Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10511 State: PUBLISHED Published: 2024-12-11T09:04:50.225Z Last Updated: 2024-12-11T15:20:18.862Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Schneider Electric Products: PowerChute Serial Shutdown Problem Types: CWE-287 Description: CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-345-01.pdf
CVE ID: CVE-2024-10513 State: PUBLISHED Published: 2025-03-20T10:09:51.035Z Last Updated: 2025-03-20T18:33:47.807Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-23 Description: A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the vulnerable endpoint '/api/document/move-files', an attacker can move the database file to a publicly accessible directory, downl
le endpoint '/api/document/move-files', an attacker can move the database file to a publicly accessible directory, download it, and subsequently delete it. This can lead to unauthorized access to sensitive data, privilege escalation, and potential data loss. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ad11cecf-161a-4fb1-986f-6f88272cbb9e - https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7
CVE ID: CVE-2024-10515 State: PUBLISHED Published: 2024-11-20T06:00:05.036Z Last Updated: 2024-11-20T15:33:58.689Z Vendors: Unknown Products: SEO Plugin by Squirrly SEO Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/367aad17-fbb5-48eb-8829-5d3513098d02/
CVE ID: CVE-2024-10516 State: PUBLISHED Published: 2024-12-06T13:45:19.633Z Last Updated: 2024-12-06T15:56:53.802Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: swte Products: Swift Performance Lite Problem Types: CWE-22 Description: The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases wher
those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4921f41a-a9b1-4ae2-a903-c14ed22dcc15?source=cve - https://plugins.trac.wordpress.org/browser/swift-performance-lite/trunk/includes/classes/class.ajax.php#L824 - https://plugins.trac.wordpress.org/browser/swift-performance-lite/trunk/includes/classes/class.ajax.php#L795 - https://plugins.trac.wordpress.org/changeset/3201933/
CVE ID: CVE-2024-10517 State: PUBLISHED Published: 2024-12-12T06:00:17.200Z Last Updated: 2024-12-12T15:20:07.056Z Vendors: Unknown Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setu
tored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f7c3a990-458e-4e15-b427-0b37de120740/
CVE ID: CVE-2024-10518 State: PUBLISHED Published: 2024-12-12T06:00:17.717Z Last Updated: 2024-12-12T15:22:10.167Z Vendors: Unknown Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
red Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a1e5ad16-6240-4920-888a-36fbac22cc71/
CVE ID: CVE-2024-10519 State: PUBLISHED Published: 2024-11-23T09:39:10.641Z Last Updated: 2024-11-23T13:18:19.613Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: karzin Products: Wishlist for WooCommerce: Multi Wishlists Per Customer PRO Problem Types: CWE-79 Description: The Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wtab' parameter in versions 3.0.8 to 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user int
nauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Note: Only WordPress installations with versions of PHP <=7.4 are affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb14896f-7f0e-4168-8a2d-309bbaddbedc?source=cve - https://github.com/wpcodefactory/wish-list-for-woocommerce/blame/master/templates/wish-list.php#L214 - https://github.com/wpcodefactory/wish-list-for-woocommerce/blob/fafa2319a8907d3260a89a2a6b4fa9ea6602c7db/templates/wish-list.php#L94 - https://plugins.trac
sh-list-for-woocommerce/blob/fafa2319a8907d3260a89a2a6b4fa9ea6602c7db/templates/wish-list.php#L94 - https://plugins.trac.wordpress.org/browser/wish-list-for-woocommerce/trunk/templates/wish-list.php#L215 - https://wordpress.org/plugins/wish-list-for-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3189775/
CVE ID: CVE-2024-10520 State: PUBLISHED Published: 2024-11-20T11:33:10.861Z Last Updated: 2024-11-20T15:14:12.419Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wedevs Products: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts Problem Types: CWE-862 Description: The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'Create_Milestone', 'Create_Task_List', 'Create_Task', and 'Delete_Task' classes in version 2.6.14. This makes it possible for unauthenticated attackers to create milestones, create task li
sk' classes in version 2.6.14. This makes it possible for unauthenticated attackers to create milestones, create task lists, create tasks, or delete tasks in any project. NOTE: Version 2.6.14 implemented a partial fix for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/497760a8-7d4a-45a0-91e4-a8ee27bcdb02?source=cve - https://plugins.trac.wordpress.org/changeset/3191204/wedevs-project-manager
CVE ID: CVE-2024-10521 State: PUBLISHED Published: 2024-11-27T11:03:33.991Z Last Updated: 2024-11-27T12:01:12.015Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: cimatti Products: WordPress Contact Forms by Cimatti Problem Types: CWE-352 Description: The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to delete forms via a forged request granted they can trick a site administrator into performing an action such as clickin
delete forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f86e8ccb-a865-4da5-9250-dd715b8cdbe7?source=cve - https://plugins.trac.wordpress.org/browser/contact-forms/trunk/accua-forms-submissions-page.php#L348 - https://wordpress.org/plugins/contact-forms/#developers - https://plugins.trac.wordpress.org/browser/contact-forms/trunk/accua-forms-list-page.php#L154 - https://plugins.trac.wordpress.org/changeset/3196728/
CVE ID: CVE-2024-10522 State: PUBLISHED Published: 2024-11-21T02:06:35.276Z Last Updated: 2024-11-21T11:30:10.061Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: seb-emendo Products: Co-marquage service-public.fr Problem Types: CWE-79 Description: The Co-marquage service-public.fr plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.5.76. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a lin
scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/664f43a6-6461-42ce-a3e4-2277c01a0efb?source=cve - https://plugins.trac.wordpress.org/browser/co-marquage-service-public/tags/0.5.76/includes/admin/notices.class.php#L37 - https://wordpress.org/plugins/co-marquage-service-public/#developers
CVE ID: CVE-2024-10523 State: PUBLISHED Published: 2024-11-04T12:00:05.802Z Last Updated: 2024-11-04T15:06:40.613Z Vendors: TP-Link Products: TP-Link Tapo H100 IoT Smart Hub Problem Types: CWE-312 Description: This vulnerability exists in TP-Link IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0331
CVE ID: CVE-2024-10524 State: PUBLISHED Published: 2024-11-19T14:23:09.718Z Last Updated: 2025-03-21T18:03:44.339Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: gnu Products: wget Problem Types: CWE-918 Description: Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2024/q4/107 - https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/ - h
ces: - https://seclists.org/oss-sec/2024/q4/107 - https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/ - https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778
CVE ID: CVE-2024-10525 State: PUBLISHED Published: 2024-10-30T11:41:08.946Z Last Updated: 2025-11-03T20:36:24.107Z Vendors: Eclipse Foundation Products: mosquitto Problem Types: CWE-122 Description: In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/190 - https://mosquitto.org/blog/2024/10/version-
: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/190 - https://mosquitto.org/blog/2024/10/version-2-0-19-released/ - https://github.com/eclipse-mosquitto/mosquitto/commit/8ab20b4ba4204fdcdec78cb4d9f03c944a6e0e1c
CVE ID: CVE-2024-10526 State: PUBLISHED Published: 2024-11-07T10:18:05.530Z Last Updated: 2024-11-07T18:31:26.561Z Vendors: Rapid7 Products: Velociraptor Problem Types: CWE-552, CWE-732 Description: Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary co
nd cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely. This issue is fixed in version 0.73.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.velociraptor.app/announcements/2024-cves/
CVE ID: CVE-2024-10527 State: PUBLISHED Published: 2025-01-07T04:21:55.254Z Last Updated: 2025-01-07T16:26:18.914Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: clevelandwebdeveloper Products: Spacer Problem Types: CWE-862 Description: The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motech_spacer_callback() function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view limited setting information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/v
g information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/112ece28-27ac-4d3c-b302-7acab43390fb?source=cve - https://plugins.trac.wordpress.org/browser/spacer/tags/3.0.7/index.php#L85
CVE ID: CVE-2024-10528 State: PUBLISHED Published: 2024-11-21T05:33:48.663Z Last Updated: 2024-11-21T11:40:11.164Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ultimatemember Products: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Problem Types: CWE-862 Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a missing capability check on the wp_ajax_um_resize_image() and ajax_resize_image() functions in all versions up to, and including, 2.
bility check on the wp_ajax_um_resize_image() and ajax_resize_image() functions in all versions up to, and including, 2.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the profile pictures of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a9793b6-2186-46ef-b204-d8f8f154ebf3?source=cve - https://github.com/ultimatemember/ultimatemember/blob/ab05bc570a8ba6449cd470791be1c0670eb9c203/includes/core/class-files.php#L332 - https://github.com/ultimatemember/ultimatemember/blob/ab05bc570a8ba6449cd470791be1c0670eb9c203/includes/core/class-files.php#L371 -
hub.com/ultimatemember/ultimatemember/blob/ab05bc570a8ba6449cd470791be1c0670eb9c203/includes/core/class-files.php#L371 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3186722%40ultimate-member&new=3186722%40ultimate-member&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10529 State: PUBLISHED Published: 2024-11-13T02:33:21.151Z Last Updated: 2024-11-13T18:42:13.487Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: kognetiks Products: Kognetiks Chatbot for WordPress Problem Types: CWE-862 Description: The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete GTP assistants. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
access and above, to delete GTP assistants. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6b302c9-a6b9-4a91-acb5-2ad270817606?source=cve - https://plugins.trac.wordpress.org/browser/chatbot-chatgpt/trunk/includes/utilities/chatbot-assistants.php#L575 - https://plugins.trac.wordpress.org/changeset/3183413/chatbot-chatgpt/trunk/includes/utilities/chatbot-assistants.php
CVE ID: CVE-2024-10530 State: PUBLISHED Published: 2024-11-13T02:33:18.433Z Last Updated: 2024-11-13T16:44:14.290Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: kognetiks Products: Kognetiks Chatbot for WordPress Problem Types: CWE-862 Description: The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the add_new_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to create new GTP assistants. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
l access and above, to create new GTP assistants. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4fd7e76-4d8b-4e4d-9ae9-c7f9933f8324?source=cve - https://plugins.trac.wordpress.org/browser/chatbot-chatgpt/trunk/includes/utilities/chatbot-assistants.php#L596 - https://plugins.trac.wordpress.org/changeset/3183413/chatbot-chatgpt/trunk/includes/utilities/chatbot-assistants.php
CVE ID: CVE-2024-10531 State: PUBLISHED Published: 2024-11-13T02:33:19.238Z Last Updated: 2024-11-13T16:38:15.130Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: kognetiks Products: Kognetiks Chatbot for WordPress Problem Types: CWE-862 Description: The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to update GTP assistants. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
access and above, to update GTP assistants. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc083470-3b43-42f3-8979-7fa6cce6ee75?source=cve - https://plugins.trac.wordpress.org/browser/chatbot-chatgpt/trunk/includes/utilities/chatbot-assistants.php#L524 - https://plugins.trac.wordpress.org/changeset/3183413/chatbot-chatgpt/trunk/includes/utilities/chatbot-assistants.php
CVE ID: CVE-2024-10532 State: PUBLISHED Published: 2024-11-21T02:06:23.400Z Last Updated: 2024-11-21T11:40:11.668Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wproyal Products: Bard Extra Problem Types: CWE-862 Description: The Bard Extra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bardxtra_import_xml() function in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to import demo data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/i
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad5d2b2-fca8-46bb-8a03-02be07f2a800?source=cve - https://plugins.trac.wordpress.org/browser/bard-extra/trunk/bard-extra.php#L341
CVE ID: CVE-2024-10533 State: PUBLISHED Published: 2024-11-16T03:29:16.730Z Last Updated: 2024-11-16T15:09:05.849Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ninjateam Products: WP Chat App Problem Types: CWE-862 Description: The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function in all versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the filebird plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vul
bird plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26f73bfe-f41a-4045-9d72-21181a9a704f?source=cve - https://plugins.trac.wordpress.org/browser/wp-whatsapp/trunk/includes/Cross.php#L206 - https://plugins.trac.wordpress.org/browser/wp-whatsapp/tags/3.6.7/includes/Cross.php#L206 - https://plugins.trac.wordpress.org/changeset/3186930/wp-whatsapp/trunk/includes/Cross.php
CVE ID: CVE-2024-10534 State: PUBLISHED Published: 2024-11-15T11:02:50.683Z Last Updated: 2024-11-15T17:32:12.034Z Vendors: Dataprom Informatics Products: Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) Problem Types: CWE-346 Description: Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traffic Injection.This issue affects Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS): before 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1856
CVE ID: CVE-2024-10535 State: PUBLISHED Published: 2024-11-06T06:43:30.122Z Last Updated: 2024-11-06T15:05:15.112Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: martinvalchev Products: Video Gallery for WooCommerce Problem Types: CWE-862 Description: The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unused_thumbnails() function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails in the video-wc-gallery-thumb directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https: