Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2432 State: PUBLISHED Published: 2024-03-13T17:51:33.908Z Last Updated: 2024-08-28T15:14:21.571Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Palo Alto Networks Products: GlobalProtect App Problem Types: CWE-269 Description: A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-2432
CVE ID: CVE-2024-2433 State: PUBLISHED Published: 2024-03-13T17:51:45.578Z Last Updated: 2024-08-12T18:54:08.465Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-269 Description: An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of the man
web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of the management plane; the dataplane is unaffected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-2433
CVE ID: CVE-2024-2434 State: PUBLISHED Published: 2024-04-25T11:02:15.928Z Last Updated: 2025-11-20T04:12:14.487Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-22 Description: An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/450303 - https://hackerone.com/reports/2401952
CVE ID: CVE-2024-2435 State: PUBLISHED Published: 2024-04-02T16:40:24.552Z Last Updated: 2024-08-01T19:11:53.568Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Temporal OSS Products: ui-server Problem Types: CWE-79 Description: For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that signal. The XSS is in the timeline page displaying the workflow execution details of the workflow that was sent the crafted signal. Access to send a signal to a workflow is determined by how you configured the authorizer on your server. This includes any entity with permission
o a workflow is determined by how you configured the authorizer on your server. This includes any entity with permission to directly call SignalWorkflowExecution or SignalWithStartWorkflowExecution, or any entity can deploy a worker that has access to call workflow progress APIs (specifically RespondWorkflowTaskCompleted). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/temporalio/ui-server/releases/tag/v2.25.0
CVE ID: CVE-2024-2436 State: PUBLISHED Published: 2024-04-09T18:58:48.811Z Last Updated: 2024-08-01T19:11:53.527Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: someguy9 Products: Lightweight Accordion Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions
ser supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/545dae6b-7983-4f02-a9a0-0be8cf935a78?source=cve - https://plugins.trac.wordpress.org/browser/lightweight-accordion/trunk/lightweight-accordion.php#L39 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3056945@lightweight-accordion/trunk&old=2889281@lightweight-accordion/trunk&sfp_email=&sfph_mai
sfph_mail=&reponame=&new=3056945@lightweight-accordion/trunk&old=2889281@lightweight-accordion/trunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2437 State: REJECTED Published: N/A Last Updated: 2024-03-14T08:55:39.474Z Description: No description available.
CVE ID: CVE-2024-2438 State: REJECTED Published: N/A Last Updated: 2024-03-14T08:56:25.730Z Description: No description available.
CVE ID: CVE-2024-2439 State: PUBLISHED Published: 2024-04-26T05:00:03.082Z Last Updated: 2025-03-28T23:18:24.442Z Vendors: Unknown Products: Salon booking system Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/7a375077-fc70-4389-b109-28fce3db2aef/
CVE ID: CVE-2024-2440 State: PUBLISHED Published: 2024-04-19T17:02:29.144Z Last Updated: 2024-08-01T19:11:53.576Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-367 Description: A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.9.13, 3.10.10, 3.11.8 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program. Additi
n versions 3.9.13, 3.10.10, 3.11.8 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2
CVE ID: CVE-2024-2441 State: PUBLISHED Published: 2024-05-10T06:00:02.156Z Last Updated: 2025-03-14T00:35:04.454Z Vendors: Unknown Products: VikBooking Hotel Booking Engine & PMS Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulne
d to. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79/
CVE ID: CVE-2024-2442 State: PUBLISHED Published: 2024-03-19T16:28:24.518Z Last Updated: 2024-08-28T14:43:58.384Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Franklin Fueling System Products: EVO 550, EVO 5000 Problem Types: CWE-25 Description: Franklin Fueling System EVO 550 and EVO 5000 are vulnerable to a Path Traversal vulnerability that could allow an attacker to access sensitive files on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-079-01
CVE ID: CVE-2024-2443 State: PUBLISHED Published: 2024-03-20T23:04:23.899Z Last Updated: 2024-08-27T19:36:36.453Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-20 Description: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHu
er instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.17 - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.12 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.9 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.7 - https
r@3.10/admin/release-notes#3.10.9 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.7 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.1
CVE ID: CVE-2024-2444 State: PUBLISHED Published: 2024-04-06T05:00:02.855Z Last Updated: 2024-08-08T20:44:29.314Z Vendors: Unknown Products: Inline Related Posts Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/214e5fd7-8684-418a-b67d-60b1dcf11a48/
CVE ID: CVE-2024-2445 State: PUBLISHED Published: 2024-03-15T09:19:50.127Z Last Updated: 2024-08-01T19:11:53.602Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-74 Description: Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://matt
attermost server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-2446 State: PUBLISHED Published: 2024-03-15T09:11:21.446Z Last Updated: 2024-08-01T19:11:53.477Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-2447 State: PUBLISHED Published: 2024-04-05T08:52:59.664Z Last Updated: 2024-08-01T19:11:53.562Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-2448 State: PUBLISHED Published: 2024-03-22T13:32:43.657Z Last Updated: 2024-11-15T20:05:31.723Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Software Products: LoadMaster Problem Types: CWE-78 Description: An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://progress.com/loadmaster - https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-Loa
eferences: - https://progress.com/loadmaster - https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449
CVE ID: CVE-2024-2449 State: PUBLISHED Published: 2024-03-22T13:35:39.103Z Last Updated: 2024-08-12T19:23:36.632Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: LoadMaster Problem Types: CWE-352 Description: A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator. Additional Analyst Notes: -
he malicious site would execute HTTP transactions on behalf of the LoadMaster administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://progress.com/loadmaster - https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449
CVE ID: CVE-2024-2450 State: PUBLISHED Published: 2024-03-15T09:12:28.880Z Last Updated: 2024-08-02T20:35:32.666Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-287 Description: Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to SAML authentication, allowing an authenticated attacker to take over other user accounts via a crafted switch request under specific conditions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/secu
s. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-2451 State: PUBLISHED Published: 2024-05-28T14:27:25.918Z Last Updated: 2024-08-01T19:11:53.533Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: TeamViewer Products: Remote (Full Client), Remote (Host) Problem Types: CWE-347 Description: Improper fingerprint validation in the TeamViewer Client (Full & Host) prior Version 15.54 for Windows and macOS allows an attacker with administrative user rights to further elevate privileges via executable sideloading. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1004/
CVE ID: CVE-2024-2452 State: PUBLISHED Published: 2024-03-26T15:43:36.233Z Last Updated: 2025-02-13T17:40:10.101Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: Eclipse Foundation Products: ThreadX Problem Types: CWE-120, CWE-190 Description: In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could cause an integer wrap-around and an allocation smaller than expected. This could cause subsequent heap buffer overflows. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-h963-7vhw-8rpx - http://seclist
ainer: References: - https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-h963-7vhw-8rpx - http://seclists.org/fulldisclosure/2024/May/35 - http://www.openwall.com/lists/oss-security/2024/05/28/1
CVE ID: CVE-2024-2453 State: PUBLISHED Published: 2024-03-21T22:39:15.488Z Last Updated: 2024-08-01T19:11:53.526Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Advantech Products: WebAccess/SCADA Problem Types: CWE-89 Description: There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01
CVE ID: CVE-2024-2454 State: PUBLISHED Published: 2024-05-09T01:38:36.737Z Last Updated: 2024-10-03T06:23:18.723Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/450405 - https://hackerone.com/reports/2408226
CVE ID: CVE-2024-2455 State: PUBLISHED Published: 2024-08-01T12:43:26.820Z Last Updated: 2024-08-01T13:13:12.615Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: BDThemes Products: Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin Problem Types: CWE-79 Description: The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget wrapper link URL in all versions up to, and including, 7.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and abov
escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1903527e-d7d9-48a0-b59d-65ec5e14def2?source=cve - https://feedback.elementpack.pro/announcements#:~:text=Version%207.9.1%20Released - https://feedback.elementpack.pro/announcements
CVE ID: CVE-2024-2456 State: PUBLISHED Published: 2024-04-09T18:59:28.137Z Last Updated: 2024-08-01T19:11:53.537Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ecwid Products: Ecwid Ecommerce Shopping Cart Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 6.12.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and abo
escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e10127aa-a5a5-4394-8b54-b57ba1369d77?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3055878%40ecwid-shopping-cart&new=3055878%40ecwid-shopping-cart&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2457 State: PUBLISHED Published: 2024-04-09T18:58:57.293Z Last Updated: 2024-08-01T19:11:53.578Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpcalc Products: Modal Window – create popup modal window Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 5.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with cont
nitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/745709f4-bb9c-41c4-ab60-d9fc18e406a8?source=cve - https://plugins.trac.wordpress.org/changeset/3054106/modal-window/tags/5.3.9/public/shortcode_icon.php?old=2988336&old_path=modal-window/tags/5.3.8/public/shortcode_icon.php
CVE ID: CVE-2024-2458 State: PUBLISHED Published: 2024-04-06T07:34:56.725Z Last Updated: 2024-08-01T19:11:53.613Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codesupplyco Products: Powerkit – Supercharge your WordPress Site Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated atta
icient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efb816e4-c07f-4e72-bfd3-06d83ed4d642?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3057392%40powerkit&new=3057392%40powerkit&sfp_email=&sfph_mail=