Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2622 State: PUBLISHED Published: 2024-03-19T02:00:07.258Z Last Updated: 2024-08-12T16:39:26.046Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Fujian Kelixin Communication Products: Command and Dispatch Platform Problem Types: CWE-89 Description: A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318. It has been classified as critical. This affects an unknown part of the file /api/client/editemedia.php. The manipulation of the argument number/enterprise_uuid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identif
le to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257199. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257199 - https://vuldb.com/?ctiid.257199 - https://h0e4a0r1t.github.io/2024/vulns/Fujian%20Kelixin%20Communication%20Co.,%20Ltd.%20Command%20and%20Dispatch%20Platform%20SQL%20Injection%20Vulnerability-editemedia.pdf
CVE ID: CVE-2024-2623 State: PUBLISHED Published: 2024-04-09T18:59:17.215Z Last Updated: 2024-08-01T19:18:47.963Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's message parameter in all versions up to, and including, 5.9.11 due to insuf
ss-Site Scripting via the countdown widget's message parameter in all versions up to, and including, 5.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/baa92aee-a0a0-45d4-aa12-1449a829930c?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/browser/assets/front-end/js/view/count-down.js - https://plugins.t
press.org/browser/essential-addons-for-elementor-lite/browser/assets/front-end/js/view/count-down.js - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3058018%40essential-addons-for-elementor-lite%2Ftrunk&old=3050196%40essential-addons-for-elementor-lite%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2624 State: PUBLISHED Published: 2024-06-06T18:11:44.254Z Last Updated: 2024-08-01T19:18:48.117Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-29 Description: A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_personal_path")` endpoint in `./lollms-webui/lollms_core/lollms/server/endpoints/lollms_user.py`. The vulnerability arises due to insufficient sanitization of user-supplied input for the `path` parameter, allowing an attacker to specify arbitrary file system paths. This fla
n of user-supplied input for the `path` parameter, allowing an attacker to specify arbitrary file system paths. This flaw enables direct arbitrary file uploads, leakage of `personal_data`, and overwriting of configurations in `lollms-webui`->`configs` by exploiting the same named directory in `personal_data`. The issue affects the latest version of the application and is fixed in version 9.4. Successful exploitation could lead to sensitive information disclosure, unauthorized file uploads, and potentially remote code execution by overwriting critical configuration files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/39e17
ditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/39e17897-0e92-4473-91c7-f728322191aa - https://github.com/parisneo/lollms-webui/commit/aeba79f3ea934331b8ecd625a58bae6e4f7e7d3f
CVE ID: CVE-2024-2625 State: PUBLISHED Published: 2024-03-20T17:06:43.112Z Last Updated: 2025-03-13T18:16:55.124Z Vendors: Google Products: Chrome Problem Types: Object lifecycle issue Description: Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/327740539 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj
//issues.chromium.org/issues/327740539 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D3Z6CRRN4J3IUZPJZVURGMRBN6WFPTU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQVVW4FLQDIJ2UABGXK2SMS5AUGT54FM/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JINDYFB3MPH43ECTI72BV63K4RXSG22/
CVE ID: CVE-2024-2626 State: PUBLISHED Published: 2024-03-20T17:06:43.596Z Last Updated: 2025-03-26T14:52:40.074Z Vendors: Google Products: Chrome Problem Types: Out of bounds read Description: Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/40945098 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj
://issues.chromium.org/issues/40945098 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D3Z6CRRN4J3IUZPJZVURGMRBN6WFPTU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQVVW4FLQDIJ2UABGXK2SMS5AUGT54FM/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JINDYFB3MPH43ECTI72BV63K4RXSG22/
CVE ID: CVE-2024-2627 State: PUBLISHED Published: 2024-03-20T17:06:44.065Z Last Updated: 2025-02-13T17:41:10.469Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/41493290 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/messa
omium.org/issues/41493290 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D3Z6CRRN4J3IUZPJZVURGMRBN6WFPTU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQVVW4FLQDIJ2UABGXK2SMS5AUGT54FM/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JINDYFB3MPH43ECTI72BV63K4RXSG22/
CVE ID: CVE-2024-2628 State: PUBLISHED Published: 2024-03-20T17:06:44.345Z Last Updated: 2025-02-13T17:41:11.052Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted URL. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/41487774 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.
ssues.chromium.org/issues/41487774 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D3Z6CRRN4J3IUZPJZVURGMRBN6WFPTU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQVVW4FLQDIJ2UABGXK2SMS5AUGT54FM/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JINDYFB3MPH43ECTI72BV63K4RXSG22/
CVE ID: CVE-2024-2629 State: PUBLISHED Published: 2024-03-20T17:06:44.739Z Last Updated: 2025-03-13T18:25:58.465Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/41487721 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D
.org/issues/41487721 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D3Z6CRRN4J3IUZPJZVURGMRBN6WFPTU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQVVW4FLQDIJ2UABGXK2SMS5AUGT54FM/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JINDYFB3MPH43ECTI72BV63K4RXSG22/
CVE ID: CVE-2024-2630 State: PUBLISHED Published: 2024-03-20T17:06:45.186Z Last Updated: 2025-03-17T16:57:22.964Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/41481877 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje
//issues.chromium.org/issues/41481877 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D3Z6CRRN4J3IUZPJZVURGMRBN6WFPTU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQVVW4FLQDIJ2UABGXK2SMS5AUGT54FM/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JINDYFB3MPH43ECTI72BV63K4RXSG22/
CVE ID: CVE-2024-2631 State: PUBLISHED Published: 2024-03-20T17:06:45.472Z Last Updated: 2025-03-28T23:53:50.051Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/41495878 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
es.chromium.org/issues/41495878 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D3Z6CRRN4J3IUZPJZVURGMRBN6WFPTU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQVVW4FLQDIJ2UABGXK2SMS5AUGT54FM/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JINDYFB3MPH43ECTI72BV63K4RXSG22/
CVE ID: CVE-2024-2632 State: PUBLISHED Published: 2024-03-19T11:58:39.831Z Last Updated: 2024-08-01T19:18:47.971Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Cegid Products: Meta4 HR Problem Types: CWE-200 Description: A Information Exposure Vulnerability has been found on Meta4 HR. This vulnerability allows an attacker to obtain a lot of information about the application such as the variables set in the process, the Tomcat versions, library versions and underlying operation system via HTTP GET '/sitetest/english/dumpenv.jsp'. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/noti
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE ID: CVE-2024-2633 State: PUBLISHED Published: 2024-03-19T12:03:45.365Z Last Updated: 2024-08-01T19:18:48.243Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cegid Products: Meta4 HR Problem Types: CWE-79 Description: A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sitetest/english/dumpenv.jsp' is vulnerable to XSS attack by 'lang' query, i.e. '/sitetest/english/dumpenv.jsp?snoop=yes&lang=%27%3Cimg%20src/onerror=alert(1)%3E&params'. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-v
A ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE ID: CVE-2024-2634 State: PUBLISHED Published: 2024-03-19T12:08:21.536Z Last Updated: 2024-08-01T19:18:47.903Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cegid Products: Meta4 HR Problem Types: CWE-79 Description: A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sse_generico/generico_login.jsp' is vulnerable to XSS attack via 'lang' query, i.e. '/sse_generico/generico_login.jsp?lang=%27%3balert(%27BLEUSS%27)%2f%2f&params='. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnera
Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE ID: CVE-2024-2635 State: PUBLISHED Published: 2024-03-19T12:09:48.232Z Last Updated: 2024-08-21T17:46:06.799Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Cegid Products: Meta4 HR Problem Types: CWE-698 Description: The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en
ality Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE ID: CVE-2024-2636 State: PUBLISHED Published: 2024-03-19T12:12:13.392Z Last Updated: 2024-08-13T13:20:44.141Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Cegid Products: Meta4 HR Problem Types: CWE-434 Description: An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espanol/update_password.jsp' file. Modifying the 'M4_NEW_PASSWORD' parameter, an attacker could store a malicious JSP file inside the file directory, to be executed the the file is loaded in the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
the file is loaded in the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid
CVE ID: CVE-2024-2637 State: PUBLISHED Published: 2024-05-14T18:49:28.624Z Last Updated: 2025-04-24T06:52:46.092Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: B&R Industrial Automation Products: Scene Viewer, Automation Runtime, mapp Vision, mapp View, mapp Cockpit, mapp Safety, VC4, APROL, CAN Driver, CAN Driver CC770, CAN Driver SJA1000, Tou0ch Lock, B&R Single-Touch Driver, Serial User Mode Touch Driver, Windows Settings Changer (LTSC), Windows Settings Changer (2019 LTSC), Windows 10 Recovery Solution, ADI driver universal, ADI Development Kit, ADI .NET SDK, SRAM driver, HMI Service Center, HMI Service Center Maintenance, Windows 10 IoT Enterprise 2019
ment Kit, ADI .NET SDK, SRAM driver, HMI Service Center, HMI Service Center Maintenance, Windows 10 IoT Enterprise 2019 LTSC, KCF Editor Problem Types: CWE-427 Description: An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&
ial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Au
&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-
: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refere
hrough 1.1; KCF Editor: before 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf
CVE ID: CVE-2024-2639 State: PUBLISHED Published: 2024-03-19T15:00:06.206Z Last Updated: 2024-08-12T16:40:54.734Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Bdtask Products: Wholesale Inventory Management System Problem Types: CWE-384 Description: A vulnerability was found in Bdtask Wholesale Inventory Management System up to 20240311. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to session fixiation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257245 was assigned to this vulnerability. NOTE: The vendor was contacted early about
d may be used. The identifier VDB-257245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257245 - https://vuldb.com/?ctiid.257245 - https://drive.google.com/file/d/1bNnSNssAeQFkO0FdW_yaEvDg5XExMPaf/view?usp=drivesdk
CVE ID: CVE-2024-2640 State: PUBLISHED Published: 2024-07-12T06:00:05.185Z Last Updated: 2024-08-01T19:18:48.172Z Vendors: Unknown Products: Watu Quiz Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been authorized by admins) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/d46db635-9d84-4268-a789-406a0db4cccf/
CVE ID: CVE-2024-2641 State: PUBLISHED Published: 2024-03-19T20:31:04.208Z Last Updated: 2024-08-01T19:18:47.980Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Ruijie Products: RG-NBS2009G-P Problem Types: CWE-285 Description: A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been classified as critical. Affected is an unknown function of the file /system/passwdManage.htm of the component Password Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257280. NOTE: The vendor was
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257280. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257280 - https://vuldb.com/?ctiid.257280 - https://h0e4a0r1t.github.io/2024/vulns/Unauthorized%20access%20vulnerability%20in%20Ruijie%20RG-NBS2009G-P%20switch.pdf
CVE ID: CVE-2024-2642 State: PUBLISHED Published: 2024-03-19T21:31:03.872Z Last Updated: 2024-08-19T17:12:16.116Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Ruijie Products: RG-NBS2009G-P Problem Types: CWE-77 Description: A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /EXCU_SHELL. The manipulation of the argument Command1 leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257281 was assigned to this vulnerability. NOTE: The vendor was contacted early about t