Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
erlying service responds that a user is permitted access to the elevation feature, the client then reinitiates communication with the underlying service and requests elevation. This elevation request has no local checks in the service, and depends on client-side validation in the AdminByRequest.exe interface, i.e., it is a vulnerable exposed functionality in the service. By communicating directly with the underlying service, any user can request elevation and obtain Administrator privilege regardless of group policies or permissions. Additional Analyst Notes: - CVE Program Container: References: - https://improsec.com/en/responsible-disclosure - https://www.adminbyrequest.com/en/releasenotes
CVE ID: CVE-2019-17202 State: PUBLISHED Published: 2020-01-23T00:00:00 Last Updated: 2024-08-05T01:33:17.108Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AC:L/AV:L/A:N/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a PIN code in a challenge-response manner upon attempting to elevate privileges. The challenge's response uses a simple algorithm that can be easily emulated via data (customer ID and
vate privileges. The challenge's response uses a simple algorithm that can be easily emulated via data (customer ID and device name) available to all users, and thus any user can elevate to Administrator privilege. Additional Analyst Notes: - CVE Program Container: References: - https://improsec.com/en/responsible-disclosure - https://www.adminbyrequest.com/en/releasenotes
CVE ID: CVE-2019-17203 State: PUBLISHED Published: 2019-10-05T21:45:09 Last Updated: 2024-08-05T01:33:17.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nilsteampassnet/TeamPass/issues/2690
CVE ID: CVE-2019-17204 State: PUBLISHED Published: 2019-10-05T21:44:58 Last Updated: 2024-08-05T01:33:17.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nilsteampassnet/TeamPass/issues/2689
CVE ID: CVE-2019-17205 State: PUBLISHED Published: 2019-10-05T21:44:26 Last Updated: 2024-08-05T01:33:17.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nilsteampassnet/TeamPass/issues/2688
CVE ID: CVE-2019-17206 State: PUBLISHED Published: 2019-10-05T22:01:24 Last Updated: 2024-08-05T01:33:17.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary scripts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frostming/rediswrapper/pull/1 - https://github.com/frostming/rediswrapper/compare/v0.2.1...v0.3.0 - https://github.com/frostming/rediswrapper/releases/tag/v0.3.0
CVE ID: CVE-2019-17207 State: PUBLISHED Published: 2019-10-18T15:47:35 Last Updated: 2024-08-05T01:33:17.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/broken-link-checker/#developers - http://seclists.org/fulldisclosure/2019/Oct/31 - http://p
ttps://wordpress.org/plugins/broken-link-checker/#developers - http://seclists.org/fulldisclosure/2019/Oct/31 - http://packetstormsecurity.com/files/154875/WordPress-Broken-Link-Checker-1.11.8-Cross-Site-Scripting.html - https://wpvulndb.com/vulnerabilities/9917
CVE ID: CVE-2019-17210 State: PUBLISHED Published: 2019-11-04T19:48:28 Last Updated: 2024-08-05T01:33:17.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString() is called by the function MQTTDeserialize_publish() to get the length and content of the MQTT topic name. In the function readMQTTLenString(), mqttstring->lenstring.len is a part of user input, which can be manipulated. An attacker can simply change it to a larger value to invalidate the if statement so that the statements inside the if statement are skipped, letting the value of mqttstring->lenstring.data
f statement so that the statements inside the if statement are skipped, letting the value of mqttstring->lenstring.data default to zero. Later, curn is accessed, which points to mqttstring->lenstring.data. On an Arm Cortex-M chip, the value at address 0x0 is actually the initialization value for the MSP register. It is highly dependent on the actual firmware. Therefore, the behavior of the program is unpredictable from this time on. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbed-os/issues/11802
CVE ID: CVE-2019-17211 State: PUBLISHED Published: 2019-11-05T15:06:40 Last Updated: 2024-08-05T01:33:17.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sn_coap_builder_calc_needed_packet_data_size_2() is used to calculate the required memory for the CoAP message from the sn_coap_hdr_s data structure. Both returned_byte_count and src_coap_msg_ptr->payload_len are of type uint16_t. When added together, the result returned_byte_count can wrap around the maximum uint16_t value. As a result, insufficient buffer space is allocated for the corresponding CoAP message. Additional Analyst Notes:
value. As a result, insufficient buffer space is allocated for the corresponding CoAP message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L355 - https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L1090 - https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L710 - https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap
.c#L710 - https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L524 - https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L527 - https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L718 - https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L746 - https://github.com/ARMmbed/mbed-os/issues/11804
CVE ID: CVE-2019-17212 State: PUBLISHED Published: 2019-11-05T14:53:22 Last Updated: 2024-08-05T01:33:17.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the 0xFF delimiter byte. Inside each while loop, the check of the value of *packet_data_pptr is not strictly enforced.
y the 0xFF delimiter byte. Inside each while loop, the check of the value of *packet_data_pptr is not strictly enforced. More specifically, inside a loop, *packet_data_pptr could be increased and then dereferenced without checking. Moreover, there are many other functions in the format of sn_coap_parser_****() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows, depending on how the CoAP packet buffer is allocated. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn
https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L301 - https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L660 - https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L331 - https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L257 - https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser
ub.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L310 - https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L313 - https://github.com/ARMmbed/mbed-os/issues/11803
CVE ID: CVE-2019-17213 State: PUBLISHED Published: 2019-10-06T13:22:18 Last Updated: 2024-08-05T01:33:17.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-webarx-cross-site-scripting-1-3-0/ - https://packetstormsecurity.com/files/149573/WordPress-WebARX-Website-Firewall-4.9.8-XSS-Bypass.html
CVE ID: CVE-2019-17214 State: PUBLISHED Published: 2019-10-06T13:21:37 Last Updated: 2024-08-05T01:33:17.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/149573/WordPress-WebARX-Website-Firewall-4.9.8-XSS-Bypass.html
CVE ID: CVE-2019-17215 State: PUBLISHED Published: 2019-10-06T15:24:12 Last Updated: 2024-08-05T01:33:17.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no bruteforce protection (e.g., lockout) established. An attacker might be able to bruteforce the password to authenticate on the device. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.140463
CVE ID: CVE-2019-17216 State: PUBLISHED Published: 2019-10-06T15:24:00 Last Updated: 2024-08-05T01:33:17.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking is possible with minimal effort. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.134117
CVE ID: CVE-2019-17217 State: PUBLISHED Published: 2019-10-06T15:23:52 Last Updated: 2024-08-05T01:33:17.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.140464
CVE ID: CVE-2019-17218 State: PUBLISHED Published: 2019-10-06T15:23:44 Last Updated: 2024-08-05T01:33:17.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencrypted via http. An attacker is able to intercept and sniff communication to the web service. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.134116
CVE ID: CVE-2019-17219 State: PUBLISHED Published: 2019-10-06T15:23:35 Last Updated: 2024-08-05T01:33:17.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the device does not enforce any authentication. An adjacent attacker is able to use the network interface without proper access control. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.134115
CVE ID: CVE-2019-17220 State: PUBLISHED Published: 2019-10-21T20:12:50 Last Updated: 2024-08-05T01:33:17.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line. Additional Analyst Notes: - CVE Program Container: References: - https://www.nezami.me/ - https://github.com/RocketChat/Rocket.Chat/releases - https://github.com/RocketChat/Rocket.Chat/commits/develop - http://packetstormsecurity.com/files/154944/Rocket.Chat-2.1.0-Cross-Site-Scripting.html
CVE ID: CVE-2019-17221 State: PUBLISHED Published: 2019-11-05T13:10:45 Last Updated: 2024-08-05T01:33:17.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HTML file, as user input, that allows reading arbitrary files on the filesystem. For example, if page.render() is the function callback, this generates a PDF or an image of the targeted file. NOTE: this product is no longer developed.
the function callback, this generates a PDF or an image of the targeted file. NOTE: this product is no longer developed. Additional Analyst Notes: - CVE Program Container: References: - https://www.darkmatter.ae/blogs/breaching-the-perimeter-phantomjs-arbitrary-file-read/
CVE ID: CVE-2019-17222 State: PUBLISHED Published: 2019-11-07T15:03:12 Last Updated: 2024-08-05T01:33:17.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN configuration screen, leading to a denial of service (inability to change the configuration). Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=e3sozdDExTM
CVE ID: CVE-2019-17223 State: PUBLISHED Published: 2019-10-15T11:59:29 Last Updated: 2024-08-05T01:33:17.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.dolibarr.org/forum/dolibarr-changelogs - https://medium.com/%40k43p/cve-2019-17223-stored-html-injection-dolibarr-crm-erp-ad1e064d0ca5
CVE ID: CVE-2019-17224 State: PUBLISHED Published: 2019-10-28T14:31:30 Last Updated: 2024-08-05T01:33:17.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a /%2f/ path traversal attack, which can be exploited in order to test for the existence of a file pathname outside of the web root directory. If a file exists but is not part of the product, there is a 404 error. If a file does not exist, there is a 302 redirect to index.html. Additional Analyst Notes: - CVE Program Container: References: - https://www.search-lab.hu/media/Compal_CH7465LG_Evaluation_Report_1.1
lyst Notes: - CVE Program Container: References: - https://www.search-lab.hu/media/Compal_CH7465LG_Evaluation_Report_1.1.pdf - https://vulnerabilities.home.blog/2019/10/27/again-a-vunerability-in-cable-router-ch7465lg-cve-2019-17224/
CVE ID: CVE-2019-17225 State: PUBLISHED Published: 2019-10-06T16:46:48 Last Updated: 2024-08-05T01:33:17.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intelliants/subrion/issues/845 - http://packetstormsecurity.com/files/154746/Subrion-4.2.1-Cross-Site-Scripting.html
CVE ID: CVE-2019-17226 State: PUBLISHED Published: 2019-10-06T17:04:36 Last Updated: 2024-08-05T01:33:17.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12148
CVE ID: CVE-2019-17228 State: PUBLISHED Published: 2020-02-24T18:25:34 Last Updated: 2024-08-05T01:33:17.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9884 - https://wordpress.org/plugins/motors-car-dealership-classified-listings/#developers - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-motors-car-dealer-classified-ads-plugin/
CVE ID: CVE-2019-17229 State: PUBLISHED Published: 2020-02-24T18:25:37 Last Updated: 2024-08-05T01:33:17.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9884 - https://wordpress.org/plugins/motors-car-dealership-classified-listings/#developers - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-motors-car-dealer-classified-ads-plugin/
CVE ID: CVE-2019-17230 State: PUBLISHED Published: 2020-04-03T14:16:16 Last Updated: 2024-08-05T01:33:17.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched/
CVE ID: CVE-2019-17231 State: PUBLISHED Published: 2020-04-03T14:16:12 Last Updated: 2024-08-05T01:33:17.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched/
CVE ID: CVE-2019-17232 State: PUBLISHED Published: 2019-10-07T22:11:30 Last Updated: 2024-08-05T01:33:17.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ultimate-faqs/#developers - https://wpvulndb.com/vulnerabilities/9883 - https://blog.nintechnet.com/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin/
CVE ID: CVE-2019-17233 State: PUBLISHED Published: 2019-10-07T22:11:20 Last Updated: 2024-08-05T01:33:17.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ultimate-faqs/#developers - https://wpvulndb.com/vulnerabilities/9883 - https://blog.nintechnet.com/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin/
CVE ID: CVE-2019-17234 State: PUBLISHED Published: 2019-11-12T16:48:54 Last Updated: 2024-08-05T01:33:17.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/igniteup/#developers - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin/
CVE ID: CVE-2019-17235 State: PUBLISHED Published: 2019-11-12T16:50:29 Last Updated: 2024-08-05T01:33:17.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/igniteup/#developers - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin/
CVE ID: CVE-2019-17236 State: PUBLISHED Published: 2019-11-12T16:52:46 Last Updated: 2024-08-05T01:33:17.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/igniteup/#developers - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin/
CVE ID: CVE-2019-17237 State: PUBLISHED Published: 2019-11-12T16:53:32 Last Updated: 2024-08-05T01:33:17.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/igniteup/#developers - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin/
CVE ID: CVE-2019-17239 State: PUBLISHED Published: 2019-10-07T21:28:52 Last Updated: 2024-08-05T01:33:17.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9896 - https://wordpress.org/plugins/download-plugins-dashboard/#developers