Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11168 State: PUBLISHED Published: 2024-11-12T21:22:23.438Z Last Updated: 2025-11-03T21:51:45.721Z Vendors: Python Software Foundation Products: CPython Description: The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5 - https://github.com/python/cpython/pull/103849 - https://github.com/python/
it/29f348e232e82938ba2165843c448c2b291504c5 - https://github.com/python/cpython/pull/103849 - https://github.com/python/cpython/issues/103848 - https://mail.python.org/archives/list/security-announce@python.org/thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/ - https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a550 - https://github.com/python/cpython/commit/634ded45545ce8cbd6fd5d49785613dd7fa9b89e - https://github.com/python/cpython/commit/ddca2953191c67a12b1f19d6bca41016c6ae7132
CVE ID: CVE-2024-11169 State: PUBLISHED Published: 2025-03-20T10:09:59.233Z Last Updated: 2025-03-20T18:32:06.181Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-115 Description: An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the server to crash. The vulnerability is fixed in version 0.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/
erability is fixed in version 0.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/754e1649-5612-4ba9-a533-06b46de5c4b5 - https://github.com/danny-avila/librechat/commit/629be5c0ca2b332178524b4e3f6fac715aea8cc4
CVE ID: CVE-2024-11170 State: PUBLISHED Published: 2025-03-20T10:08:59.584Z Last Updated: 2025-03-20T18:59:47.731Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-29 Description: A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/b64156c2-5380-4d4d-af30-b2938dcdd46e - https://github.com/danny-
Vulnrichment: References: - https://huntr.com/bounties/b64156c2-5380-4d4d-af30-b2938dcdd46e - https://github.com/danny-avila/librechat/commit/629be5c0ca2b332178524b4e3f6fac715aea8cc4
CVE ID: CVE-2024-11171 State: PUBLISHED Published: 2025-03-20T10:10:18.684Z Last Updated: 2025-10-15T12:49:28.195Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-770 Description: In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage (the default setting for multer), there is no limit on the upload file size. This can lead to a server crash due to out-of-memory errors when handling large files. An attacker without any privileges can exploit this vulne
r crash due to out-of-memory errors when handling large files. An attacker without any privileges can exploit this vulnerability to cause a complete denial of service. The issue is fixed in version 0.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/91717a5a-d653-4e35-b186-9e8d00aa4285 - https://github.com/danny-avila/librechat/commit/bb58a2d0662ef86dc75a9d2f6560125c018e3836
CVE ID: CVE-2024-11172 State: PUBLISHED Published: 2025-03-20T10:10:06.689Z Last Updated: 2025-10-15T12:49:28.544Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-248 Description: A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c
is fixed in version 0.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c76a7ee3-2e26-45a0-8940-21c749592105 - https://github.com/danny-avila/librechat/commit/976784c01fa4cce00d4c2941801d56aed375c21b
CVE ID: CVE-2024-11173 State: PUBLISHED Published: 2025-03-20T10:10:33.944Z Last Updated: 2025-03-20T18:19:53.277Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-248 Description: An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. Although a valid JWT is required to exploit this vulnerability, LibreChat allows open registration, enabling unauthenticated attackers to create an account and perf
this vulnerability, LibreChat allows open registration, enabling unauthenticated attackers to create an account and perform the attack. The issue is fixed in version 0.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4cebf926-c17f-4836-868b-e1de86221cec - https://github.com/danny-avila/librechat/commit/95a212534f1c5991bd1231a34ac3668b4b592cc3
CVE ID: CVE-2024-11175 State: PUBLISHED Published: 2024-11-13T15:31:26.613Z Last Updated: 2024-11-13T18:27:34.447Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Public Products: CMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue. Additi
he patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284351 - https://vuldb.com/?ctiid.284351 - https://gitee.com/sanluan/PublicCMS/issues/IB2BUV - https://gitee.com/sanluan/PublicCMS/commit/b9530b9cc1f5cfdad4b637874f59029a6283a65c
CVE ID: CVE-2024-11176 State: PUBLISHED Published: 2024-11-20T08:33:45.983Z Last Updated: 2025-08-21T10:11:39.156Z Vendors: M-Files Corporation Products: M-Files Aino Problem Types: CWE-863, CWE-732 Description: Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/CVE-2024-11176
CVE ID: CVE-2024-11177 State: REJECTED Published: N/A Last Updated: 2024-11-26T16:22:53.335Z Description: No description available.
CVE ID: CVE-2024-11178 State: PUBLISHED Published: 2024-12-06T06:48:22.861Z Last Updated: 2024-12-09T14:51:36.034Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: india-web-developer Products: Login With OTP Problem Types: CWE-288 Description: The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attackers to generate and brute force the 6-digit numeric OTP that makes it possible to log in as any existing user on the site, such as an administrator, if they have acce
meric OTP that makes it possible to log in as any existing user on the site, such as an administrator, if they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3775d48-5985-475e-8fb9-c4c5fd044772?source=cve - https://plugins.trac.wordpress.org/browser/otp-login/tags/1.4.2/lib/otpl-class.php#L293 - https://plugins.trac.wordpress.org/browser/otp-login/tags/1.4.2/lib/otpl-class.php#L317
CVE ID: CVE-2024-11179 State: PUBLISHED Published: 2024-11-20T09:31:54.943Z Last Updated: 2024-11-20T15:17:03.909Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: inspireui Products: MStore API – Create Native Android & iOS Apps On The Cloud Problem Types: CWE-89 Description: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level a
cient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b308bddf-a153-4d5b-936f-2170a1a494a5?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.15.5/controllers/helpers/vendor-admin-wcfm-helper.php#L803 - https://plugins.trac.wordpress.org/changeset/3190678/mstore-api/trunk/controllers/helpers/vendor-admin-wcfm-helper.php
CVE ID: CVE-2024-11180 State: PUBLISHED Published: 2025-03-29T07:23:45.196Z Last Updated: 2025-03-31T14:30:07.050Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor Addons and Templates Problem Types: CWE-79 Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_countdown_timer_title parameter in all versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in page
t possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35969379-e668-4045-8de7-696f196ba5b0?source=cve - https://plugins.trac.wordpress.org/changeset/3190501/elementskit-lite/trunk/widgets/countdown-timer/countdown-timer.php - https://plugins.trac.wordpress.org/changeset/3262976/elementskit-lite/trunk/widgets/init/assets/js/elementor.js
CVE ID: CVE-2024-11181 State: PUBLISHED Published: 2024-12-12T06:46:32.559Z Last Updated: 2024-12-12T14:40:45.586Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wpsoul Products: Greenshift – animation and page builder blocks Problem Types: CWE-639 Description: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wp_reusable_render' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private,
for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/06047667-2a24-4e1c-9389-11daceff4d23?source=cve - https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/settings.php#L43 - https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/settings.php#L1236 - https://plugins.trac.wordpress.org/changeset/3203829/greenshift-animation-and-page-builder-blocks/trunk/settings.php
CVE ID: CVE-2024-11182 State: PUBLISHED Published: 2024-11-15T10:43:10.960Z Last Updated: 2025-10-21T22:55:36.394Z Vendors: MDaemon Products: Email Server Problem Types: CWE-79 Description: An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html
CVE ID: CVE-2024-11183 State: PUBLISHED Published: 2024-12-07T06:00:04.979Z Last Updated: 2024-12-09T16:20:38.394Z Vendors: Unknown Products: Simple Side Tab Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ff3f2788-d1a1-4a62-a247-39a931308f51/
CVE ID: CVE-2024-11184 State: PUBLISHED Published: 2025-01-02T06:00:04.587Z Last Updated: 2025-01-06T20:30:08.869Z Vendors: Unknown Products: wp-enable-svg Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8/
CVE ID: CVE-2024-11185 State: PUBLISHED Published: 2025-05-27T22:11:30.325Z Last Updated: 2025-05-28T13:34:52.088Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Arista Networks Products: EOS Problem Types: cwe-1189 Description: On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with different VLANs, resulting in a breach of VLAN isolation and segmentation boundaries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.arista.com/en/support/advisories-notices/security-advisory/21411-security-advisory-0118
CVE ID: CVE-2024-11186 State: PUBLISHED Published: 2025-05-08T18:47:52.859Z Last Updated: 2025-05-08T19:01:23.429Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Arista Networks Products: CloudVision Portal Problem Types: CWE-287 Description: On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-premise. It does not impact CloudVision as-a-Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notic
ice. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/21314-security-advisory-0114
CVE ID: CVE-2024-11187 State: PUBLISHED Published: 2025-01-29T21:40:11.942Z Last Updated: 2025-02-11T19:02:32.914Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: CWE-405 Description: It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure. This issue affects BIND 9 versions 9.11.0 through
ually need to have been deliberately crafted to attack this exposure. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2024-11187
CVE ID: CVE-2024-11188 State: PUBLISHED Published: 2024-11-23T05:40:11.211Z Last Updated: 2024-11-23T13:18:20.399Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: strategy11team Products: Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Problem Types: CWE-79 Description: The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Reflected Cross-Site Scripting via the Custom HTML Form parameters in all versions up to, and including, 6.16.1.2 due to insufficient input sanitization and output escaping. This makes it
n all versions up to, and including, 6.16.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/da84aa80-7ef6-4846-870d-07bf88652329?source=cve - https://plugins.trac.wordpress.org/browser/formidable/tags/6.16/classes/helpers/FrmFieldsHelper.php#L158
CVE ID: CVE-2024-11189 State: PUBLISHED Published: 2025-05-15T20:06:47.896Z Last Updated: 2025-05-20T19:36:41.529Z Vendors: Unknown Products: Social Share And Social Locker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f3d1473a-6d25-447d-af27-f315323fdd62/
CVE ID: CVE-2024-11190 State: PUBLISHED Published: 2025-05-15T20:06:48.117Z Last Updated: 2025-05-20T19:36:31.023Z Vendors: Unknown Products: jwp-a11y Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/66b914ba-4253-4849-a38a-05ab246a9a32/
CVE ID: CVE-2024-11191 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:11.319Z Description: No description available.
CVE ID: CVE-2024-11192 State: PUBLISHED Published: 2024-11-26T08:31:54.439Z Last Updated: 2024-11-26T14:09:24.138Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jonkastonka Products: Sp*tify Play Button for WordPress Problem Types: CWE-79 Description: The Spotify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spotifyplaybutton shortcode in all versions up to, and including, 2.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in page
t possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a52e43dd-46b4-445b-b350-a2fd76315869?source=cve - https://plugins.trac.wordpress.org/browser/spotify-play-button-for-wordpress/tags/2.11/sptify-play-button-for-wordpress.php#L147 - https://plugins.trac.wordpress.org/browser/spotify-play-button-for-wordpress/tags/2.11/sptify-play-button-for-wordpress.php#L137 - https://wordpress.org/plugins/spotify-play-button-for-wordpress/#developers - http
-play-button-for-wordpress.php#L137 - https://wordpress.org/plugins/spotify-play-button-for-wordpress/#developers - https://plugins.trac.wordpress.org/changeset?old_path=%2Fspotify-play-button-for-wordpress&old=3189556&new_path=%2Fspotify-play-button-for-wordpress&new=3191339&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11193 State: PUBLISHED Published: 2024-11-13T21:04:12.910Z Last Updated: 2024-11-14T14:54:38.382Z Vendors: YugabyteDB Products: YugabyteDB Anywhere Problem Types: CWE-532 Description: An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw results in the unintentional exposure of sensitive information in Yugabyte Anywhere logs, potentially allowing unauthorized users with access to these logs to view the LDAP bind password. An attacker with log access could exploit this vulnerability to gain unauthorized access to the LDAP server, leading to potential exposure or compromise of
xploit this vulnerability to gain unauthorized access to the LDAP server, leading to potential exposure or compromise of LDAP-managed resources This issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yugabyte/yugabyte-db/commit/0bf6e5a3e9c0718a28e654483596615d0798b208
CVE ID: CVE-2024-11194 State: PUBLISHED Published: 2024-11-19T11:32:12.120Z Last Updated: 2024-11-19T14:21:22.650Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: techlabpro1 Products: Classified Listing – Classified ads & Business Directory Plugin Problem Types: CWE-862 Description: The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and abov