Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ed to the public and may be used. The associated identifier of this vulnerability is VDB-256303. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.256303 - https://vuldb.com/?ctiid.256303 - https://docs.qq.com/doc/DYklCV0thWnRaaWpY
CVE ID: CVE-2024-2352 State: PUBLISHED Published: 2024-03-10T01:31:05.215Z Last Updated: 2024-08-12T18:09:02.319Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: 1Panel Problem Types: CWE-77 Description: A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
ely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256304 - https://vuldb.com/?ctiid.256304 - https://github.com/1Panel-dev/1Panel/pull/4131 - https://github.com/1Panel-dev/1Panel/pull/4131#issue-2176105990 - https://github.com/1Panel-dev/1Panel/pull/4131/commits/0edd7a9f6f5100aab98a0ea6e5deedff7700396c
CVE ID: CVE-2024-2353 State: PUBLISHED Published: 2024-03-10T07:31:04.225Z Last Updated: 2024-08-12T13:49:53.588Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Totolink Products: X6000R Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256313 was assigned to this vulnerability. NOTE: The vendor was con
ed to the public and may be used. The identifier VDB-256313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256313 - https://vuldb.com/?ctiid.256313 - https://github.com/OraclePi/repo/blob/main/totolink%20X6000R/1/X6000R%20AX3000%20WiFi%206%20Giga%20unauthed%20rce.md
CVE ID: CVE-2024-2354 State: PUBLISHED Published: 2024-03-10T11:00:06.371Z Last Updated: 2024-08-21T15:30:51.136Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Dreamer Products: CMS Problem Types: CWE-352 Description: A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3. Affected is an unknown function of the file /admin/menu/toEdit. The manipulation of the argument id leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respon
identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256314 - https://vuldb.com/?ctiid.256314 - https://github.com/sweatxi/BugHub/blob/main/dreamer_cms_admin_menu_toEdit_csrf.pdf
CVE ID: CVE-2024-2355 State: PUBLISHED Published: 2024-03-10T11:31:04.250Z Last Updated: 2024-08-01T19:11:53.373Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: keerti1924 Products: Secret-Coder-PHP-Project Problem Types: CWE-540 Description: A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /secret_coder.sql. The manipulation leads to inclusion of sensitive information in source code. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed
ly. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.256315 - https://vuldb.com/?ctiid.256315 - https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/keerti1924%20%5BSecret-Coder-PHP-Project%20Sensitive%20Information%20Disclosure%5D%20on%20secret_coder.sql.md
CVE ID: CVE-2024-2357 State: PUBLISHED Published: 2024-03-11T19:39:03.280Z Last Updated: 2025-02-13T17:39:47.355Z Vendors: The Libreswan Project (www.libreswan.org) Products: libreswan Problem Types: IKEv2 misconfiguration can cause libreswan to abort and restart Description: The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service. Additional Analyst Notes: - CISA AD
ing the auto= keyword, it can cause repeated crashes leading to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://libreswan.org/security/CVE-2024-2357 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EJZJYFHKBIJ4ZK5GAWWFFR3AKJS6O5JX/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HEM46ALKF7NG6CAUKZ7KQERVOHWQIQKY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TVQ7MZY6LFFGRWAJNTKKN2VSEFS2VPAR/
CVE ID: CVE-2024-2358 State: PUBLISHED Published: 2024-05-16T09:03:45.397Z Last Updated: 2024-08-01T19:11:53.476Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-29 Description: A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences ('../../../'), enabling them to nav
n exploit this by crafting a payload that includes relative path traversal sequences ('../../../'), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious '__init__.py' file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22
CVE ID: CVE-2024-2359 State: PUBLISHED Published: 2024-06-06T18:55:40.417Z Last Updated: 2024-08-01T19:11:53.481Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-78 Description: A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises from the application's handling of the `/execute_code` endpoint, which is intended to be blocked from external access by default. However, attackers can exploit the `/update_setting` endpoint, which lacks proper access control, to modify the `host` configuration at ru
can exploit the `/update_setting` endpoint, which lacks proper access control, to modify the `host` configuration at runtime. By changing the `host` setting to an attacker-controlled value, the restriction on the `/execute_code` endpoint can be bypassed, leading to remote code execution. This vulnerability is due to improper neutralization of special elements used in an OS command (`Improper Neutralization of Special Elements used in an OS Command`). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/62144831-8d4b-4cf2-9737-5e559f7bc67e
CVE ID: CVE-2024-2360 State: PUBLISHED Published: 2024-06-06T18:55:02.078Z Last Updated: 2024-08-01T19:11:53.463Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-29 Description: parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute arbitrary code on the targeted server. The issue affects the latest version of the software. The vulnerability stems from the appl
code on the targeted server. The issue affects the latest version of the software. The vulnerability stems from the application's handling of the 'discussion_db_name' and 'pdf_latex_path' parameters, which do not properly validate file paths, allowing for directory traversal. This vulnerability can also lead to further file exposure and other attack vectors by manipulating the 'discussion_db_name' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/65d0ef59-a761-4bbd-86fa-dd8e8621082e
CVE ID: CVE-2024-2361 State: PUBLISHED Published: 2024-05-16T09:03:50.151Z Last Updated: 2024-08-01T19:11:53.455Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-29 Description: A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the `install_model()` function within `lollms_core/lollms/binding.py`, where the application fails to properly sanitize the `file://` protocol and other inputs, leading to arbitrary read and upload capabilities. Attackers can exploit this vulnerab
le://` protocol and other inputs, leading to arbitrary read and upload capabilities. Attackers can exploit this vulnerability by manipulating the `path` and `variant_name` parameters to achieve path traversal, allowing for the reading of arbitrary files and uploading files to arbitrary locations on the server. This vulnerability affects the latest version of parisneo/lollms-webui. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/cd383817-924a-445a-838e-d0c867c6a176
CVE ID: CVE-2024-2362 State: PUBLISHED Published: 2024-06-06T18:08:14.865Z Last Updated: 2024-08-01T19:11:53.464Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-36 Description: A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of adequate sanitization of user-supplied input in the 'del_preset' endpoint, where the application fails to prevent the use of absol
anitization of user-supplied input in the 'del_preset' endpoint, where the application fails to prevent the use of absolute paths or directory traversal sequences ('..'). As a result, an attacker can send a specially crafted request to the 'del_preset' endpoint to delete files outside of the intended directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/2433d0a4-9ba0-474b-be1a-6fd5019770ba
CVE ID: CVE-2024-2363 State: PUBLISHED Published: 2024-03-10T22:31:04.366Z Last Updated: 2024-08-01T19:11:53.430Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: AOL Products: AIM Triton Problem Types: CWE-404 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in AOL AIM Triton 1.0.4. It has been declared as problematic. This vulnerability affects unknown code of the component Invite Handler. The manipulation of the argument CSeq leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256318 is the identifier assigned to this vulnerability. NOTE: This vulnerabilit
osed to the public and may be used. VDB-256318 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.256318 - https://vuldb.com/?ctiid.256318 - https://fitoxs.com/vuldb/exploit/exploit_aim_triton.txt
CVE ID: CVE-2024-2364 State: PUBLISHED Published: 2024-03-10T23:00:08.397Z Last Updated: 2025-04-16T15:48:58.608Z Severity: LOW (CVSS 1.8 CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Musicshelf Problem Types: CWE-530 Description: A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320.
evice. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.256320 - https://vuldb.com/?ctiid.256320 - https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md
CVE ID: CVE-2024-2365 State: PUBLISHED Published: 2024-03-10T23:31:05.050Z Last Updated: 2024-08-05T15:43:17.420Z Severity: LOW (CVSS 1.6 CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Musicshelf Problem Types: CWE-916 Description: A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The explo
ffort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256321 - https://vuldb.com/?ctiid.256321 - https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Weak_Hashing_Algorithms.md
CVE ID: CVE-2024-2366 State: PUBLISHED Published: 2024-05-16T09:03:49.643Z Last Updated: 2024-08-01T19:11:53.448Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-77 Description: A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in lollms_core/lollms/server/endpoints/lollms_binding_infos.py of the latest version. The vulnerability arises due to insufficient path sanitization, allowing an attacker to exploit path traversal to navigate to arbitrary directories. By manipulating the binding_path to point to a con
acker to exploit path traversal to navigate to arbitrary directories. By manipulating the binding_path to point to a controlled directory and uploading a malicious __init__.py file, an attacker can execute arbitrary code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/63266c77-408b-45ff-962c-8163db50a864
CVE ID: CVE-2024-2368 State: PUBLISHED Published: 2024-06-05T06:50:27.940Z Last Updated: 2024-08-01T19:11:53.493Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ndijkstra Products: Mollie Forms Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incorrect nonce validation on the duplicateForm() function. This makes it possible for unauthenticated attackers to duplicate forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a li
orms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51ff10f2-4a5b-42ab-9ee2-95b036ac1c9a?source=cve - https://plugins.trac.wordpress.org/changeset/3097426/mollie-forms
CVE ID: CVE-2024-2369 State: PUBLISHED Published: 2024-04-02T05:00:01.384Z Last Updated: 2024-10-31T15:21:50.437Z Vendors: Unknown Products: Page Builder Gutenberg Blocks Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/252dfc35-4c8c-4304-aa09-73dfe986b10d/
CVE ID: CVE-2024-2370 State: REJECTED Published: 2024-03-11T12:55:18.543Z Last Updated: 2024-03-20T13:01:00.634Z Description: No description available.
CVE ID: CVE-2024-2371 State: PUBLISHED Published: 2024-03-12T08:49:46.017Z Last Updated: 2024-08-01T19:11:53.396Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Korenix Products: JetI/O 6550 Problem Types: CWE-200 Description: Information exposure vulnerability in Korenix JetI/O 6550 affecting firmware version F208 Build:0817. The SNMP protocol uses plaintext to transfer data, allowing an attacker to intercept traffic and retrieve credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/information-exposure-vulnerability-korenix-jetio-6550
CVE ID: CVE-2024-2375 State: PUBLISHED Published: 2024-07-03T06:00:04.122Z Last Updated: 2024-08-01T19:11:53.432Z Vendors: Unknown Products: WPQA Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/3d144e1c-a1f4-4c5a-93e2-4296a96d4ba2/
CVE ID: CVE-2024-2376 State: PUBLISHED Published: 2024-07-03T06:00:04.339Z Last Updated: 2024-08-01T19:11:53.485Z Vendors: Unknown Products: WPQA Builder Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/bdd2e323-d589-4050-bc27-5edd2507a818/
CVE ID: CVE-2024-2377 State: PUBLISHED Published: 2024-04-30T12:55:20.956Z Last Updated: 2024-08-01T19:11:53.467Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Hitachi Energy Products: SDM600 Problem Types: CWE-346 Description: A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000191&languageCode=en&Preview=true
CVE ID: CVE-2024-2378 State: PUBLISHED Published: 2024-04-30T12:58:21.972Z Last Updated: 2024-08-01T19:11:53.375Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Energy Products: SDM600 Problem Types: CWE-863 Description: A vulnerability exists in the web-authentication component of the SDM600. If exploited an attacker could escalate privileges on af-fected installations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000191&languageCode=en&Preview=true
CVE ID: CVE-2024-2379 State: PUBLISHED Published: 2024-03-27T07:56:41.158Z Last Updated: 2025-02-13T17:39:51.599Z Vendors: curl Products: curl Problem Types: CWE-295 Improper Certificate Validation Description: libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2024-2379.json - https://curl.se/docs/CVE-2024-2379.html - https://hackerone.com/reports/2410774 - htt
/curl.se/docs/CVE-2024-2379.json - https://curl.se/docs/CVE-2024-2379.html - https://hackerone.com/reports/2410774 - http://www.openwall.com/lists/oss-security/2024/03/27/2 - https://security.netapp.com/advisory/ntap-20240531-0001/ - https://support.apple.com/kb/HT214119 - https://support.apple.com/kb/HT214118 - https://support.apple.com/kb/HT214120 - http://seclists.org/fulldisclosure/2024/Jul/20 - http://seclists.org/fulldisclosure/2024/Jul/18 - http://seclists.org/fulldisclosure/2024/Jul/19
CVE ID: CVE-2024-2380 State: PUBLISHED Published: 2024-04-05T13:01:08.382Z Last Updated: 2024-08-01T19:11:53.480Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-80 Description: Stored XSS in graph rendering in Checkmk <2.3.0b4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://checkmk.com/werk/16618
CVE ID: CVE-2024-2381 State: PUBLISHED Published: 2024-06-19T03:12:32.995Z Last Updated: 2024-08-09T18:51:16.612Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ali2woo Products: AliExpress Dropshipping with AliNext Lite Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save_image function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's s