Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8449 State: PUBLISHED Published: 2024-09-30T06:45:27.302Z Last Updated: 2024-09-30T17:05:21.197Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-798 Description: Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8047-adf79-1.html - https://
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8047-adf79-1.html - https://www.twcert.org.tw/en/cp-139-8048-f0e4d-2.html
CVE ID: CVE-2024-8450 State: PUBLISHED Published: 2024-09-30T06:50:58.570Z Last Updated: 2024-09-30T17:33:25.526Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-798 Description: Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowing unauthorized remote attackers to use this community string to access the SNMPv1 service with read-write privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8049-83fe4-1.html - https://www.twcert.org.tw/en/cp-139-8
ulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8049-83fe4-1.html - https://www.twcert.org.tw/en/cp-139-8050-52f32-2.html
CVE ID: CVE-2024-8451 State: PUBLISHED Published: 2024-09-30T06:56:40.972Z Last Updated: 2024-09-30T17:32:59.893Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-400, CWE-280 Description: Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorized remote attackers to exploit this weakness to occupy connection slots and prevent legitimate users from accessing the SSH service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.or
s from accessing the SSH service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8051-5048e-1.html - https://www.twcert.org.tw/en/cp-139-8052-ac0ea-2.html
CVE ID: CVE-2024-8452 State: PUBLISHED Published: 2024-09-30T07:07:26.325Z Last Updated: 2024-09-30T17:32:24.359Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-327, CWE-328 Description: Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html - https://www.twcert.org.tw/en/cp-
ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html - https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html
CVE ID: CVE-2024-8453 State: PUBLISHED Published: 2024-09-30T07:12:14.782Z Last Updated: 2024-09-30T15:47:03.144Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-328, CWE-759 Description: Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers with administrator privileges can read configuration files to obtain the hash values, and potentially crack them to retrieve the plaintext passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.o
retrieve the plaintext passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8055-2c361-1.html - https://www.twcert.org.tw/en/cp-139-8056-09688-2.html
CVE ID: CVE-2024-8454 State: PUBLISHED Published: 2024-09-30T07:18:30.271Z Last Updated: 2024-09-30T16:59:40.972Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0, IGS-5225-4UP1T2S hardware 1.0 Problem Types: CWE-476, CWE-400 Description: The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl service, allowing unauthenticated remote attackers to send crafted packets that can crash the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcer
d packets that can crash the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8057-1b3fa-1.html - https://www.twcert.org.tw/en/cp-139-8058-cc391-2.html
CVE ID: CVE-2024-8455 State: PUBLISHED Published: 2024-09-30T07:24:49.379Z Last Updated: 2024-09-30T16:54:36.168Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0, IGS-5225-4UP1T2S hardware 1.0 Problem Types: CWE-261 Description: The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords. Addit
th, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8059-bde5f-1.html - https://www.twcert.org.tw/en/cp-139-8060-f3955-2.html
CVE ID: CVE-2024-8456 State: PUBLISHED Published: 2024-09-30T07:35:04.179Z Last Updated: 2024-09-30T16:51:08.872Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-306 Description: Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8061-91872-1.
ices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8061-91872-1.html - https://www.twcert.org.tw/en/cp-139-8062-92f17-2.html
CVE ID: CVE-2024-8457 State: PUBLISHED Published: 2024-09-30T07:39:17.778Z Last Updated: 2024-09-30T15:46:39.115Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-79 Description: Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8063-01634-1.html - https://www.twc
st Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8063-01634-1.html - https://www.twcert.org.tw/en/cp-139-8064-70255-2.html
CVE ID: CVE-2024-8458 State: PUBLISHED Published: 2024-09-30T07:45:34.664Z Last Updated: 2024-09-30T16:47:20.988Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-352 Description: Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user and perform actions on their behalf, such as creating accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
orm actions on their behalf, such as creating accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8065-579c1-1.html - https://www.twcert.org.tw/en/cp-139-8066-d6504-2.html
CVE ID: CVE-2024-8459 State: PUBLISHED Published: 2024-09-30T07:59:27.614Z Last Updated: 2024-09-30T16:13:57.982Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-312 Description: Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administrator privileges to read the file and obtain the credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8067-2fc50-1.html - https://www.twcert.org.tw/en/cp-139-8068-8aa
ment: References: - https://www.twcert.org.tw/tw/cp-132-8067-2fc50-1.html - https://www.twcert.org.tw/en/cp-139-8068-8aaa5-2.html
CVE ID: CVE-2024-8460 State: PUBLISHED Published: 2024-09-05T12:00:07.296Z Last Updated: 2024-09-05T14:52:02.394Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: D-Link Products: DNS-320 Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, has been found in D-Link DNS-320 2.02b01. Affected by this issue is some unknown functionality of the file /cgi-bin/widget_api.cgi of the component Web Management Interface. The manipulation of the argument getHD/getSer/getSys leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The expl
ay be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276626 - https://vuldb.com/?ctiid.276626 - https://vuldb.com/?submit.401297 - https://github.com/leetsun/IoT-Vuls/tree/main/Dlink-dns320/1 - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - https://www
ree/main/Dlink-dns320/1 - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - https://www.dlink.com/
CVE ID: CVE-2024-8461 State: PUBLISHED Published: 2024-09-05T12:31:05.270Z Last Updated: 2024-09-05T14:47:39.045Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: D-Link Products: DNS-320 Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of the component Web Management Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the ma
sed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276627 - https://vuldb.com/?ctiid.276627 - https://vuldb.com/?submit.401300 - https://github.com/leetsun/IoT-Vuls/tree/main/Dlink-dns320/4 - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - https://www.dlink.com/
CVE ID: CVE-2024-8462 State: PUBLISHED Published: 2024-09-05T13:00:05.647Z Last Updated: 2024-09-05T13:56:09.660Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Windmill Problem Types: CWE-307 Description: A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/users.rs of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.390
tely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.390.1 is able to address this issue. The patch is identified as acfe7786152f036f2476f93ab5536571514fa9e3. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276630 - https://vuldb.com/?ctiid.276630 - https://vuldb.com/?submit.401826 - https://github.com/windmill-labs/windmill/commit/acfe7786152f036f2476f93ab5536571514fa9e3 - https://github.com/windmill-labs/windmill/releases/tag/v1.390.1
CVE ID: CVE-2024-8463 State: PUBLISHED Published: 2024-09-05T12:49:52.618Z Last Updated: 2024-09-05T13:25:59.317Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-434 Description: File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to execute an RCE via webshell. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8464 State: PUBLISHED Published: 2024-09-05T12:54:15.421Z Last Updated: 2024-09-05T13:24:06.728Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-89 Description: SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.php, and retrieve all the information stored in it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8465 State: PUBLISHED Published: 2024-09-05T12:54:34.307Z Last Updated: 2024-09-05T13:22:57.789Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-89 Description: SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and retrieve all the information stored in it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8466 State: PUBLISHED Published: 2024-09-05T12:54:49.671Z Last Updated: 2024-09-05T13:21:56.302Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-89 Description: SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/category/controller.php, and retrieve all the information stored in it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8467 State: PUBLISHED Published: 2024-09-05T12:55:09.389Z Last Updated: 2024-09-05T13:18:18.565Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-89 Description: SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/index.php, and retrieve all the information stored in it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8468 State: PUBLISHED Published: 2024-09-05T12:55:28.534Z Last Updated: 2024-09-05T13:15:13.688Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-89 Description: SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, and retrieve all the information stored in it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8469 State: PUBLISHED Published: 2024-09-05T12:55:44.603Z Last Updated: 2024-09-05T13:13:56.901Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-89 Description: SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/index.php, and retrieve all the information stored in it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8470 State: PUBLISHED Published: 2024-09-05T12:56:02.047Z Last Updated: 2024-09-05T13:12:37.209Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-89 Description: SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacancy/controller.php, and retrieve all the information stored in it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8471 State: PUBLISHED Published: 2024-09-05T13:07:54.067Z Last Updated: 2024-09-05T13:29:09.863Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8472 State: PUBLISHED Published: 2024-09-05T13:08:12.515Z Last Updated: 2024-09-05T13:28:45.886Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through multiple parameters in /jobportal/index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8473 State: PUBLISHED Published: 2024-09-05T13:08:31.923Z Last Updated: 2024-09-05T13:27:17.329Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: PHPGurukul Products: Job Portal Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through user_email parameter in /jobportal/admin/login.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE ID: CVE-2024-8474 State: PUBLISHED Published: 2025-01-06T14:33:26.129Z Last Updated: 2025-01-06T16:54:38.487Z Vendors: OpenVPN Products: OpenVPN Connect Problem Types: CWE-212 Description: OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openvpn.net/connect-docs/android-release-notes.html
CVE ID: CVE-2024-8475 State: PUBLISHED Published: 2024-12-17T11:42:03.959Z Last Updated: 2024-12-17T14:33:40.593Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Digital Operation Services Products: WiFiBurada Problem Types: CWE-302, CWE-799 Description: Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables.This issue affects WiFiBurada: before 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1888
CVE ID: CVE-2024-8476 State: PUBLISHED Published: 2024-09-25T02:05:13.494Z Last Updated: 2024-09-25T13:36:53.212Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: scottpaterson Products: Easy PayPal Events Problem Types: CWE-352 Description: The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeevent_plugin_buttons() function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link
ts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/602d337e-0778-4182-8e77-0eb3b37d5a7a?source=cve - https://plugins.trac.wordpress.org/browser/easy-paypal-events-tickets/tags/1.2.1/includes/private_buttons.php#L5 - https://plugins.trac.wordpress.org/browser/easy-paypal-events-tickets/tags/1.2.1/includes/private_buttons.php#L273 - https://plugins.trac.wordpress.org/changeset/3155809/easy-paypal-events-tickets/trunk/includes/private_buttons.php
CVE ID: CVE-2024-8477 State: PUBLISHED Published: 2024-10-10T02:06:12.095Z Last Updated: 2024-10-10T14:27:25.509Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: neeraj_slit Products: Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) Problem Types: CWE-352 Description: The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.87. This is due to missing or incorrect nonce validation on the Init() function. This makes it possible for unauthenticated attackers to log out of a Brevo connection