Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5594 State: PUBLISHED Published: 2025-01-06T13:52:20.272Z Last Updated: 2025-11-03T20:48:53.705Z Vendors: OpenVPN Products: OpenVPN Problem Types: CWE-1287 Description: OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.openvpn.net/openvpn/wiki/CVE-2024-5594 - https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html
CVE ID: CVE-2024-5595 State: PUBLISHED Published: 2024-08-02T06:00:06.949Z Last Updated: 2024-08-02T16:12:09.234Z Vendors: Unknown Products: Essential Blocks Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f2b8f092-4fc0-4edc-ba0f-d4312c2e5dec/
CVE ID: CVE-2024-5596 State: PUBLISHED Published: 2024-06-22T05:47:55.999Z Last Updated: 2024-08-01T21:18:06.636Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: armember Products: ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly implemented nonce validation function on multiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta and plugin option
ultiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta and plugin options which can lead to limited privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e55591e-c1e9-4667-b04f-4956d2f37d51?source=cve - https://codecanyon.net/item/armember-complete-wordpress-membership-system/17785056
CVE ID: CVE-2024-5597 State: PUBLISHED Published: 2024-06-10T16:53:50.147Z Last Updated: 2024-08-01T21:18:06.595Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-843 Description: Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02
CVE ID: CVE-2024-5598 State: PUBLISHED Published: 2024-06-29T04:33:29.415Z Last Updated: 2024-08-01T21:18:06.571Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: modalweb Products: Advanced File Manager Problem Types: CWE-922 Insecure Storage of Sensitive Information Description: The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder. Additional Analyst
ng backups or other sensitive information if the files have been moved to the built-in Trash folder. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4ff5ed-8857-46b8-942b-ac0f47880a95?source=cve - https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/class_fma_connector.php#L13 - https://plugins.trac.wordpress.org/changeset/3107587/
CVE ID: CVE-2024-5599 State: PUBLISHED Published: 2024-06-07T12:33:43.953Z Last Updated: 2024-08-01T21:18:06.782Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: softaculous Products: FileOrganizer – Manage WordPress and Website Files Problem Types: CWE-922 Insecure Storage of Sensitive Information Description: The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files
le for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78e7b65d-91f8-477e-b992-3148c1b65d7b?source=cve - https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/main/ajax.php#L85 - https://plugins.trac.wordpress.org/changeset/3098763/
CVE ID: CVE-2024-5600 State: PUBLISHED Published: 2024-07-09T08:33:04.702Z Last Updated: 2024-08-01T21:18:06.423Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: happymonkeyagency Products: SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue Problem Types: CWE-862 Missing Authorization Description: The SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check and insufficient sanitization on the import_settings() function in all versions up to, and including, 1.3.10. This makes it possible for authenticated attackers, with Subscriber-level access
versions up to, and including, 1.3.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0ecffe-8543-4d82-a1cc-f2474499f373?source=cve - https://plugins.trac.wordpress.org/browser/happy-scss-compiler/trunk/admin/class-hm-wp-scss-admin.php#L384
CVE ID: CVE-2024-5601 State: PUBLISHED Published: 2024-06-27T07:44:27.083Z Last Updated: 2024-08-01T21:18:06.365Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mediavine Products: Create by Mediavine Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode in all versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access a
scaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d04d8c1-75c0-447c-a26a-c2724c0a6618?source=cve - https://plugins.trac.wordpress.org/browser/mediavine-create/trunk/class-plugin.php#L575 - https://wordpress.org/plugins/mediavine-create/#developers - https://plugins.trac.wordpress.org/changeset/3108144/#file794
CVE ID: CVE-2024-5602 State: PUBLISHED Published: 2024-07-23T13:15:50.508Z Last Updated: 2025-08-27T20:42:59.211Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: IO Trace Tool Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability due to a missing bounds check in the NI I/O Trace Tool may result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted nitrace file. The NI I/O Trace tool is installed as part of the NI System Configuration utilities included with many NI software products. Refer to the NI Security Advisory for identifying the version of NI IO Trace.
s included with many NI software products. Refer to the NI Security Advisory for identifying the version of NI IO Trace.exe installed. The NI I/O Trace tool was also previously released as NI Spy. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/stack-based-buffer-overflow-vulnerability-in-ni-io-trace-tool.html
CVE ID: CVE-2024-5604 State: PUBLISHED Published: 2024-07-19T06:00:05.940Z Last Updated: 2024-08-01T21:18:06.836Z Vendors: Unknown Products: Bug Library Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Bug Library WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/29985150-8d49-4a3f-8411-5d7263b424d8/
CVE ID: CVE-2024-5605 State: PUBLISHED Published: 2024-06-20T03:37:21.786Z Last Updated: 2024-08-01T21:18:06.562Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dglingren Products: Media Library Assistant Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo
g on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba8a9f5-0633-4cf0-af27-5466d93e9020?source=cve - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L2783 - https://wordpress.org/plugins/media-library-assistant/#devel
tant/trunk/includes/class-mla-shortcode-support.php#L2783 - https://wordpress.org/plugins/media-library-assistant/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3098232%40media-library-assistant&new=3098232%40media-library-assistant&sfp_email=&sfph_mail=
CVE ID: CVE-2024-5606 State: PUBLISHED Published: 2024-07-02T06:00:03.377Z Last Updated: 2024-08-01T21:18:06.591Z Vendors: Unknown Products: Quiz and Survey Master (QSM) Problem Types: CWE-89 SQL Injection Description: The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/e3eee6bc-1f69-4be1-b323-0c9b5fe7535e/
CVE ID: CVE-2024-5607 State: PUBLISHED Published: 2024-06-07T02:39:28.634Z Last Updated: 2024-08-01T21:18:07.015Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: ninjateam Products: GDPR CCPA Compliance & Cookie Consent Banner Problem Types: CWE-862 Missing Authorization Description: The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings() in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings, update p
possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings, update page content, send arbitrary emails and inject malicious web scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f870a6-26a5-4f98-9bd6-12736c561265?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3097680%40ninja-gdpr-compliance&new=3097680%40ninja-gdpr-compliance&sfp_email=&sfph_mail=
CVE ID: CVE-2024-5608 State: PUBLISHED Published: 2024-10-24T11:42:44.789Z Last Updated: 2024-10-24T13:55:28.297Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/cve-2024-5608.html
CVE ID: CVE-2024-5609 State: REJECTED Published: N/A Last Updated: 2024-06-06T18:35:27.654Z Description: No description available.
CVE ID: CVE-2024-5610 State: REJECTED Published: N/A Last Updated: 2025-01-08T22:14:49.858Z Description: No description available.
CVE ID: CVE-2024-5611 State: PUBLISHED Published: 2024-06-15T09:43:51.193Z Last Updated: 2024-08-01T21:18:06.315Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jetmonsters Products: Stratum – Elementor Widgets Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘label_years’ attribute within the Countdown widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev
ficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/840dd4a9-103a-4ff9-ba26-3bf5b6e831a1?source=cve - https://plugins.trac.wordpress.org/browser/stratum/tags/1.4.0/includes/templates/countdown.php#L66 - https://plugins.trac.wordpress.org/changeset/3102765#file1
CVE ID: CVE-2024-5612 State: PUBLISHED Published: 2024-06-07T04:33:24.031Z Last Updated: 2024-08-01T21:18:06.610Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Essential Addons Products: Essential Addons for Elementor Pro Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_lightbox_open_btn_icon’ parameter within the Lightbox & Modal widget in all versions up to, and including, 5.8.15 due to insufficient input sanitization and output escaping. This makes it possible for au
s up to, and including, 5.8.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8dbe4104-b7d1-484f-a843-a3d1fc02999d?source=cve - https://essential-addons.com/changelog/
CVE ID: CVE-2024-5613 State: PUBLISHED Published: 2024-06-08T05:44:30.245Z Last Updated: 2024-08-01T21:18:06.789Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: awordpresslife Products: Formula Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dismiss_action' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip
put sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf391432-d569-4458-947f-fe4a2ebcf8f1?source=cve - https://themes.trac.wordpress.org/browser/formula/0.5.1/inc/customizer/customizer-notice/formula-customizer-notify.php?rev=229770#L143 - https://themes.trac.wordpress.org/changeset/230569/
CVE ID: CVE-2024-5614 State: PUBLISHED Published: 2024-07-27T11:13:36.446Z Last Updated: 2024-08-01T21:18:06.494Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: piotnetdotcom Products: Piotnet Addons For Elementor Problem Types: CWE-200 Description: The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'pafe_posts_list' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and excerpts of future, draft, and pending blog posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refer
future, draft, and pending blog posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2880cde0-a278-4a41-97f7-c54c2b3aceb2?source=cve - https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/inc/ajax-posts-list.php#L4 - https://plugins.trac.wordpress.org/changeset/3125094/
CVE ID: CVE-2024-5615 State: PUBLISHED Published: 2024-06-06T03:32:56.493Z Last Updated: 2024-08-01T21:18:06.779Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: willnorris Products: Open Graph Problem Types: CWE-200 Information Exposure Description: The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'opengraph_default_description' function. This makes it possible for unauthenticated attackers to extract sensitive data including partial content of password-protected blog posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
-protected blog posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f57dc0fe-07f3-457e-8080-fe530f6a9f01?source=cve - https://plugins.trac.wordpress.org/browser/opengraph/trunk/opengraph.php#L369 - https://plugins.trac.wordpress.org/changeset/3097574/
CVE ID: CVE-2024-5616 State: PUBLISHED Published: 2024-07-06T08:38:02.339Z Last Updated: 2024-08-01T21:18:06.438Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: mudler Products: mudler/localai Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview', without the victim's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality. Add
's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/fd753fb6-ba04-4dd8-abef-918fb97120af - https://github.com/mudler/localai/commit/4e1463fec291612a59a16db60b3fd12d4c49d64b
CVE ID: CVE-2024-5618 State: PUBLISHED Published: 2024-07-18T16:28:44.661Z Last Updated: 2024-08-01T21:18:06.786Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: PruvaSoft Informatics Products: Apinizer Management Console Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in PruvaSoft Informatics Apinizer Management Console allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Apinizer Management Console: before 2024.05.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-1010
CVE ID: CVE-2024-5619 State: PUBLISHED Published: 2024-07-18T16:49:47.565Z Last Updated: 2024-08-01T21:18:06.354Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: PruvaSoft Informatics Products: Apinizer Management Console Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apinizer Management Console: before 2024.05.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-1010
CVE ID: CVE-2024-5620 State: PUBLISHED Published: 2024-07-18T17:00:20.458Z Last Updated: 2024-08-01T21:18:06.621Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: PruvaSoft Informatics Products: Apinizer Management Console Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in PruvaSoft Informatics Apinizer Management Console allows Authentication Bypass.This issue affects Apinizer Management Console: before 2024.05.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-1010
CVE ID: CVE-2024-5622 State: PUBLISHED Published: 2024-08-29T08:49:48.300Z Last Updated: 2024-08-29T13:29:24.311Z Vendors: B&R Industrial Automation Products: B&R APROL Problem Types: CWE-250, CWE-267 Description: An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P2014_Multiple_vulnerabilities_in_BR_APROL.pdf-367290ae.pdf
CVE ID: CVE-2024-5623 State: PUBLISHED Published: 2024-08-29T08:51:26.052Z Last Updated: 2024-08-29T13:46:16.304Z Vendors: B&R Industrial Automation Products: B&R APROL Problem Types: CWE-250, CWE-267 Description: An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P2014_Multiple_vulnerabilities_in_BR_APROL.pdf-367290ae.pdf