Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to the public and may be used. The identifier of this vulnerability is VDB-252472. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252472 - https://vuldb.com/?ctiid.252472 - https://note.zhaoj.in/share/9wv48TygKRxo
CVE ID: CVE-2024-1115 State: PUBLISHED Published: 2024-01-31T20:00:05.046Z Last Updated: 2025-05-29T15:03:25.099Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: openBI Problem Types: CWE-78 Description: A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252473 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP
identifier VDB-252473 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252473 - https://vuldb.com/?ctiid.252473 - https://note.zhaoj.in/share/81JmiyogcYL7
CVE ID: CVE-2024-1116 State: PUBLISHED Published: 2024-01-31T20:00:06.237Z Last Updated: 2024-08-23T19:23:35.469Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: openBI Problem Types: CWE-434 Description: A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application/plugins/controller/Upload.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-252474 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
ntifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252474 - https://vuldb.com/?ctiid.252474 - https://note.zhaoj.in/share/uCElTQRGWVyw
CVE ID: CVE-2024-1117 State: PUBLISHED Published: 2024-01-31T20:31:04.310Z Last Updated: 2025-05-29T15:03:18.752Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: openBI Problem Types: CWE-94 Description: A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /application/index/controller/Screen.php. The manipulation of the argument fileurl leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252475. Additional Analyst Notes: - CVE Program Container:
used. The associated identifier of this vulnerability is VDB-252475. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252475 - https://vuldb.com/?ctiid.252475 - https://note.zhaoj.in/share/Liu1nbjddxu4
CVE ID: CVE-2024-1118 State: PUBLISHED Published: 2024-02-07T11:02:39.957Z Last Updated: 2024-08-01T18:26:30.501Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: chemiker Products: Podlove Subscribe button Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it
ient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f234f05f-e377-4e89-81e1-f47ff44eebc5?source=cve - https://github.com/podlove/podlove-subscribe-button-wp-plugin/commit/b16b7a2e98db4c642ca671b0aede4dbfce4578b3 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sf
n-wp-plugin/commit/b16b7a2e98db4c642ca671b0aede4dbfce4578b3 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032152%40podlove-subscribe-button&new=3032152%40podlove-subscribe-button&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1119 State: PUBLISHED Published: 2024-03-20T06:48:26.874Z Last Updated: 2024-08-05T16:21:47.456Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: railmedia Products: Order Tip for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The Order Tip for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_tips_to_csv() function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to export the plugin's order fees. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ww
lugin's order fees. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f837d6b-d1fa-4019-892a-dca3c0f29ca7?source=cve - https://plugins.trac.wordpress.org/browser/order-tip-woo/trunk/admin/controllers/reports.class.php#L359 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3052259%40order-tip-woo&new=3052259%40order-tip-woo&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1120 State: PUBLISHED Published: 2024-03-01T09:31:40.619Z Last Updated: 2024-08-28T15:07:56.103Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xlplugins, djeet Products: NextMove Lite – Thank You Page for WooCommerce, Finale Lite – Sales Countdown Timer & Discount for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the download_tools_settings() function in all versions up to, and including, 2.17.0.
e to a missing capability check on the download_tools_settings() function in all versions up to, and including, 2.17.0. This makes it possible for unauthenticated attackers to export system information that can aid attackers in an attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d9332be-2cf0-46cd-81e4-6436aeec0f83?source=cve - https://plugins.trac.wordpress.org/browser/finale-woocommerce-sales-countdown-timer-discount/trunk/includes/wcct-xl-support.php#L710 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042127%40finale-woocommerce-sales-countdown-ti
plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042127%40finale-woocommerce-sales-countdown-timer-discount&new=3042127%40finale-woocommerce-sales-countdown-timer-discount&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1121 State: PUBLISHED Published: 2024-02-05T21:21:51.919Z Last Updated: 2024-08-01T18:26:30.685Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: philkurth Products: Advanced Forms for ACF Problem Types: CWE-862 Missing Authorization Description: The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_json_file() function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/
gs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7b33f2ee-3f20-4494-bdae-3f8cc3c6dc73?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3031007%40advanced-forms&new=3031007%40advanced-forms&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1122 State: PUBLISHED Published: 2024-02-09T04:31:53.959Z Last Updated: 2024-08-27T17:36:57.800Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: themewinter Products: Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin Problem Types: CWE-862 Missing Authorization Description: The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data. Additional Analyst Note
nd including, 3.3.50. This makes it possible for unauthenticated attackers to export event data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0cbdf679-1657-4249-a433-8fe0cddd94be?source=cve - https://plugins.trac.wordpress.org/changeset/3033231/wp-event-solution/tags/3.3.51/core/admin/hooks.php
CVE ID: CVE-2024-1123 State: PUBLISHED Published: 2024-03-09T07:01:09.193Z Last Updated: 2024-08-01T18:26:30.574Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: metagauss Products: EventPrime – Events Calendar, Bookings and Tickets Problem Types: CWE-862 Missing Authorization Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_frontend_event_submission() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and c
This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary posts. This can also be exploited by unauthenticated attackers when the allow_submission_by_anonymous_user setting is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/351926d4-a9be-4fbd-bdf2-8bbff41d97ef?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033882%40eventprime-event-calendar-management&new=3033882%40eventprime-event-calendar-management&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1124 State: PUBLISHED Published: 2024-03-09T07:01:04.693Z Last Updated: 2024-08-01T18:26:30.510Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: metagauss Products: EventPrime – Events Calendar, Bookings and Tickets Problem Types: CWE-862 Missing Authorization Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary co
possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/346049ca-1bc5-4e02-9f38-d1f64338709d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043888%40eventprime-event-calendar-management&new=3043888%40eventprime-event-calendar-management&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1125 State: PUBLISHED Published: 2024-03-09T07:01:10.355Z Last Updated: 2024-08-01T18:26:30.608Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: metagauss Products: EventPrime – Events Calendar, Bookings and Tickets Problem Types: CWE-862 Missing Authorization Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts. Additional Analys
ssible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5278afb-9db3-4b1d-bb2f-e6595f0ac6dc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043888%40eventprime-event-calendar-management&new=3043888%40eventprime-event-calendar-management&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1126 State: PUBLISHED Published: 2024-03-13T15:27:16.554Z Last Updated: 2024-08-08T17:48:25.094Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: metagauss Products: EventPrime – Events Calendar, Bookings and Tickets Problem Types: CWE-862 Missing Authorization Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_attendees_email_by_event_id() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to to retrieve the attendees list
makes it possible for authenticated attackers, with subscriber-level access and above, to to retrieve the attendees list for any event. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d266b6ee-24ec-4363-a986-5ccd4db5ae3c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033882%40eventprime-event-calendar-management&new=3033882%40eventprime-event-calendar-management&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1127 State: PUBLISHED Published: 2024-03-13T15:26:44.282Z Last Updated: 2024-08-01T18:26:30.555Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: metagauss Products: EventPrime – Events Calendar, Bookings and Tickets Problem Types: CWE-862 Missing Authorization Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the booking_export_all() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all event booking which can contai
ible for authenticated attackers, with subscriber-level access and above, to retrieve all event booking which can contain PII. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39da62be-e630-48cd-b732-80ed3d337638?source=cve - https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk//includes/service/class-ep-ajax.php#L1994 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033882%40eventprime-event-calendar-management&new=3033882%40eventprime-event-calendar-management&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1128 State: PUBLISHED Published: 2024-02-20T18:56:22.265Z Last Updated: 2024-08-01T18:26:30.434Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access
tization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22420c2d-788c-4577-ae54-7b48f6063f5d?source=cve - https://plugins.trac.wordpress.org/changeset/3037911/tutor/tags/2.6.1/classes/Q_and_A.php?old=2827221&old_path=tutor/trunk/classes/Q_and_A.php
CVE ID: CVE-2024-1129 State: PUBLISHED Published: 2024-02-01T04:31:54.943Z Last Updated: 2024-08-07T17:52:57.259Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: webaways Products: NEX-Forms – Ultimate Form Builder – Contact forms and much more Problem Types: CWE-862 Missing Authorization Description: The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_starred() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as starred. Addition
es it possible for authenticated attackers, with subscriber-level access and above, to mark records as starred. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/53db0f72-3353-42bb-ad75-4c5aa32d7939?source=cve - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1490 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1502 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1524 - https:
s.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1524 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1512 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1493 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1539
CVE ID: CVE-2024-1130 State: PUBLISHED Published: 2024-02-01T04:31:55.418Z Last Updated: 2024-08-01T18:26:30.583Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: webaways Products: NEX-Forms – Ultimate Form Builder – Contact forms and much more Problem Types: CWE-862 Missing Authorization Description: The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_read() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as read. Additional Ana
it possible for authenticated attackers, with subscriber-level access and above, to mark records as read. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c3b646-d865-4425-bc8f-00b3555a3d74?source=cve - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1490 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1502 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1524 - https://plug
.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L1524 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1512 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1493 - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/8.5.7/includes/classes/class.dashboard.php#L1539
CVE ID: CVE-2024-1132 State: PUBLISHED Published: 2024-04-17T13:21:19.130Z Last Updated: 2025-11-07T20:40:21.522Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Migration Toolkit for Runtimes 1 on RHEL 8, MTA-6.2-RHEL-9, Red Hat AMQ Broker 7, Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.10, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, RHSSO 7.6.8, Red Hat build of Apicurio Registry 2, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enter
Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat Process Automation 7 Problem Types: CWE-22 Description: A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL. Additional Anal
zes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1860 - https://access.redhat.com/errata/RHSA-2024:1861 - https://access.redhat.com/errata/RHSA-2024:1862 - https://access.redhat.com/errata/RHSA-2024:1864 - https://access.redhat.com/errata/RHSA-2024:1866 - https://access.redhat.com/errata/RHSA-2024:1867 - https://access.redhat.com/errata/RHSA-2024:1868 - https://access.redhat.com/errata/RHSA-2024:2945 - https://access.redhat.com/errata/RHSA-2024:3752 - https://access.redhat.com/errata/RHSA-2024:3762 - https
SA-2024:2945 - https://access.redhat.com/errata/RHSA-2024:3752 - https://access.redhat.com/errata/RHSA-2024:3762 - https://access.redhat.com/errata/RHSA-2024:3919 - https://access.redhat.com/errata/RHSA-2024:3989 - https://access.redhat.com/security/cve/CVE-2024-1132 - https://bugzilla.redhat.com/show_bug.cgi?id=2262117
CVE ID: CVE-2024-1133 State: PUBLISHED Published: 2024-02-20T18:56:49.287Z Last Updated: 2024-08-01T18:26:30.481Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-862 Missing Authorization Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with subscriber access or higher, to interact with questions in courses in whic