Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
may be used. The identifier VDB-257281 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257281 - https://vuldb.com/?ctiid.257281 - https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20RG-NBS2009G-P%20switch%20has%20a%20foreground%20CLI%20command%20injection%20vulnerability.pdf
CVE ID: CVE-2024-2643 State: PUBLISHED Published: 2025-05-15T20:09:44.129Z Last Updated: 2025-05-20T14:22:29.007Z Vendors: Unknown Products: Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes
attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/194ebf81-8fe4-4c74-8174-35d0ac00ac93/
CVE ID: CVE-2024-2644 State: PUBLISHED Published: 2024-03-19T22:00:06.233Z Last Updated: 2024-08-01T19:18:47.976Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /protocol/firewall/addfirewall.php. The manipulation of the argument FireWallTableArray leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257282 is the identifier assigned to this v
remotely. The exploit has been disclosed to the public and may be used. VDB-257282 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257282 - https://vuldb.com/?ctiid.257282 - https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-laddfirewall.md
CVE ID: CVE-2024-2645 State: PUBLISHED Published: 2024-03-19T22:31:04.320Z Last Updated: 2024-08-01T19:18:47.917Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-643 Description: A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb/resetpwd/resetpwd.php. The manipulation of the argument UserId leads to improper neutralization of data within xpath expressions. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associat
is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257283. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257283 - https://vuldb.com/?ctiid.257283 - https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-laddfirewall.md
CVE ID: CVE-2024-2646 State: PUBLISHED Published: 2024-03-19T22:31:05.692Z Last Updated: 2024-08-12T14:59:53.941Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /vpnweb/index.php?para=index. The manipulation of the argument check_VirtualSiteId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257284. NOTE: The vendor was
s been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257284. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257284 - https://vuldb.com/?ctiid.257284 - https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-index.md
CVE ID: CVE-2024-2647 State: PUBLISHED Published: 2024-03-19T23:00:06.786Z Last Updated: 2024-08-01T19:18:48.108Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /admin/singlelogin.php. The manipulation of the argument loginId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257285 was assigned to this vulnerability. NOTE: Th
has been disclosed to the public and may be used. The identifier VDB-257285 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257285 - https://vuldb.com/?ctiid.257285 - https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-singlelogin.md
CVE ID: CVE-2024-2648 State: PUBLISHED Published: 2024-03-19T23:00:08.417Z Last Updated: 2024-08-01T19:18:48.179Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-643 Description: A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of data within xpath expressions. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257286 is
is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257286 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257286 - https://vuldb.com/?ctiid.257286 - https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-naccheck.md
CVE ID: CVE-2024-2649 State: PUBLISHED Published: 2024-03-19T23:31:04.748Z Last Updated: 2025-04-10T20:18:41.638Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /protocol/iscdevicestatus/deleteonlineuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of thi
can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257287. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257287 - https://vuldb.com/?ctiid.257287 - https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-deleteonlineuser.md
CVE ID: CVE-2024-2650 State: PUBLISHED Published: 2024-04-09T18:58:56.390Z Last Updated: 2024-08-01T19:18:48.063Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-20 Improper Input Validation Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the alignment parameter in the Woo Product Carousel widget in all versions up to, and including, 5.9.10 due to insufficient input sanitization and output esc
oduct Carousel widget in all versions up to, and including, 5.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7242d808-9c33-4b3f-bda6-b4b72ca37de9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3058018%40essential-addons-for-elementor-lite%2Ftrunk&old=3050196%40essential-addons-for-elementor-lite%2
&reponame=&new=3058018%40essential-addons-for-elementor-lite%2Ftrunk&old=3050196%40essential-addons-for-elementor-lite%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2651 State: PUBLISHED Published: 2024-05-09T01:38:31.730Z Last Updated: 2024-10-03T06:23:18.818Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/450830 - https://hack
Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/450830 - https://hackerone.com/reports/2408619
CVE ID: CVE-2024-2652 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:54.772Z Description: No description available.
CVE ID: CVE-2024-2653 State: PUBLISHED Published: 2024-04-03T17:18:29.944Z Last Updated: 2025-11-04T18:29:43.933Z Vendors: AMPHP Products: amphp/http-client, amphp/http Problem Types: CWE-789: Memory Allocation with Excessive Size Value Description: amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/amphp/http/security/advisories/GHSA-qjfw-cvjf-f4fm - https://github.com/amphp/http-client/security/advisories/GHSA-w8gf-g2vq-j2f4 - http://www.openwall.com/lists/oss-securi
https://github.com/amphp/http-client/security/advisories/GHSA-w8gf-g2vq-j2f4 - http://www.openwall.com/lists/oss-security/2024/04/03/16
CVE ID: CVE-2024-2654 State: PUBLISHED Published: 2024-04-09T18:59:21.868Z Last Updated: 2025-08-27T21:02:57.367Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: mndpsingh287 Products: File Manager Problem Types: CWE-35 Path Traversal: '.../...//' Description: The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. This makes it possible for authenticated attackers, with administrator access and above, to read the contents of arbitrary zip files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
les on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca98fbc6-8cfa-4997-8a46-344afb75a97e?source=cve - https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/file_folder_manager.php#L1353 - https://plugins.trac.wordpress.org/changeset/3062387/wp-file-manager/trunk?contextall=1&old=3051451&old_path=%2Fwp-file-manager%2Ftrunk
CVE ID: CVE-2024-2655 State: PUBLISHED Published: 2024-04-10T05:32:22.955Z Last Updated: 2024-08-13T14:01:12.963Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: livemesh Products: Elementor Addons by Livemesh Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post widgets in all versions up to, and including, 8.3.5 due to insufficient input sanitization and output escaping on author display names. This makes it possible for authenticated attackers, with contributor-level acce
output escaping on author display names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69f2fc37-4c02-48da-b1e8-350ecc8ba086?source=cve - https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/templates/post-meta/author.php#L8
CVE ID: CVE-2024-2656 State: PUBLISHED Published: 2024-04-06T03:24:43.105Z Last Updated: 2024-08-01T19:18:48.293Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: icegram Products: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a CSV import in all versions up to, and including, 5.7.14 due to insufficien
lnerable to Stored Cross-Site Scripting via a CSV import in all versions up to, and including, 5.7.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/159ddb06-e7c4-4279-a8a1-c78a02e15891?source=cve - https://plugins.trac.wordpress.org/c
m/threat-intel/vulnerabilities/id/159ddb06-e7c4-4279-a8a1-c78a02e15891?source=cve - https://plugins.trac.wordpress.org/changeset/3063438/email-subscribers/trunk/lite/includes/classes/class-es-import-subscribers.php
CVE ID: CVE-2024-2657 State: PUBLISHED Published: 2024-05-30T08:30:12.030Z Last Updated: 2024-08-01T19:18:48.261Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: khl32 Products: Font Farsi Problem Types: CWE-87 Improper Neutralization of Alternate XSS Syntax Description: The Font Farsi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj
-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec6faa4-d8d3-4c5e-91b2-142164d3b481?source=cve - https://wordpress.org/plugins/font-farsi/
CVE ID: CVE-2024-2658 State: PUBLISHED Published: 2025-01-30T17:11:22.139Z Last Updated: 2025-01-30T19:22:27.067Z Vendors: Flexera Products: FlexNet Publisher Problem Types: CWE-427 Description: A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.flexera.com
with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.flexera.com/s/article/cve-2024-2658-flexnet-publisher-potential-local-privilege-escalation-issue - https://www.zerodayinitiative.com/advisories/ZDI-24-359/
CVE ID: CVE-2024-2659 State: PUBLISHED Published: 2024-04-15T18:00:12.275Z Last Updated: 2025-08-27T20:56:47.966Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: SMM, SMM2, FPC Problem Types: CWE-78 Description: A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system commands when performing a specific administrative function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-140420
CVE ID: CVE-2024-2660 State: PUBLISHED Published: 2024-04-04T17:55:20.192Z Last Updated: 2024-09-26T00:13:17.242Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-636 Description: Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.hashic
.14.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573
CVE ID: CVE-2024-2661 State: PUBLISHED Published: 2024-05-02T16:52:00.115Z Last Updated: 2024-08-01T19:18:48.323Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ukrsolution Products: Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. plugin for WordPress is vulnerable to blind SQL Injection via the ‘currentIds’ parameter in all versions up to, and including, 1.5.4 due
ress is vulnerable to blind SQL Injection via the ‘currentIds’ parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c8ba503-db7e-4ac1-898f-a301854db60f?source=cve - https://plugins.trac.wordpress.org/browser/ba
intel/vulnerabilities/id/3c8ba503-db7e-4ac1-898f-a301854db60f?source=cve - https://plugins.trac.wordpress.org/browser/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/trunk/src/Core.php#L621 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3074826%40barcode-scanner-lite-pos-to-manage-products-inventory-and-orders%2Ftrunk&old=3048878%40barcode-scanner-lite-pos-to-manage-products-inventory-and-orders%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2662 State: PUBLISHED Published: 2024-05-10T07:33:38.367Z Last Updated: 2024-08-01T19:18:48.399Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: unitecms Products: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Problem Types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes i
This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/58492dbb-b9e0-4477-b85d-ace06dba954c?source=cve - https://plugins.trac.wordpress.org/changeset/3071404/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_template_engine.class.php
CVE ID: CVE-2024-2663 State: PUBLISHED Published: 2024-04-30T08:32:23.952Z Last Updated: 2024-08-01T19:18:48.215Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: websmokers Products: ZD YouTube FLV Player Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $_GET['image'] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analy
nating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f26854-7e25-4e64-9f03-916ece6fde03?source=cve - https://wordpress.org/plugins/zd-youtube-flv-player/
CVE ID: CVE-2024-2664 State: PUBLISHED Published: 2024-04-10T03:09:46.177Z Last Updated: 2024-08-01T19:18:48.244Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Widget in all versions up to, and including, 4.10.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-le