Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3954 State: PUBLISHED Published: 2024-05-09T20:03:19.931Z Last Updated: 2024-08-01T20:26:57.182Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: metaphorcreations Products: Ditty – Responsive News Tickers, Sliders, and Lists Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditty. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is pre
access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f00b138-5c4b-4f75-94b1-82721cba2668?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081335%40ditty-news-ticker&new=3081335%40ditty-news-ticker&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3955 State: PUBLISHED Published: 2024-05-02T09:43:51.941Z Last Updated: 2024-08-01T20:26:57.228Z Vendors: PiBrewing, CraftBeerPi - Brewing Controller Products: CraftBeerPi 4 Problem Types: CWE-94 Description: URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing to execute arbitrary code.This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/
57572c7). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/05/CVE-2024-3955/ - https://cert.pl/posts/2024/05/CVE-2024-3955/ - https://github.com/PiBrewing/craftbeerpi4/issues/132
CVE ID: CVE-2024-3956 State: PUBLISHED Published: 2024-05-10T08:32:34.089Z Last Updated: 2024-08-01T20:26:57.201Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: sc0ttkclark Products: Pods – Custom Content Types and Fields Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pod Form widget in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with c
sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a0707c92-96e9-444a-8a13-52d49c9e3f5c?source=cve - https://plugins.trac.wordpress.org/browser/pods/tags/3.2.1/ui/front/form.php#L105 - https://plugins.trac.wordpress.org/changeset/3083418/pods/tags/3.1.4.1/includes/data.php - https://plugins.trac.wordpress.org/changeset/3083418/pods/tags/3.1.4.1
set/3083418/pods/tags/3.1.4.1/includes/data.php - https://plugins.trac.wordpress.org/changeset/3083418/pods/tags/3.1.4.1/ui/front/form.php - https://pods.io/2024/05/08/pods-3-2-1-1-security-release/
CVE ID: CVE-2024-3957 State: PUBLISHED Published: 2024-05-02T16:51:49.208Z Last Updated: 2024-08-01T20:26:57.228Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: pluggabl Products: Booster for WooCommerce Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide. Additional Analyst Notes: - CISA AD
s on what other plugins are installed and what shortcode functionality they provide. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1653de8f-62eb-488b-9e97-8b30221b509f?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/class-wcj-product-by-user.php#L245 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3076207%40woocommerce-jetpack%2Ftrunk&old=3046146%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail=#file7
CVE ID: CVE-2024-3958 State: PUBLISHED Published: 2024-08-08T10:31:17.868Z Last Updated: 2024-09-17T15:31:43.886Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-94 Description: An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/456988 - htt
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/456988 - https://hackerone.com/reports/2437784
CVE ID: CVE-2024-3959 State: PUBLISHED Published: 2024-06-26T23:31:25.425Z Last Updated: 2024-08-29T15:04:57.412Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-285 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/456989 - https://hackerone.com/reports/2456845
CVE ID: CVE-2024-3960 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:33.275Z Description: No description available.
CVE ID: CVE-2024-3961 State: PUBLISHED Published: 2024-06-21T03:49:00.260Z Last Updated: 2024-08-01T20:26:57.176Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: convertkit Products: ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages Problem Types: CWE-862 Missing Authorization Description: The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tag_subscriber function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to subscribe users to tags. Fi
ersions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to subscribe users to tags. Financial damages may occur to site owners if their API quota is exceeded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79d828b8-aea2-4705-ae23-ac70133a6c3e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3104932%40convertkit%2Ftrunk&old=3085997%40convertkit%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3962 State: PUBLISHED Published: 2024-04-26T08:29:20.259Z Last Updated: 2024-08-01T20:26:57.175Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: themeisle Products: Product Addons & Fields for WooCommerce Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code e
sible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires the PPOM Pro plugin to be installed along with a WooCommerce product that contains a file upload field to retrieve the correct nonce. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f95bcc3-354e-4016-9a17-945569b076b6?source=cve - https://themeisle.com/plugins/ppom-pro/ - https://plugins.trac.wordpress.org/changeset/3075669/woocommerce-product-addon
CVE ID: CVE-2024-3963 State: PUBLISHED Published: 2024-07-13T06:00:05.270Z Last Updated: 2024-08-01T20:26:57.225Z Vendors: Unknown Products: Giveaways and Contests by RafflePress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Giveaways and Contests by RafflePress WordPress plugin before 1.12.14 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/827d738e-5369-431e-8438-b5c4d8c1f8f1/
CVE ID: CVE-2024-3964 State: PUBLISHED Published: 2024-07-13T06:00:05.478Z Last Updated: 2024-08-01T20:26:57.228Z Vendors: Unknown Products: Product Enquiry for WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ff468772-3e6a-439c-a4d7-94bd2ce1a964/
CVE ID: CVE-2024-3965 State: PUBLISHED Published: 2024-06-14T06:00:02.754Z Last Updated: 2024-08-01T20:26:57.179Z Vendors: Unknown Products: Pray For Me Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0e1ba2b3-5849-42f6-b503-8b3b520e4a79/
CVE ID: CVE-2024-3966 State: PUBLISHED Published: 2024-06-14T06:00:02.940Z Last Updated: 2024-10-28T20:39:23.356Z Vendors: Unknown Products: Pray For Me Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripting attacks that trigger when an admin visits the Prayer Requests in the WP Admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/9f0a575f-862d-4f2e-8d25-82c6f58dd11a/
CVE ID: CVE-2024-3967 State: PUBLISHED Published: 2024-05-15T16:40:10.253Z Last Updated: 2024-08-01T20:26:57.248Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: OpenText Products: iManager Problem Types: CWE-502 Description: Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution unisng unsafe java object deserialization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3968 State: PUBLISHED Published: 2024-05-15T16:39:39.515Z Last Updated: 2024-08-01T20:26:57.240Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenText Products: iManager Problem Types: CWE-20 Description: Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution using custom file upload task. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3969 State: PUBLISHED Published: 2024-05-28T14:38:06.307Z Last Updated: 2024-08-21T16:41:56.086Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenText Products: iManager Problem Types: CWE-611 Description: XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3970 State: PUBLISHED Published: 2024-05-15T16:39:21.361Z Last Updated: 2024-08-01T20:26:57.230Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenText Products: iManager Problem Types: CWE-918 Description: Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure by directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3971 State: PUBLISHED Published: 2024-06-14T06:00:03.148Z Last Updated: 2025-03-13T21:21:14.103Z Vendors: Unknown Products: Similarity Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5dec5719-105d-4989-a97f-bda04d223322/
CVE ID: CVE-2024-3972 State: PUBLISHED Published: 2024-06-14T06:00:03.351Z Last Updated: 2024-08-01T20:26:57.234Z Vendors: Unknown Products: Similarity Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/55dfb9b5-d590-478b-bd1f-d420b79037fa/
CVE ID: CVE-2024-3973 State: PUBLISHED Published: 2024-08-07T06:00:05.491Z Last Updated: 2025-03-19T18:03:07.457Z Vendors: Unknown Products: House Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8c6ce66e-091a-41da-a13d-5f80cadb499a/
CVE ID: CVE-2024-3974 State: PUBLISHED Published: 2024-05-09T20:03:23.335Z Last Updated: 2024-08-01T20:26:57.263Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: buddypress Products: BuddyPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages th
le for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3657384e-025a-44ad-8b7e-1a2fea17dcc3?source=cve - https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-members/bp-members-blocks.php#L347 - https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-members/bp-members-admin.php#L145 - https://plugins.trac.wordpress.org/changeset/3079691/buddypress
CVE ID: CVE-2024-3975 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:35.108Z Description: No description available.
CVE ID: CVE-2024-3976 State: PUBLISHED Published: 2025-02-05T12:02:27.929Z Last Updated: 2025-02-05T20:12:12.955Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to unauthorised instance users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/457140 - h
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/457140 - https://hackerone.com/reports/2470939
CVE ID: CVE-2024-3977 State: PUBLISHED Published: 2024-06-14T06:00:03.530Z Last Updated: 2024-08-01T20:26:57.263Z Vendors: Unknown Products: WordPress Jitsi Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/25851386-eccf-49cb-afbf-c25286c9b19e/
CVE ID: CVE-2024-3978 State: PUBLISHED Published: 2024-06-14T06:00:03.710Z Last Updated: 2024-08-01T20:26:57.200Z Vendors: Unknown Products: WordPress Jitsi Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a9f47d11-47ac-4998-a82a-dc2f3b0decdf/
CVE ID: CVE-2024-3979 State: PUBLISHED Published: 2024-04-19T18:00:08.395Z Last Updated: 2024-08-01T20:26:57.251Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: COVESA Products: vsomeip Problem Types: CWE-362 Description: A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261596. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - ht
ulnerability is VDB-261596. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261596 - https://vuldb.com/?ctiid.261596 - https://vuldb.com/?submit.312410 - https://github.com/COVESA/vsomeip/issues/663 - https://github.com/COVESA/vsomeip/files/14904610/details.zip
CVE ID: CVE-2024-3980 State: PUBLISHED Published: 2024-08-27T12:42:41.124Z Last Updated: 2025-08-27T21:24:22.839Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Energy Products: MicroSCADA X SYS600, MicroSCADA Pro SYS600 Problem Types: CWE-22 Description: The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/previe
application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-3982 State: PUBLISHED Published: 2024-08-27T12:47:21.577Z Last Updated: 2024-08-27T17:52:18.269Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Energy Products: MicroSCADA SYS600 Problem Types: CWE-294 Description: An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator rights can enable it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/previe
n enable it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-3983 State: PUBLISHED Published: 2024-08-01T06:00:05.102Z Last Updated: 2024-08-01T16:08:02.885Z Vendors: Unknown Products: WooCommerce Customers Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e4059d66-07b9-4f1a-a461-d6e8f0e98eec/
CVE ID: CVE-2024-3984 State: PUBLISHED Published: 2024-06-19T03:12:30.634Z Last Updated: 2024-08-01T20:26:57.244Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: embedsocial Products: EmbedSocial – Social Media Feeds, Reviews and Galleries Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EmbedSocial – Social Media Feeds, Reviews and Galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedsocial_reviews' shortcode in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user supplied attributes