024-01-31T19:00:06.546Z Last Updated: 2025-05-29T15:03:31.976Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: QR Code Login System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Login System 1.0. Affected by this issue is some unknown functionality of the file add-user.php. The manipulation of the argument qr-code leads to cross site scripting. The attack may be launched remotely. VDB-252470 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
ier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252470 - https://vuldb.com/?ctiid.252470
CVE ID: CVE-2024-1112 State: PUBLISHED Published: 2024-01-31T13:17:59.316Z Last Updated: 2025-05-29T15:03:52.453Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Angus Johnson Products: Resource Hacker Problem Types: CWE-119 Description: Heap-based buffer overflow vulnerability in Resource Hacker, developed by Angus Johnson, affecting version 3.6.0.92. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/buffer-overflow-vulnerability-resource-hacker
CVE ID: CVE-2024-1113 State: PUBLISHED Published: 2024-01-31T19:31:03.971Z Last Updated: 2024-08-27T20:28:19.120Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: openBI Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/controller/Unity.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252471. Additional Analyst Notes: - CVE Program Container: -
sed. The associated identifier of this vulnerability is VDB-252471. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252471 - https://vuldb.com/?ctiid.252471 - https://note.zhaoj.in/share/hPSx8li8LFfJ
CVE ID: CVE-2024-1114 State: PUBLISHED Published: 2024-01-31T19:31:05.018Z Last Updated: 2024-08-23T19:24:44.201Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: n/a Products: openBI Problem Types: CWE-284 Description: A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/controller/Screen.php. The manipulation of the argument fileUrl leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252472. Additional Analyst Notes: - CVE Progr