Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e7bd708-2e82-4fef-85f2-bf4f56f66bc4?source=cve - https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/blocks/init
82-4fef-85f2-bf4f56f66bc4?source=cve - https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/blocks/init.php#L127 - https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/blocks/init.php#L132 - https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/blocks/init.php#L70 - https://plugins.trac.wordpress.org/changeset/3107152/simply-gallery-block/trunk/blocks/init.php - https://wordpress.org/plugins/simply-gallery-block/#developers
CVE ID: CVE-2024-5425 State: PUBLISHED Published: 2024-06-07T03:21:57.042Z Last Updated: 2024-08-01T21:11:12.787Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pandaboxwp Products: WP jQuery Lightbox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts
makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3439710-1159-4677-93c9-14bacfbf0b55?source=cve - https://plugins.trac.wordpress.org/browser/wp-jquery-lightbox/trunk/jquery.lightbox.js - https://github.com/lokesh/lightbox2/blob/dev/src/js/lightbox.js#L57 - https://plugins.trac.wordpress.org/changeset/3097604/#file8 - https://wordpress.org/plugins/wp-jquery-lightbox/#developers
CVE ID: CVE-2024-5426 State: PUBLISHED Published: 2024-06-07T09:33:35.276Z Last Updated: 2024-08-01T21:11:12.711Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: 10web Products: Photo Gallery by 10Web – Mobile-Friendly Image Gallery Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to injec
due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Photo Gallery can be extended to contributors on pro versions of the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13436238-f14a-445b-9a9b-fbcf23b7b498?source=cve - https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/filemanager/UploadHandler.php#L521 - https://plugins.
e - https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/filemanager/UploadHandler.php#L521 - https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/filemanager/UploadHandler.php#L542 - https://plugins.trac.wordpress.org/changeset/3098798/
CVE ID: CVE-2024-5427 State: PUBLISHED Published: 2024-05-31T06:40:54.597Z Last Updated: 2024-08-01T21:11:12.719Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themewinter Products: WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Reservation Form shortcode in all versions up to, and including, 2.2.24 due to insufficient i
Scripting via the plugin's Reservation Form shortcode in all versions up to, and including, 2.2.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/336e2429-97ab-4948-9d21-f0121216d2d1?source=cve - https://plugins.trac.wordpress.org/browser/wp-cafe/trunk/core/shortcodes/views/reservation/reservation-form-template.php
https://plugins.trac.wordpress.org/browser/wp-cafe/trunk/core/shortcodes/views/reservation/reservation-form-template.php#L22 - https://wordpress.org/plugins/wp-cafe/#description - https://plugins.trac.wordpress.org/changeset/3095135/#file8
CVE ID: CVE-2024-5428 State: PUBLISHED Published: 2024-05-28T13:31:03.731Z Last Updated: 2024-08-01T21:11:12.741Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Simple Online Bidding System Problem Types: CWE-352 Description: A vulnerability classified as problematic was found in SourceCodester Simple Online Bidding System 1.0. Affected by this vulnerability is the function save_product of the file /admin/index.php?page=manage_product of the component HTTP POST Request Handler. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-266383. Additional Analyst Notes:
tack can be launched remotely. The associated identifier of this vulnerability is VDB-266383. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.266383 - https://vuldb.com/?ctiid.266383 - https://vuldb.com/?submit.345072 - https://github.com/kaikai145154/CVE-CSRF/blob/main/SourceCodester%20Simple%20Online%20Bidding%20System%20CSRF.md
CVE ID: CVE-2024-5429 State: PUBLISHED Published: 2024-10-17T06:00:04.449Z Last Updated: 2024-10-17T18:32:41.143Z Vendors: Unknown Products: Logo Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ddb76c88-aeca-42df-830e-abffd29f1141/
CVE ID: CVE-2024-5430 State: PUBLISHED Published: 2024-06-26T23:30:50.436Z Last Updated: 2024-08-29T15:04:59.442Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-284 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/464017 - https://hackerone.com/reports/
E Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/464017 - https://hackerone.com/reports/2520947
CVE ID: CVE-2024-5431 State: PUBLISHED Published: 2024-06-25T05:41:46.543Z Last Updated: 2024-08-01T21:11:12.783Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themewinter Products: WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.25 via the reservation_extra_field shortcode parameter. Th
ocal File Inclusion in all versions up to, and including, 2.2.25 via the reservation_extra_field shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include remote files on the server, potentially resulting in code execution Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c5e7ed1-7eb8-4ce7-9dd6-0f7937b6f671?source=cve - https://plugins.trac.wordpress.org/browser/wp-cafe/tags/2.2.25/core/shortcodes/views/reservation/reservation-form-template.php#L178
CVE ID: CVE-2024-5432 State: PUBLISHED Published: 2024-06-20T02:08:20.958Z Last Updated: 2024-08-01T21:11:12.719Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: webinnane Products: Lifeline Donation Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to insufficient verification on the user being supplied during the checkout through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have acce
le for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e24da0c-13d2-4a3d-b918-0d28e3341d88?source=cve - https://plugins.trac.wordpress.org/browser/lifeline-donation/trunk/includes/class-lifeline-donation.php?rev=2575844#L292 - https://plugins.trac.wordpress.org/browser/lifeline-donation/trunk/vendor/webinane/webinane-commerce/includes/Classes/Checkout.php?rev=2490935#L125
CVE ID: CVE-2024-5433 State: PUBLISHED Published: 2024-05-28T18:39:48.285Z Last Updated: 2024-08-01T21:11:12.744Z Vendors: Campbell Scientific Products: CSI Web Server and RTMC Problem Types: CWE-22 Description: The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
ide of the webserver root directory they should be restricted to. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01
CVE ID: CVE-2024-5434 State: PUBLISHED Published: 2024-05-28T18:43:07.150Z Last Updated: 2024-08-01T21:11:12.752Z Vendors: Campbell Scientific Products: CSI Web Server and RTMC Problem Types: CWE-261 Description: The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.go
in access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01
CVE ID: CVE-2024-5435 State: PUBLISHED Published: 2024-09-12T16:56:58.445Z Last Updated: 2024-09-13T14:17:35.209Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-209 Description: An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/464044 - https://hackerone.com/repo
- CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/464044 - https://hackerone.com/reports/2520722
CVE ID: CVE-2024-5436 State: PUBLISHED Published: 2024-05-31T08:11:34.578Z Last Updated: 2024-08-01T21:11:12.695Z Vendors: Snap Products: Snapchat Lenscore Problem Types: CWE-704 Description: Type confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/snapchat
CVE ID: CVE-2024-5437 State: PUBLISHED Published: 2024-05-28T23:31:03.887Z Last Updated: 2024-08-01T21:11:12.768Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Simple Online Bidding System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as problematic. Affected is the function save_category of the file /admin/index.php?page=categories. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266442 is the identifier assigned to this vulnerability
he exploit has been disclosed to the public and may be used. VDB-266442 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.266442 - https://vuldb.com/?ctiid.266442 - https://vuldb.com/?submit.345066 - https://github.com/pijiawei/CVE/blob/pijiawei-photo/SourceCodester%20Simple%20Online%20Bidding%20System%20XSS.md
CVE ID: CVE-2024-5438 State: PUBLISHED Published: 2024-06-07T12:33:42.892Z Last Updated: 2024-08-01T21:11:12.745Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to del
user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/00ec14d4-d97b-40b1-b61b-05e911f49bb0?source=cve - https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Quiz.php#L1806 - https://plugins.trac.wordpress.org/changeset/3098465/
CVE ID: CVE-2024-5439 State: PUBLISHED Published: 2024-06-05T07:34:56.901Z Last Updated: 2024-08-01T21:11:12.743Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: creativethemeshq Products: Blocksy Problem Types: CWE-20 Improper Input Validation Description: The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a l
eb scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c05687f4-5ea2-4226-982f-c3499f204685?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=229705%40blocksy%2F2.0.51&old=228990%40blocksy%2F2.0.50
CVE ID: CVE-2024-5440 State: PUBLISHED Published: 2025-05-15T20:07:06.056Z Last Updated: 2025-05-20T19:25:19.295Z Vendors: Unknown Products: If-So Dynamic Content Personalization Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/52fdc271-96f2-4e25-9df2-29a3ce06328c/
CVE ID: CVE-2024-5441 State: PUBLISHED Published: 2024-07-09T05:34:17.609Z Last Updated: 2024-08-01T21:11:12.734Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Webnus, webnus/ Products: Modern Events Calendar, Modern Events Calendar Lite Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's serv
ble for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0c007090-9d9b-4ee7-8f77-91abd4373051?source=cve - https://webnus.net/modern-events-calendar/
CVE ID: CVE-2024-5442 State: PUBLISHED Published: 2024-07-13T06:00:11.530Z Last Updated: 2024-08-01T21:11:12.789Z Vendors: Unknown Products: Photo Gallery, Sliders, Proofing and Themes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4f1fa417-f760-4132
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4f1fa417-f760-4132-95c2-a38d0b631263/
CVE ID: CVE-2024-5443 State: PUBLISHED Published: 2024-06-22T16:12:32.499Z Last Updated: 2024-08-01T21:11:12.805Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-29 Description: CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerability arises from the `/mount_extension` endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. This is facilitated by the `data.category` and `data.folder` parameters accepting empty strings (`""`), which, due to inadeq
is facilitated by the `data.category` and `data.folder` parameters accepting empty strings (`""`), which, due to inadequate input sanitization, can lead to the construction of a `package_path` that points to the root directory. Consequently, if an attacker can create a `config.yaml` file in a controllable path, this path can be appended to the `extensions` list and trigger the execution of `__init__.py` in the current directory, leading to remote code execution. The vulnerability affects versions up to 5.9.0, and has been addressed in version 9.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/db52848a-4dbe-4110-a981-0373
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/db52848a-4dbe-4110-a981-03739834bf45 - https://github.com/parisneo/lollms/commit/2d0c4e76be93195836ecd0948027e791b8a2626f
CVE ID: CVE-2024-5444 State: PUBLISHED Published: 2024-07-11T06:00:03.516Z Last Updated: 2024-08-01T21:11:12.795Z Vendors: Unknown Products: Bible Text Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/21eddf64-c71e-4aba-b1e9-fe67b4ddfb30/
CVE ID: CVE-2024-5445 State: PUBLISHED Published: 2024-08-08T22:04:11.534Z Last Updated: 2025-01-07T19:48:40.594Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: N-able Products: Ecosystem Agent Problem Types: CWE-295 Description: Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.n-able.com/s/article/How-to-check-Ecosystem-Agent-version-in-N-central
- CISA ADP Vulnrichment: References: - https://me.n-able.com/s/article/How-to-check-Ecosystem-Agent-version-in-N-central - https://me.n-able.com/s/article/How-to-check-Ecosystem-Agent-Version-in-N-sight - https://me.n-able.com/s/security-advisory/aArVy0000000BhpKAE/cve20245445-ecosystem-agent-insufficient-transport-layer-security
CVE ID: CVE-2024-5447 State: PUBLISHED Published: 2024-06-21T06:00:06.279Z Last Updated: 2024-08-01T21:11:12.768Z Vendors: Unknown Products: PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpsca