Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8778 State: PUBLISHED Published: 2024-09-16T05:48:33.163Z Last Updated: 2024-09-16T13:05:51.023Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: The SYSCOM Group Products: OMFLOW Problem Types: CWE-36 Description: OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8073-ff771-1.html - https://www.twcert.org.tw/en/cp-139-8074-66457-2.html
CVE ID: CVE-2024-8779 State: PUBLISHED Published: 2024-09-16T05:51:45.255Z Last Updated: 2024-09-16T13:52:19.224Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: The SYSCOM Group Products: OMFLOW Problem Types: CWE-284 Description: OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privileges to update system settings or create accounts with administrator privileges, thereby gaining control of the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8075-a0d06-1.html - https://www.twcert.org.tw/en/cp-139-
Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8075-a0d06-1.html - https://www.twcert.org.tw/en/cp-139-8076-6ade0-2.html
CVE ID: CVE-2024-8780 State: PUBLISHED Published: 2024-09-16T05:56:22.825Z Last Updated: 2024-09-16T13:05:35.370Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: The SYSCOM Group Products: OMFLOW Problem Types: CWE-200 Description: OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regular privileges to obtain accounts and password hashes of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8077-7a7c0-1.html - https://www.twcert.org.tw/en/cp-139-8078-36fc9-2.html
CVE ID: CVE-2024-8781 State: PUBLISHED Published: 2024-11-18T14:00:49.131Z Last Updated: 2024-11-18T20:18:28.645Z Vendors: TR7 Products: Application Security Platform (ASP) Problem Types: CWE-250, CWE-424 Description: Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allows Privilege Escalation, -Privilege Abuse.This issue affects Application Security Platform (ASP): v1.4.25.188. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1861
CVE ID: CVE-2024-8782 State: PUBLISHED Published: 2024-09-13T18:00:09.004Z Last Updated: 2024-09-13T18:38:13.694Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: JFinalCMS Problem Types: CWE-22 Description: A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277433 - https://vuldb.com/?ctiid.277433 - https://vuldb.com/?
ISA ADP Vulnrichment: References: - https://vuldb.com/?id.277433 - https://vuldb.com/?ctiid.277433 - https://vuldb.com/?submit.405528 - https://gitee.com/heyewei/JFinalcms/issues/IAOSJG - https://github.com/yhy7612/Seccode/blob/main/README1.md
CVE ID: CVE-2024-8783 State: PUBLISHED Published: 2024-09-13T18:31:06.312Z Last Updated: 2024-09-16T17:45:16.384Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: OpenTibiaBR Products: MyAAC Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in OpenTibiaBR MyAAC up to 0.8.16. Affected is an unknown function of the file system/pages/forum/new_post.php of the component Post Reply Handler. The manipulation of the argument post_topic leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as bf6ae3df0d32fa22552bb44ca4f8489a6e78cc1c. It is r
en disclosed to the public and may be used. The patch is identified as bf6ae3df0d32fa22552bb44ca4f8489a6e78cc1c. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277434 - https://vuldb.com/?ctiid.277434 - https://vuldb.com/?submit.406368 - https://github.com/opentibiabr/myaac/issues/121 - https://github.com/opentibiabr/myaac/pull/122 - https://github.com/opentibiabr/myaac/pull/122/commits/bf6ae3df0d32fa22552bb44ca4f8489a6e78cc1c
CVE ID: CVE-2024-8784 State: PUBLISHED Published: 2024-09-13T18:31:09.898Z Last Updated: 2024-09-16T17:46:18.889Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: QDocs Products: Smart School Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknown functionality of the file /user/chat/mynewuser of the component Chat. The manipulation of the argument users[] with the input 1'+AND+(SELECT+3220+FROM+(SELECT(SLEEP(5)))ZNun)+AND+'WwBM'%3d'WwBM as part of POST Request Parameter leads to sql injection. The attack can be launched remotely. The exploit h
BM'%3d'WwBM as part of POST Request Parameter leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.1 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277435 - https://vuldb.com/?ctiid.277435 - https://vuldb.com/?submit.407385 - https://github.com/bytium/vulnerability-research/blob/main/Advisory%20for%20Time-Based%20Blind%20SQL%20Injection%20in%20QDocs%20Smart%20School.md - https://smart-school.in/article/version-7-0-1 - https://codecanyon.net/item/smart-school-school-management-
0School.md - https://smart-school.in/article/version-7-0-1 - https://codecanyon.net/item/smart-school-school-management-system/19426018
CVE ID: CVE-2024-8785 State: PUBLISHED Published: 2024-12-02T14:49:36.748Z Last Updated: 2024-12-02T15:30:19.766Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-648 Description: In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-Septe
CVE ID: CVE-2024-8786 State: PUBLISHED Published: 2024-10-01T08:30:17.471Z Last Updated: 2024-10-01T13:36:21.050Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: brochris Products: Auto Featured Image from Title Problem Types: CWE-79 Description: The Auto Featured Image from Title plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. A
ipts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bf6102-458f-4930-8880-baa96afb1c15?source=cve - https://plugins.trac.wordpress.org/browser/auto-featured-image-from-title/trunk/auto-featured-image-from-title.php#L822
CVE ID: CVE-2024-8787 State: PUBLISHED Published: 2024-10-16T02:05:02.076Z Last Updated: 2024-10-16T13:38:04.039Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: elbanyaoui Products: Smart Online Order for Clover Problem Types: CWE-79 Description: The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as
ect arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35d64d3e-b48e-4e35-ab1d-0557fcd62263?source=cve - https://plugins.trac.wordpress.org/browser/clover-online-orders/tags/1.5.7/admin/moo-OnlineOrders-admin.php#L477 - https://plugins.trac.wordpress.org/browser/clover-online-orders/tags/1.5.7/admin/includes/class-moo-products-list.php#L572 - https://plugins.trac.wordpress.org/changeset/3168446/clover-online-orders/tags/1.5.8/admin/includes/class-moo-products-list.php?old=3142847&old_pat
ess.org/changeset/3168446/clover-online-orders/tags/1.5.8/admin/includes/class-moo-products-list.php?old=3142847&old_path=clover-online-orders%2Ftags%2F1.5.7%2Fadmin%2Fincludes%2Fclass-moo-products-list.php - https://plugins.trac.wordpress.org/changeset/3168446/clover-online-orders/tags/1.5.8/admin/moo-OnlineOrders-admin.php?old=3142847&old_path=clover-online-orders%2Ftags%2F1.5.7%2Fadmin%2Fmoo-OnlineOrders-admin.php
CVE ID: CVE-2024-8788 State: PUBLISHED Published: 2024-09-28T02:04:24.211Z Last Updated: 2024-09-30T15:03:48.662Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: omardabbas Products: EU/UK VAT Manager for WooCommerce Problem Types: CWE-79 Description: The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.11. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking
rary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/443c57bf-2f3d-4b8f-9dae-b11142a74341?source=cve - https://plugins.trac.wordpress.org/browser/eu-vat-for-woocommerce/tags/2.12.12/includes/admin/class-alg-wc-eu-vat-admin.php#L461 - https://plugins.trac.wordpress.org/changeset/3158296/eu-vat-for-woocommerce/tags/2.12.14/includes/admin/class-alg-wc-eu-vat-admin.php
CVE ID: CVE-2024-8789 State: PUBLISHED Published: 2025-03-20T10:10:28.174Z Last Updated: 2025-10-15T12:50:42.963Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-1333 Description: Lunary-ai/lunary version git 105a3f6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. The application allows users to upload their own regular expressions, which are then executed on the server side. Certain regular expressions can have exponential runtime complexity relative to the input size, leading to potential denial of service. An attacker can exploit this by submitting a specially crafted regular ex
size, leading to potential denial of service. An attacker can exploit this by submitting a specially crafted regular expression, causing the server to become unresponsive for an arbitrary length of time. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e32f5f0d-bd46-4268-b6b1-619e07c6fda3 - https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497fa
CVE ID: CVE-2024-8790 State: PUBLISHED Published: 2024-10-18T04:32:51.131Z Last Updated: 2024-10-18T13:06:28.744Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: themeinwp Products: Social Share With Floating Bar Problem Types: CWE-79 Description: The Social Share With Floating Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link
scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec35484-8561-4a8c-bf67-0a880f915fb1?source=cve - https://plugins.trac.wordpress.org/browser/social-share-with-floating-bar/tags/1.0.3/inc/class-social-share-with-floating-bar-settings.php#L312
CVE ID: CVE-2024-8791 State: PUBLISHED Published: 2024-09-24T02:31:00.740Z Last Updated: 2024-09-24T13:46:18.285Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: smub Products: Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Problem Types: CWE-639 Description: The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible f
ng a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee60943-b583-4a99-8e62-846b380c98aa?source=cve - https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.1.14/includes/users/class-charitable-user.php#L872 - https://plugins.trac.wordpress.org/changeset/3154009/charitable/trunk/includes/users/class-charitable-user.php
CVE ID: CVE-2024-8792 State: PUBLISHED Published: 2024-10-30T02:32:19.366Z Last Updated: 2024-10-30T13:02:11.443Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: markjaquith Products: Subscribe to Comments Problem Types: CWE-79 Description: The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analy
hat execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7566ac1-9ae2-44d2-8ad1-029957870992?source=cve - https://plugins.trac.wordpress.org/browser/subscribe-to-comments/trunk/subscribe-to-comments.php#L1470 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3177660%40subscribe-to-comments%2Ftrunk&old=1198281%40subscribe-to-comments%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8793 State: PUBLISHED Published: 2024-10-01T08:30:15.952Z Last Updated: 2024-10-01T13:36:47.964Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jkohlbach Products: Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More Problem Types: CWE-79 Description: The Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.2.1. This makes it possible for unauthenticated attackers to inject ar
the URL in all versions up to, and including, 2.7.2.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d3c44eb-ef25-43f5-a872-6ef52c3d9c1f?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-exporter/tags/2.7.2.1/includes/settings.php#L195
CVE ID: CVE-2024-8794 State: PUBLISHED Published: 2024-09-24T02:31:01.384Z Last Updated: 2024-09-24T13:44:01.625Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: bookingalgorithms Products: BA Book Everything Problem Types: CWE-620 Description: The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user's identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user's passwords, including administrators. It's important to note that the attacker will not have access to the
set any user's passwords, including administrators. It's important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e261b0e-5ca3-4f5c-acc0-41abee31b148?source=cve - https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.6.20/includes/class-babe-users.php#L266 - https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.6.20/includes/class-babe-my-account.php#L610 - https://plugins.trac.wordpress.org/changeset/3152728/ba-book-everything/trunk/includes/class-babe-users.php
CVE ID: CVE-2024-8795 State: PUBLISHED Published: 2024-09-24T01:56:47.005Z Last Updated: 2024-09-24T13:43:08.237Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: bookingalgorithms Products: BA Book Everything Problem Types: CWE-352 Description: The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the my_account_update() function. This makes it possible for unauthenticated attackers to update a user's account details via a forged request granted they can trick a site administrator into performing an action such as clicking on
details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to reset a user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b691560e-e285-467c-9d52-1620c63de1f0?source=cve - https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.6.20/includes/class-babe-users.php#L203 - https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.6.20/includes/class-babe-my-account.php#L562 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3152728%
ass-babe-my-account.php#L562 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3152728%40ba-book-everything&new=3152728%40ba-book-everything&sfp_email=&sfph_mail=#file3
CVE ID: CVE-2024-8796 State: PUBLISHED Published: 2024-09-17T17:12:13.468Z Last Updated: 2024-09-20T19:43:21.263Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: devise-two-factor Products: devise-two-factor Problem Types: CWE-331 Description: Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
tacker to guess the shared secret and generate valid TOTP codes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-qjxf-mc72-wjr2
CVE ID: CVE-2024-8797 State: PUBLISHED Published: 2024-09-14T05:40:42.659Z Last Updated: 2024-09-15T19:57:06.184Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: murgroland Products: WP Booking System – Booking Calendar Problem Types: CWE-79 Description: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing a
attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1bea55b5-b2d7-4eaf-8868-d2645ce18619?source=cve - https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.0.19.10/includes/modules/update-checker/views/view-register-website.php#L21 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3150487%40wp-booking-system&new=3150487%40wp-booking-system&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8798 State: PUBLISHED Published: 2024-12-15T23:23:31.173Z Last Updated: 2025-09-17T05:27:44.819Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-122, CWE-787 Description: No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r7pm-f93f-f7fp
CVE ID: CVE-2024-8799 State: PUBLISHED Published: 2024-10-01T08:30:14.413Z Last Updated: 2024-10-01T13:49:21.174Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ghuger Products: Custom Banners Problem Types: CWE-79 Description: The Custom Banners plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA AD
can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49618d9f-e6d8-40d5-b19f-7ce987939172?source=cve - https://plugins.trac.wordpress.org/browser/custom-banners/trunk/include/tgmpa/init.php#L96