Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23503 State: PUBLISHED Published: 2024-06-11T16:09:18.164Z Last Updated: 2024-08-01T23:06:24.690Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: WPManageNinja LLC Products: Ninja Tables Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ninja-tables/wordpress-ninja-tables-plugin-5-0-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-23504 State: PUBLISHED Published: 2024-06-14T05:37:31.035Z Last Updated: 2024-08-01T23:06:24.997Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WPManageNinja LLC Products: Ninja Tables Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ninja-tables/wordpress-ninja-tables-plugin-5-0-5-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2024-23505 State: PUBLISHED Published: 2024-01-31T15:23:42.308Z Last Updated: 2025-05-23T16:00:28.399Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: DearHive Products: PDF Viewer & 3D PDF Flipbook – DearPDF Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive PDF Viewer & 3D PDF Flipbook – DearPDF allows Stored XSS.This issue affects PDF Viewer & 3D PDF Flipbook – DearPDF: from n/a through 2.0.38. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dearpdf-lite/wordpress
m Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dearpdf-lite/wordpress-pdf-viewer-3d-pdf-flipbook-dearpdf-plugin-2-0-38-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-23506 State: PUBLISHED Published: 2024-01-26T23:19:52.248Z Last Updated: 2024-08-23T19:47:23.508Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: InstaWP Team Products: InstaWP Connect – 1-click WP Staging & Migration Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in InstaWP Team InstaWP Connect – 1-click WP Staging & Migration.This issue affects InstaWP Connect – 1-click WP Staging & Migration: from n/a through 0.1.0.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/instawp-connect/wordpress-in
ainer: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/instawp-connect/wordpress-instawp-connect-plugin-0-1-0-9-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-23507 State: PUBLISHED Published: 2024-01-31T11:52:25.115Z Last Updated: 2025-05-30T18:31:32.145Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: InstaWP Team Products: InstaWP Connect – 1-click WP Staging & Migration Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP Team InstaWP Connect – 1-click WP Staging & Migration.This issue affects InstaWP Connect – 1-click WP Staging & Migration: from n/a through 0.1.0.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ins
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/instawp-connect/wordpress-instawp-connect-plugin-0-1-0-9-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-23508 State: PUBLISHED Published: 2024-01-31T15:21:17.373Z Last Updated: 2025-05-30T18:23:41.621Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: PDF Poster – PDF Embedder Plugin for WordPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerabili
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pdf-poster/wordpress-pdf-poster-plugin-2-1-17-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-23510 State: PUBLISHED Published: 2024-03-27T13:42:25.941Z Last Updated: 2024-08-01T23:06:25.181Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Martyn Chamberlin Products: Don't Muck My Markup Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Martyn Chamberlin Don't Muck My Markup.This issue affects Don't Muck My Markup: from n/a through 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/dont-muck-my-markup/wordpress-don-t-muck-my-markup-plugin-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-23512 State: PUBLISHED Published: 2024-02-12T08:22:30.384Z Last Updated: 2025-05-07T20:57:39.536Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: wpxpo Products: ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks.This issue affects ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks: from n/a through 3.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/product-blocks/wordpress-produ
ner: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/product-blocks/wordpress-productx-plugin-3-1-4-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-23513 State: PUBLISHED Published: 2024-02-12T07:53:55.787Z Last Updated: 2025-05-07T20:57:58.576Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: PropertyHive Products: PropertyHive Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-2-0-5-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-23514 State: PUBLISHED Published: 2024-02-10T08:16:22.534Z Last Updated: 2024-08-01T23:06:25.242Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ClickToTweet.com Products: Click To Tweet Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ClickToTweet.Com Click To Tweet allows Stored XSS.This issue affects Click To Tweet: from n/a through 2.0.14. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/click-to-tweet/wordpress-click-to-tweet-plugin-2-0-14-cross-site-scripting-xss
s://patchstack.com/database/vulnerability/click-to-tweet/wordpress-click-to-tweet-plugin-2-0-14-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2024-23515 State: PUBLISHED Published: 2024-03-27T13:41:15.094Z Last Updated: 2024-08-01T23:06:24.728Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Cincopa Products: Post Video Players Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Cincopa Post Video Players.This issue affects Post Video Players: from n/a through 1.159. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/video-playlist-and-gallery-plugin/wordpress-cincopa-video-and-media-plugin-1-158-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-23516 State: PUBLISHED Published: 2024-02-10T08:11:58.971Z Last Updated: 2024-08-01T23:06:24.845Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Calculators World Products: CC BMI Calculator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calculators World CC BMI Calculator allows Stored XSS.This issue affects CC BMI Calculator: from n/a through 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cc-bmi-calculator/wordpress-cc-bmi-calculator-plugin-2-0-1-cross-sit
es: - https://patchstack.com/database/vulnerability/cc-bmi-calculator/wordpress-cc-bmi-calculator-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-23517 State: PUBLISHED Published: 2024-02-10T08:08:49.348Z Last Updated: 2024-08-01T23:06:25.100Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Start Booking Products: Scheduling Plugin – Online Booking for WordPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Start Booking Scheduling Plugin – Online Booking for WordPress allows Stored XSS.This issue affects Scheduling Plugin – Online Booking for WordPress: from n/a through 3.5.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/datab
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/calendar-booking/wordpress-scheduling-plugin-online-booking-for-wordpress-plugin-3-5-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-23518 State: PUBLISHED Published: 2024-06-11T17:05:02.474Z Last Updated: 2024-08-01T23:06:25.167Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Navneil Naicker Products: ACF Photo Gallery Field Problem Types: CWE-862 Description: Missing Authorization vulnerability in Navneil Naicker ACF Photo Gallery Field.This issue affects ACF Photo Gallery Field: from n/a through 2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/navz-photo-gallery/wordpress-acf-photo-gallery-field-plugin-2-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-23519 State: PUBLISHED Published: 2024-02-28T16:27:34.627Z Last Updated: 2024-08-01T23:06:25.235Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: M&S Consulting Products: Email Before Download Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in M&S Consulting Email Before Download.This issue affects Email Before Download: from n/a through 6.9.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/email-before-download/wordpress-email-before-download-plugin-6-9-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-23520 State: PUBLISHED Published: 2024-03-26T11:47:10.447Z Last Updated: 2024-08-02T16:04:15.883Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: AccessAlly Products: PopupAlly Problem Types: CWE-862 Description: Missing Authorization vulnerability in AccessAlly PopupAlly.This issue affects PopupAlly: from n/a through 2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/popupally/wordpress-popupally-plugin-2-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-23521 State: PUBLISHED Published: 2024-06-11T15:34:46.214Z Last Updated: 2024-08-01T23:06:25.243Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Happyforms Products: Happyforms Problem Types: CWE-862 Description: Missing Authorization vulnerability in Happyforms.This issue affects Happyforms: from n/a through 1.25.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/happyforms/wordpress-happyforms-plugin-1-25-10-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-23522 State: PUBLISHED Published: 2024-05-17T08:47:39.531Z Last Updated: 2024-08-01T23:06:25.211Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Strategy11 Form Builder Team Products: Formidable Forms Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Injection.This issue affects Formidable Forms: from n/a through 6.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/formidable/wordpress-formidable-forms-plugin-6-7-conte
iner: References: - https://patchstack.com/database/vulnerability/formidable/wordpress-formidable-forms-plugin-6-7-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-23523 State: PUBLISHED Published: 2024-03-16T04:26:07.549Z Last Updated: 2024-08-01T23:06:25.278Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Elementor Products: Elementor Pro Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Elementor Pro.This issue affects Elementor Pro: from n/a through 3.19.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/elementor-pro/wordpress-elementor-pro-plugin-3-19-2-contributor-arbitrary-user-meta-data-retrieval-vulnerability?_s_id=cve
CVE ID: CVE-2024-23524 State: PUBLISHED Published: 2024-06-10T08:03:47.823Z Last Updated: 2024-08-01T23:06:25.168Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ONTRAPORT Inc. Products: PilotPress Problem Types: CWE-862 Description: Missing Authorization vulnerability in ONTRAPORT Inc. PilotPress.This issue affects PilotPress: from n/a through 2.0.30. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/pilotpress/wordpress-pilotpress-plugin-2-0-29-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-23525 State: PUBLISHED Published: 2024-01-17T00:00:00.000Z Last Updated: 2025-06-02T15:06:35.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://metacpan.org/release/NUDDLEGG/Spreadsheet-ParseXLSX-0.30/changes - https://gist.github.com/phvietan/d1c95a88ab6e17047b0248d6bf9eac4a - https://github.com/MichaelDaum/spreadsheet-parsexlsx/issues/10 - http://www.openwall.com/lists/oss-security/2024/01/18/4 - https://lists.debian.org/debian-lts-
eet-parsexlsx/issues/10 - http://www.openwall.com/lists/oss-security/2024/01/18/4 - https://lists.debian.org/debian-lts-announce/2024/01/msg00018.html - https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html
CVE ID: CVE-2024-23526 State: PUBLISHED Published: 2024-04-19T01:10:31.066Z Last Updated: 2024-08-01T23:06:25.188Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Ivanti Products: Avalanche Description: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-23527 State: PUBLISHED Published: 2024-04-24T23:12:51.975Z Last Updated: 2025-03-24T19:55:29.993Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Ivanti Products: Avalanche Description: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ivanti.com/blog/security-update-for-ivanti-avalanche
CVE ID: CVE-2024-23528 State: PUBLISHED Published: 2024-04-19T01:10:13.138Z Last Updated: 2024-08-01T23:06:25.298Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Ivanti Products: Avalanche Description: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-23529 State: PUBLISHED Published: 2024-04-19T01:10:13.141Z Last Updated: 2024-08-01T23:06:24.967Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Ivanti Products: Avalanche Description: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-23530 State: PUBLISHED Published: 2024-04-19T01:10:11.824Z Last Updated: 2024-08-01T23:06:24.718Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Ivanti Products: Avalanche Description: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-23531 State: PUBLISHED Published: 2024-04-19T01:10:11.825Z Last Updated: 2024-08-01T23:06:25.127Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Avalanche Description: An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial of service attacks. In certain rare conditions this could also lead to reading content from memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-23532 State: PUBLISHED Published: 2024-04-19T01:10:11.922Z Last Updated: 2024-08-01T23:06:25.255Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service attacks. In certain conditions this could also lead to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-23533 State: PUBLISHED Published: 2024-04-19T01:10:11.827Z Last Updated: 2024-08-01T23:06:25.130Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Ivanti Products: Avalanche Description: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an authenticated remote attacker to read sensitive information in memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-23534 State: PUBLISHED Published: 2024-04-19T01:10:11.834Z Last Updated: 2024-08-01T23:06:25.145Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-23535 State: PUBLISHED Published: 2024-04-19T01:10:11.917Z Last Updated: 2024-08-01T23:06:25.271Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-23537 State: PUBLISHED Published: 2024-03-29T14:38:05.738Z Last Updated: 2025-02-13T17:39:45.238Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Apache Software Foundation Products: Apache Fineract Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.9.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Report - https://lists.apache.org/thread/fq1ns4nprw2vqpkwwj9sw45jkw
confluence/display/FINERACT/Apache+Fineract+Security+Report - https://lists.apache.org/thread/fq1ns4nprw2vqpkwwj9sw45jkwxmt9f1 - http://www.openwall.com/lists/oss-security/2024/03/29/1
CVE ID: CVE-2024-23538 State: PUBLISHED Published: 2024-03-29T14:37:40.374Z Last Updated: 2025-02-13T17:39:45.863Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Apache Software Foundation Products: Apache Fineract Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Re
- CISA ADP Vulnrichment: References: - https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Report - https://lists.apache.org/thread/by32w2dylzgbqm5940x3wj7519wolqxs - http://www.openwall.com/lists/oss-security/2024/03/29/2