Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3248327-6e10-420e-83cf-a23296eb2e6f?source=cve - https://plugins.trac.wordpress.org/browser/ali2woo-lite/trunk//includes/classes/controller/WooCommerceProductEditController.php#L108
CVE ID: CVE-2024-2382 State: PUBLISHED Published: 2024-06-04T05:32:14.795Z Last Updated: 2024-08-01T19:11:53.554Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ishanverma Products: Authorize.net Payment Gateway For WooCommerce Problem Types: CWE-345 Insufficient Verification of Data Authenticity Description: The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due to the plugin not properly verifying the authenticity of the request that updates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to
dates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to paid bypassing any payment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab71d24-0409-421b-8abf-f4d5390a32a1?source=cve - https://plugins.trac.wordpress.org/browser/authorizenet-payment-gateway-for-woocommerce/trunk/index.php#L205
CVE ID: CVE-2024-2383 State: PUBLISHED Published: 2024-06-06T18:18:29.911Z Last Updated: 2024-08-01T19:11:53.449Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-1021 Description: A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious page, potentially leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control. Th
y leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control. The issue was addressed in version 0.56.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963 - https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9
CVE ID: CVE-2024-2384 State: PUBLISHED Published: 2024-03-20T02:35:41.744Z Last Updated: 2024-08-01T19:23:33.074Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: kilbot Products: WooCommerce POS Problem Types: CWE-345 Insufficient Verification of Data Authenticity Description: The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not properly verifying the authentication and authorization of the current user This makes it possible for authenticated attackers, with customer-level access and above, to view potentially sensitive information about other users by le
cated attackers, with customer-level access and above, to view potentially sensitive information about other users by leveraging their order id Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b8ba69-aa8b-436f-990c-39e283f5d2f2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3053833%40woocommerce-pos&new=3053833%40woocommerce-pos&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2385 State: PUBLISHED Published: 2024-07-04T03:32:22.764Z Last Updated: 2024-08-01T19:11:53.450Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: livemesh Products: Elementor Addons by Livemesh Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.3.7 via several of the plugin's widgets through the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the se
e for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0aa3ec9b-80d5-4e31-8045-43c8d151cab8?source=cve - https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/8.3.5/includes/helper-functions.php#L726 - https://plugins.trac.wordpress.org/b
ss.org/browser/addons-for-elementor/tags/8.3.5/includes/helper-functions.php#L726 - https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/8.3.5/includes/widgets/heading.php#L267
CVE ID: CVE-2024-2386 State: PUBLISHED Published: 2024-06-29T13:00:05.620Z Last Updated: 2024-08-01T19:11:53.407Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: flippercode Products: WP Maps – Display Google Maps Perfectly with Ease Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query
due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f0deb68-3caf-4ad6-977e-0e954d29e6b7?source=cve - https://plugins.trac.wordpress.org/changeset/3108077/wp-google-map-plugin
CVE ID: CVE-2024-2387 State: PUBLISHED Published: 2024-03-20T01:57:55.902Z Last Updated: 2024-08-02T20:29:12.557Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nasirahmed Products: Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms plugin for WordPress is vulnerable to SQL Injection via the ‘integration_id’ parameter in all versions up to, and including, 1.82.0 due to insufficient
ble to SQL Injection via the ‘integration_id’ parameter in all versions up to, and including, 1.82.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries and subsequently inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45d5a677-9b8b-4258-9cfb-101b0f0e6f6f?source=cve - htt
ences: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45d5a677-9b8b-4258-9cfb-101b0f0e6f6f?source=cve - https://plugins.trac.wordpress.org/browser/advanced-form-integration/trunk/includes/class-adfoin-log-table.php#L275 - https://plugins.trac.wordpress.org/browser/advanced-form-integration/trunk/includes/class-adfoin-log-table.php#L227 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3052201%40advanced-form-integration&new=3052201%40advanced-form-integration&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2388 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:58.749Z Description: No description available.
CVE ID: CVE-2024-2389 State: PUBLISHED Published: 2024-04-02T12:22:45.131Z Last Updated: 2024-08-01T19:11:53.536Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Software Products: Flowmon Problem Types: CWE-78 Description: In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.flowmon.com - https://support.kemptechnologies.com/hc/en-us/
ichment: - CVE Program Container: References: - https://www.flowmon.com - https://support.kemptechnologies.com/hc/en-us/articles/24878235038733-CVE-2024-2389-Flowmon-critical-security-vulnerability
CVE ID: CVE-2024-2390 State: PUBLISHED Published: 2024-03-18T15:37:44.698Z Last Updated: 2024-08-21T14:42:09.885Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Tenable Products: Nessus Agent, Nessus Problem Types: CWE-269 Description: As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem location, and abuse the impacted plugin in order to escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ww
scalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2024-05
CVE ID: CVE-2024-2391 State: PUBLISHED Published: 2024-03-12T10:31:04.813Z Last Updated: 2024-08-01T19:11:53.461Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: EVE-NG Problem Types: CWE-79 Description: A vulnerability was found in EVE-NG 5.0.1-13 and classified as problematic. Affected by this issue is some unknown functionality of the component Lab Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256442 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional
is vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.256442 - https://vuldb.com/?ctiid.256442 - https://www.exploit-db.com/exploits/51153
CVE ID: CVE-2024-2392 State: PUBLISHED Published: 2024-03-22T01:59:59.696Z Last Updated: 2024-08-01T19:11:53.600Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: creativethemeshq Products: Blocksy Companion Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above
scaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b937cbfb-d43c-4cda-b247-921661cbc0ad?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051797%40blocksy-companion&new=3051797%40blocksy-companion&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2393 State: PUBLISHED Published: 2024-03-12T13:00:08.002Z Last Updated: 2024-08-12T13:49:07.831Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: CRUD without Page Reload Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file add_user.php. The manipulation of the argument city leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256453 was assigned to this vulnerability. Additional Analyst Notes
ed to the public and may be used. The identifier VDB-256453 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256453 - https://vuldb.com/?ctiid.256453 - https://github.com/CveSecLook/cve/blob/main/CRUD%20(Create%2C%20Read%2C%20Update%2C%20Delete)%20Without%20Page%20Reload%3ARefresh%20Using%20PHP%20and%20MySQL%20with%20Source%20Code%202/sql-1.md
CVE ID: CVE-2024-2394 State: PUBLISHED Published: 2024-03-12T14:31:04.079Z Last Updated: 2024-08-12T13:47:11.989Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Management System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Admin/add-admin.php. The manipulation of the argument avatar leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256454 is the identifier assigned to this vulnerability. Additional An
been disclosed to the public and may be used. VDB-256454 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256454 - https://vuldb.com/?ctiid.256454 - https://github.com/LiAoRJ/CVE_Hunter/blob/main/RCE-1.md
CVE ID: CVE-2024-2395 State: PUBLISHED Published: 2024-03-12T21:34:33.129Z Last Updated: 2024-08-26T16:53:15.211Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: autopolisbg Products: Bulgarisation for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.14. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to generate and delete labels via a forged request granted they can trick a site administrator into performing an action su
generate and delete labels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff1d12e-1129-40d3-8c29-3a46ffc77872?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034198%40bulgarisation-for-woocommerce&new=3034198%40bulgarisation-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2396 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:06.246Z Description: No description available.
CVE ID: CVE-2024-2397 State: PUBLISHED Published: 2024-04-12T13:22:01.636Z Last Updated: 2025-02-13T17:40:07.188Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: The Tcpdump Group Products: tcpdump Problem Types: CWE-835 Description: Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLT_PPP_SERIAL .pcap savefile. This problem does not affect any tcpdump release, but it affected the git master branch from 2023-06-05 to 2024-03-21. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpdump/commit/b9811ef5bb1b7d4
Vulnrichment: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpdump/commit/b9811ef5bb1b7d45a90e042f81f3aaf233c8bcb2 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GEZRGR3QCW2ZNFIAWMZZOG4ZLFLFNG2M/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HUUI2MBVHFENXNBCHDQZP2RBBA2VD5HG/
CVE ID: CVE-2024-2398 State: PUBLISHED Published: 2024-03-27T07:55:48.524Z Last Updated: 2025-02-13T17:40:07.893Z Vendors: curl Products: curl Problem Types: CWE-772 Missing Release of Resource after Effective Lifetime Description: When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application. Additional Analyst Notes: - CISA ADP Vulnrichment: -
s silently and is therefore not easily detected by an application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://curl.se/docs/CVE-2024-2398.json - https://curl.se/docs/CVE-2024-2398.html - https://hackerone.com/reports/2402845 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/ - http://www.openwall.com/lists/oss-security/2024/03/27/3 - https://security.netapp.com/advisory/ntap-20240503-0009/ - https://support.apple.com/kb/HT214119 -
urity/2024/03/27/3 - https://security.netapp.com/advisory/ntap-20240503-0009/ - https://support.apple.com/kb/HT214119 - https://support.apple.com/kb/HT214118 - https://support.apple.com/kb/HT214120 - http://seclists.org/fulldisclosure/2024/Jul/20 - http://seclists.org/fulldisclosure/2024/Jul/18 - http://seclists.org/fulldisclosure/2024/Jul/19
CVE ID: CVE-2024-2399 State: PUBLISHED Published: 2024-03-15T06:48:46.034Z Last Updated: 2024-08-01T19:11:53.560Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Premium Addons for Elementor Products: Premium Addons Pro for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 4.10.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribu
zation and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc057069-15cd-477f-9106-e616e919c62f?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.10.23/widgets/premium-media-wheel.php#L2753 - https://plugins.trac.wordpress.org/changeset/3051259/premium-addons-for-elementor/trunk/widgets/premium-media-wheel.php
CVE ID: CVE-2024-2400 State: PUBLISHED Published: 2024-03-13T04:09:41.514Z Last Updated: 2025-02-13T17:40:08.768Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Performance Manager in Google Chrome prior to 122.0.6261.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/327696052 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj
//issues.chromium.org/issues/327696052 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T55OZ7JOMLNT5ICM4DTCZOJZD6TZICKO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIKPDCUMQNF2DFB7TU3V4ISJ7WFJH7YI/
CVE ID: CVE-2024-2401 State: PUBLISHED Published: 2024-05-02T16:52:35.790Z Last Updated: 2024-08-01T19:11:53.390Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: jatacid Products: Admin Page Spider Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Admin Page Spider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pag
ible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c33d9295-0c7f-45a0-9d62-4293c8bbef0b?source=cve - https://wordpress.org/plugins/admin-page-spider/
CVE ID: CVE-2024-2402 State: PUBLISHED Published: 2024-04-24T05:00:02.534Z Last Updated: 2024-10-29T16:12:12.668Z Vendors: Unknown Products: Better Comments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/98e050cf-5686-4216-bad1-575decf3eaa7/
CVE ID: CVE-2024-2403 State: PUBLISHED Published: 2024-03-13T18:05:18.218Z Last Updated: 2025-03-26T20:10:07.560Z Vendors: Devolutions Products: Remote Desktop Manager Description: Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker that compromised a user endpoint, under specific circumstances, to access sensitive information via residual files in the temporary directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2024-0004