Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8885 State: PUBLISHED Published: 2024-10-02T12:25:18.831Z Last Updated: 2024-10-02T14:24:29.783Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Intercept X Problem Types: CWE-1104, CWE-502 Description: A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20241002-cde-lpe
CVE ID: CVE-2024-8887 State: PUBLISHED Published: 2024-09-18T11:05:31.015Z Last Updated: 2024-09-18T13:26:55.753Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CIRCUTOR Products: CIRCUTOR Q-SMT Problem Types: CWE-1284 Description: CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/
e device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products
CVE ID: CVE-2024-8888 State: PUBLISHED Published: 2024-09-18T11:54:47.337Z Last Updated: 2024-09-18T13:14:00.252Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CIRCUTOR Products: CIRCUTOR Q-SMT Problem Types: CWE-613 Description: An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/i
stored web information, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products
CVE ID: CVE-2024-8889 State: PUBLISHED Published: 2024-09-18T12:00:11.071Z Last Updated: 2024-09-18T13:09:03.920Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: CIRCUTOR Products: CIRCUTOR TCP2RS+ Problem Types: CWE-20 Description: Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle. Additional Analyst Notes: - CISA ADP Vulnrichme
isabling its use. This equipment is at the end of its useful life cycle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products
CVE ID: CVE-2024-8890 State: PUBLISHED Published: 2024-09-18T13:03:31.453Z Last Updated: 2024-09-18T14:36:22.074Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: CIRCUTOR Products: CIRCUTOR Q-SMT Problem Types: CWE-201 Description: An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol. This fact prevents a secure communication channel from being established. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerab
t Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products
CVE ID: CVE-2024-8891 State: PUBLISHED Published: 2024-09-18T13:10:01.274Z Last Updated: 2024-09-18T15:28:30.964Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: CIRCUTOR Products: CIRCUTOR Q-SMT Problem Types: CWE-359 Description: An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products
CVE ID: CVE-2024-8892 State: PUBLISHED Published: 2024-09-18T12:54:04.077Z Last Updated: 2024-09-18T14:42:50.191Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: CIRCUTOR Products: CIRCUTOR TCP2RS+ Problem Types: CWE-400 Description: Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle. Additional Analyst Notes: - CISA ADP Vulnrichmen
sabling its use. This equipment is at the end of its useful life cycle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products
CVE ID: CVE-2024-8893 State: PUBLISHED Published: 2025-02-14T16:33:37.348Z Last Updated: 2025-02-14T18:38:48.818Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: GoodWe Technologies Co., Ltd. Products: GW1500‑XS Problem Types: CWE-798 Description: Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi‑Fi.This issue affects GW1500‑XS: 1.1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://os-s.net/publications/advisories/CVE-2024-8893.pdf
CVE ID: CVE-2024-8894 State: PUBLISHED Published: 2024-12-04T11:40:22.411Z Last Updated: 2024-12-04T21:02:00.422Z Vendors: Open Design Alliance Products: ODA Drawings SDK - All Versions < 2025.10 Problem Types: CWE-787 Description: Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing proper checks on received SectionIterator data can trigger an unhandled exception. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opendesign.com/security-
le code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2024-8895 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:34.764Z Description: No description available.
CVE ID: CVE-2024-8896 State: PUBLISHED Published: 2024-10-29T21:43:11.437Z Last Updated: 2025-08-26T18:38:07.811Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, DWG TrueView, RealDWG Problem Types: CWE-908 Description: A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of th
r can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE ID: CVE-2024-8897 State: PUBLISHED Published: 2024-09-17T12:21:22.840Z Last Updated: 2025-03-19T15:32:41.993Z Vendors: Mozilla Products: Firefox for Android Problem Types: Address bar spoofing after server-side redirect Description: Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be able to spoof the address bar contents. This can lead to a malicious site to appear to have the same URL as the trusted site. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 130.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: R
ffected.* This vulnerability affects Firefox for Android < 130.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1862537 - https://www.mozilla.org/security/advisories/mfsa2024-45/
CVE ID: CVE-2024-8898 State: PUBLISHED Published: 2025-03-20T10:10:58.125Z Last Updated: 2025-03-20T16:20:06.356Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-22 Description: A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This vulnerability allows attackers to create or delete directories with arbitrary paths on the system. The issue arises due to insufficient sanitization of user-supplied input, which can be exploited to traverse directories outside the intended path. Additional Analyst Notes: - CISA ADP Vul
nput, which can be exploited to traverse directories outside the intended path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6072371f-0ddc-42e3-9207-1c6d6b18d32f - https://github.com/parisneo/lollms-webui/commit/6d07c8a0dd0a15cc060becc73fda9fe8e788eb23
CVE ID: CVE-2024-8899 State: PUBLISHED Published: 2024-11-26T11:04:30.428Z Last Updated: 2024-11-26T14:09:22.224Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: jegtheme Products: Jeg Elementor Kit Problem Types: CWE-200 Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the render_content function in class/elements/views/class-tabs-view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
ract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4efc9c47-321a-4635-943f-785ffc34d851?source=cve - https://plugins.trac.wordpress.org/changeset/3193980/jeg-elementor-kit
CVE ID: CVE-2024-8900 State: PUBLISHED Published: 2024-09-17T18:14:52.537Z Last Updated: 2025-03-18T20:17:43.168Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Clipboard write permission bypass Description: An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects Firefox < 129, Firefox ESR < 128.3, and Thunderbird < 128.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1872841 - https://www.mozilla.org/security/advisories/mfsa2024-33/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https:
s://www.mozilla.org/security/advisories/mfsa2024-33/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-49/
CVE ID: CVE-2024-8901 State: PUBLISHED Published: 2024-10-21T23:19:31.138Z Last Updated: 2025-10-14T19:01:50.153Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: Amazon Products: AWS ALB Route Directive Adapter For Istio Problem Types: CWE-290 Description: The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer and issuer validation. In deployments of ALB that ignore security best practices, where ALB targets are directly
signer and issuer validation. In deployments of ALB that ignore security best practices, where ALB targets are directly exposed to internet traffic, an actor can provide a JWT signed by an untrusted entity in order to spoof OIDC-federated sessions and successfully bypass authentication. The repository/package has been deprecated, is end of life, and is no longer supported. As a security best practice, ensure that your ELB targets (e.g. EC2 Instances, Fargate Tasks etc.) do not have public IP addresses. Ensure any forked or derivative code validate that the signer attribute in the JWT match the ARN of the Application Load Balancer that the service is configured to use. Additional Analyst Note
in the JWT match the ARN of the Application Load Balancer that the service is configured to use. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2024-011/ - https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/security/advisories/GHSA-789x-wph8-m68r
CVE ID: CVE-2024-8902 State: PUBLISHED Published: 2024-10-12T09:39:16.937Z Last Updated: 2024-10-15T13:21:27.257Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-200 Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_column function in modules/data-table/widgets/data-table.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnr
ss and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7317ecf5-d43d-4080-ad2a-7644764dd41e?source=cve - https://plugins.trac.wordpress.org/changeset/3163899/addon-elements-for-elementor-page-builder
CVE ID: CVE-2024-8903 State: PUBLISHED Published: 2024-09-23T08:57:16.328Z Last Updated: 2024-09-23T15:37:00.561Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Acronis Products: Acronis Cyber Protect Cloud Agent Problem Types: CWE-250 Description: Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows, macOS) before build 38565. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-7510
CVE ID: CVE-2024-8904 State: PUBLISHED Published: 2024-09-17T21:07:18.144Z Last Updated: 2024-09-18T15:41:24.504Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html - https://issues.chromium.org/issues/365376497
CVE ID: CVE-2024-8905 State: PUBLISHED Published: 2024-09-17T21:07:18.768Z Last Updated: 2024-09-18T15:39:29.929Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html - https://issues.chromium.org/issues/359949835
CVE ID: CVE-2024-8906 State: PUBLISHED Published: 2024-09-17T21:07:19.006Z Last Updated: 2025-03-25T16:10:43.942Z Vendors: Google Products: Chrome Problem Types: Incorrect security UI Description: Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html - https://issues.chromium.org/issues/352681108
CVE ID: CVE-2024-8907 State: PUBLISHED Published: 2024-09-17T21:07:19.333Z Last Updated: 2025-03-25T16:10:44.170Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (XSS) via a crafted set of UI gestures. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html - https://issues.chromium.org/issues/360642942
CVE ID: CVE-2024-8908 State: PUBLISHED Published: 2024-09-17T21:07:19.601Z Last Updated: 2025-03-20T21:02:42.763Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html - https://issues.chromium.org/issues/337222641
CVE ID: CVE-2024-8909 State: PUBLISHED Published: 2024-09-17T21:07:19.868Z Last Updated: 2025-03-17T15:52:57.328Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html - https://issues.chromium.org/issues/341353783
CVE ID: CVE-2024-8910 State: PUBLISHED Published: 2024-09-25T06:48:59.659Z Last Updated: 2024-09-25T13:26:21.429Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-1230 Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 via the render function in includes/widgets/htmega_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes:
ibutor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/09fb88e4-4846-40d3-8a79-a6a867bfb59f?source=cve - https://plugins.trac.wordpress.org/changeset/3156058/ht-mega-for-elementor
CVE ID: CVE-2024-8911 State: PUBLISHED Published: 2024-10-08T08:33:18.169Z Last Updated: 2024-10-09T15:49:45.921Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: latepoint Products: LatePoint Plugin Problem Types: CWE-89 Description: The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note that changing a WordPres
cated attackers to change user passwords and potentially take over administrator accounts. Note that changing a WordPress user's password is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. Without this setting enabled, only the passwords of plugin customers, which are stored and managed in a separate database table, can be modified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c9a23a3-5eb5-4f5b-bf32-c9d163426f29?source=cve - https://wpdocs.latepoint.com/changelog/
CVE ID: CVE-2024-8912 State: PUBLISHED Published: 2024-10-11T18:22:50.565Z Last Updated: 2024-10-11T18:32:20.493Z Vendors: Google Products: Looker Problem Types: CWE-444 Description: An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: * Looker (Google Cloud core) was found to be vulnerable. This issue has already been mitigated and our investigation has found no signs of exploitation. * Looker (original) was not vulnerable to this issue. Customer-hosted Looker instances were found to be vulnerable and must be upgraded. This vulnerability has been pa
issue. Customer-hosted Looker instances were found to be vulnerable and must be upgraded. This vulnerability has been patched in all supported versions of customer-hosted Looker, which are available on the Looker download page https://download.looker.com/ . For Looker customer-hosted instances, please update to the latest supported version of Looker as soon as possible. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page: * 23.12 -> 23.12.123+ * 23.18 -> 23.18.117+ * 24.0 -> 24.0.92+ * 24.6 -> 24.6.77+ * 24.8 -> 24.8.66+ * 24.10 -> 24.10.78+ * 24.12 -> 24.12.56+ * 24.14 -> 24.14.37+ Additional Analyst Notes:
-> 24.6.77+ * 24.8 -> 24.8.66+ * 24.10 -> 24.10.78+ * 24.12 -> 24.12.56+ * 24.14 -> 24.14.37+ Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/looker/docs/best-practices/security-bulletin-09-16-24
CVE ID: CVE-2024-8913 State: PUBLISHED Published: 2024-10-11T08:30:45.851Z Last Updated: 2024-10-11T14:44:26.619Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: posimyththemes Products: The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Problem Types: CWE-200 Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.11 via the render function in modules/widgets/tp_accordion.php. This makes it possible for authenticated attackers, with Contributor
ender function in modules/widgets/tp_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/46126f88-416a-4430-8596-12f72cd2c1e7?source=cve - https://plugins.trac.wordpress.org/changeset/3165763/the-plus-addons-for-elementor-page-builder