Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6712 State: PUBLISHED Published: 2025-05-15T20:07:09.350Z Last Updated: 2025-05-20T19:23:39.551Z Vendors: Unknown Products: MapFig Studio Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0346b62c-a856-4554-a24a-ef2c2943bda9/
CVE ID: CVE-2024-6713 State: PUBLISHED Published: 2025-05-15T20:07:09.539Z Last Updated: 2025-05-20T19:23:31.210Z Vendors: Unknown Products: PVN Auth Popup Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/24685b19-0a44-411a-9e1b-d4d0627d7cb6/
CVE ID: CVE-2024-6714 State: PUBLISHED Published: 2024-07-23T15:46:58.102Z Last Updated: 2024-08-01T21:41:04.325Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Canonical Ltd. Products: Ubuntu Desktop Provision Problem Types: CWE-73 Description: An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/canonical/ubuntu-desktop-provision/commit/8d9086de0f82894ff27a9e429ff4f45231020092 - https://bugs.launchpad.net/ubuntu/+source/provd/+bug/2071574 - https://www.cve.org/CVERecord
ff27a9e429ff4f45231020092 - https://bugs.launchpad.net/ubuntu/+source/provd/+bug/2071574 - https://www.cve.org/CVERecord?id=CVE-2024-6714
CVE ID: CVE-2024-6715 State: PUBLISHED Published: 2024-08-23T06:00:04.204Z Last Updated: 2024-08-26T14:12:50.015Z Vendors: Unknown Products: Ditty Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/19406acc-3441-4d4a-9163-ace8f1dceb78/
CVE ID: CVE-2024-6716 State: REJECTED Published: 2024-07-15T14:43:52.638Z Last Updated: 2024-09-04T13:58:43.119Z Description: No description available.
CVE ID: CVE-2024-6717 State: PUBLISHED Published: 2024-07-23T00:16:20.955Z Last Updated: 2024-08-01T21:41:04.313Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-610 Description: HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-15-nomad-vulnerable-to-allocation-directory-path-es
Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-15-nomad-vulnerable-to-allocation-directory-path-escape-through-archive-unpacking/68781
CVE ID: CVE-2024-6718 State: PUBLISHED Published: 2025-05-15T20:07:09.756Z Last Updated: 2025-05-20T19:24:33.942Z Vendors: Unknown Products: PVN Auth Popup Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7d28ea72-8c3b-4607-b877-7b10d954fef9/
CVE ID: CVE-2024-6719 State: PUBLISHED Published: 2025-05-15T20:07:09.955Z Last Updated: 2025-05-20T19:21:20.456Z Vendors: Unknown Products: Offload Videos Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1dc7caac-a36e-4313-a8be-c6b13e564924/
CVE ID: CVE-2024-6720 State: PUBLISHED Published: 2024-08-06T15:28:44.640Z Last Updated: 2024-10-28T19:51:09.560Z Vendors: Unknown Products: Light Poll Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d1449be1-ae85-46f4-b5ba-390d25b87723/
CVE ID: CVE-2024-6721 State: REJECTED Published: N/A Last Updated: 2024-07-15T15:33:38.228Z Description: No description available.
CVE ID: CVE-2024-6722 State: PUBLISHED Published: 2024-09-04T06:00:03.453Z Last Updated: 2024-09-04T14:34:46.111Z Vendors: Unknown Products: Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c
in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ce909d3c-2ef2-4167-87c4-75b5effb2a4d/
CVE ID: CVE-2024-6723 State: PUBLISHED Published: 2024-09-13T06:00:02.961Z Last Updated: 2024-09-13T15:30:32.161Z Vendors: Unknown Products: AI Engine Problem Types: CWE-89 SQL Injection Description: The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fbd2152e-0aa1-4b56-a6a3-2e6ec78e08a5/
CVE ID: CVE-2024-6724 State: PUBLISHED Published: 2024-08-13T06:00:02.297Z Last Updated: 2024-08-13T14:26:06.464Z Vendors: Unknown Products: Generate Images Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Generate Images WordPress plugin before 5.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0cb3158a-263d-4c4a-8029-62b453c281cb/
CVE ID: CVE-2024-6725 State: PUBLISHED Published: 2024-07-31T10:59:17.745Z Last Updated: 2024-08-01T14:54:49.524Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: strategy11team Products: Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Problem Types: CWE-79 Description: The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in all versions up to, and including, 6.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated a
including, 6.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with form editing permissions and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/848cfa72-4211-4576-91c2-4f643e3161c3?source=cve - https://plugins.trac.wordpress.org/browser/formidable/trunk/classes/models/fields/FrmFieldType.php#L875 - https://plugins.trac.wordpress.org/changeset/3128202/
CVE ID: CVE-2024-6726 State: PUBLISHED Published: 2024-07-29T17:27:19.180Z Last Updated: 2024-08-01T21:41:04.586Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delphix Products: Delphix Engine Problem Types: CWE-94 Description: Versions of Delphix Engine prior to Release 25.0.0.0 contain a flaw which results in Remote Code Execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.perforce.com/s/detail/a91PA000001SUDtYAO
CVE ID: CVE-2024-6727 State: PUBLISHED Published: 2024-07-29T17:52:29.064Z Last Updated: 2024-08-01T21:41:04.600Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Delphix Products: Data Control Tower (DCT) Problem Types: CWE-284 Description: A flaw in versions of Delphix Data Control Tower (DCT) prior to 19.0.0 results in broken authentication through the enable-scale-testing functionality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.perforce.com/s/detail/a91PA000001SUFVYA4
CVE ID: CVE-2024-6728 State: PUBLISHED Published: 2024-07-14T00:31:04.366Z Last Updated: 2024-08-01T21:41:04.555Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file typeedit.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271401 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vuln
and may be used. The identifier VDB-271401 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271401 - https://vuldb.com/?ctiid.271401 - https://vuldb.com/?submit.372856 - https://github.com/jeery0/cve/issues/1
CVE ID: CVE-2024-6729 State: PUBLISHED Published: 2024-07-14T01:00:08.304Z Last Updated: 2024-08-26T04:53:10.595Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /control/add_act.php. The manipulation of the argument aname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: -
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271402 - https://vuldb.com/?ctiid.271402 - https://vuldb.com/?submit.373488 - https://reports.kunull.net/CVEs/2024/CVE-2024-6729 - https://www.sourcecodester.com/
CVE ID: CVE-2024-6730 State: PUBLISHED Published: 2024-07-14T01:31:04.360Z Last Updated: 2024-08-01T21:41:04.537Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Nanjing Xingyuantu Technology Products: SparkShop Problem Types: CWE-434 Description: A vulnerability was found in Nanjing Xingyuantu Technology SparkShop up to 1.1.6. It has been rated as critical. This issue affects some unknown processing of the file /api/Common/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271403. Additional Analy
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271403. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271403 - https://vuldb.com/?ctiid.271403 - https://vuldb.com/?submit.374047 - https://github.com/J1rrY-learn/learn/blob/main/sparkshop_upload.md
CVE ID: CVE-2024-6731 State: PUBLISHED Published: 2024-07-14T22:00:05.570Z Last Updated: 2024-08-26T04:53:08.746Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Student Study Center Desk Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. This affects an unknown part of the file /Master.php?f=save_student. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Prog
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271449 - https://vuldb.com/?ctiid.271449 - https://vuldb.com/?submit.374362 - https://reports.kunull.net/CVEs/2024/CVE-2024-6731 - https://www.sourcecodester.com/
CVE ID: CVE-2024-6732 State: PUBLISHED Published: 2024-07-14T22:31:03.538Z Last Updated: 2024-08-26T04:53:06.651Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Student Study Center Desk Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. This vulnerability affects unknown code of the file /sscdms/classes/Users.php?f=save. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pr
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271450 - https://vuldb.com/?ctiid.271450 - https://vuldb.com/?submit.374370 - https://reports.kunull.net/CVEs/2024/CVE-2024-6732 - https://www.sourcecodester.com/
CVE ID: CVE-2024-6733 State: PUBLISHED Published: 2024-07-14T23:00:05.330Z Last Updated: 2024-08-01T21:41:04.607Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file templateedit.php. The manipulation of the argument id/title/msg leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-271454 is the identifier assigned to this vulnerability. Additional Analyst Notes
sed to the public and may be used. VDB-271454 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271454 - https://vuldb.com/?ctiid.271454 - https://vuldb.com/?submit.374463 - https://github.com/jiaoyanshuai/cve/issues/1
CVE ID: CVE-2024-6734 State: PUBLISHED Published: 2024-07-14T23:31:03.700Z Last Updated: 2024-08-01T21:41:04.575Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file templateadd.php. The manipulation of the argument title/msg leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271455. Additional Analyst Notes: - CI
he public and may be used. The associated identifier of this vulnerability is VDB-271455. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271455 - https://vuldb.com/?ctiid.271455 - https://vuldb.com/?submit.374464 - https://github.com/jiaoyanshuai/cve/issues/2
CVE ID: CVE-2024-6735 State: PUBLISHED Published: 2024-07-15T00:00:05.643Z Last Updated: 2024-08-01T21:41:04.576Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file setgeneral.php. The manipulation of the argument sitename/email/mobile/sms/currency leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271456. Additional Analyst
has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271456. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271456 - https://vuldb.com/?ctiid.271456 - https://vuldb.com/?submit.374516 - https://github.com/xzyxiaohaha/cve/issues/1
CVE ID: CVE-2024-6736 State: PUBLISHED Published: 2024-07-15T00:31:04.234Z Last Updated: 2024-08-01T21:41:04.579Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee and Visitor Gate Pass Logging System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown processing of the file view_employee.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271457 was assigned to this vulnerabilit
he exploit has been disclosed to the public and may be used. The identifier VDB-271457 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271457 - https://vuldb.com/?ctiid.271457 - https://vuldb.com/?submit.374485 - https://github.com/ljllll123/cve/blob/main/sql.md
CVE ID: CVE-2024-6737 State: PUBLISHED Published: 2024-07-15T02:23:06.055Z Last Updated: 2024-08-01T21:41:04.596Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: 2100 TECHNOLOGY Products: Electronic Official Document Management System Problem Types: CWE-284 Description: The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regular privileges to access the account settings functionality and create an administrator account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7923-46df3-1.htm
es: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7923-46df3-1.html - https://www.twcert.org.tw/en/cp-139-7924-85606-2.html
CVE ID: CVE-2024-6738 State: PUBLISHED Published: 2024-07-15T02:50:39.639Z Last Updated: 2024-08-01T21:41:04.604Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WisdomGarden Products: Tronclass Problem Types: CWE-284 Description: The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html - https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html
CVE ID: CVE-2024-6739 State: PUBLISHED Published: 2024-07-15T03:15:03.815Z Last Updated: 2024-08-01T21:41:04.608Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Openfind Products: MailGates, MailAudit Problem Types: CWE-1004 Description: The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7927-03837-1.html - https://www.twcert.org.tw/en/cp-139-7928-04e8a-2.html - https://www.openfind.com.tw/taiwan/download/Openf
03837-1.html - https://www.twcert.org.tw/en/cp-139-7928-04e8a-2.html - https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf
CVE ID: CVE-2024-6740 State: PUBLISHED Published: 2024-07-15T08:00:31.584Z Last Updated: 2024-08-01T21:41:04.575Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Openfind Products: Mail2000 V7.0, Mail2000 V8.0 Problem Types: CWE-79 Description: Openfind's Mail2000 does not properly validate email atachments, allowing unauthenticated remote attackers to inject JavaScript code within the attachment and perform Stored Cross-site scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7938-d9c97-1.html - https://www.twcert.org.tw/en/cp-139-7939-3423f-2.html - https://www.ope
/www.twcert.org.tw/tw/cp-132-7938-d9c97-1.html - https://www.twcert.org.tw/en/cp-139-7939-3423f-2.html - https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf
CVE ID: CVE-2024-6741 State: PUBLISHED Published: 2024-07-15T08:26:32.252Z Last Updated: 2024-08-01T21:41:04.558Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Openfind Products: Mail2000 V7.0, Mail2000 V8.0 Problem Types: CWE-693 Description: Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7940-0177a-1.html - https://www.twcert.org.tw/en/cp-
rogram Container: References: - https://www.twcert.org.tw/tw/cp-132-7940-0177a-1.html - https://www.twcert.org.tw/en/cp-139-7941-b66e7-2.html - https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf
CVE ID: CVE-2024-6742 State: PUBLISHED Published: 2024-07-15T05:55:32.052Z Last Updated: 2024-08-01T21:41:04.583Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: AguardNet Products: Space Management System Problem Types: CWE-79 Description: AguardNet Technology's Space Management System does not properly filter user input, allowing remote attackers with regular privileges to inject JavaScript and perform Reflected Cross-site scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7930-e0368-1.html - https://www.twcert.org.tw/en/cp-139-7931-608eb-2.html