Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
he attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269800. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269800 - https://vuldb.com/?ctiid.269800 - https://vuldb.com/?submit.359344 - https://gentle-khaan-c53.notion.site/Reflected-XSS-in-Labvantage-LIMS-c9aa0641d1464816832bb8b98958626f?pvs=4
CVE ID: CVE-2024-6368 State: PUBLISHED Published: 2024-06-27T11:31:06.731Z Last Updated: 2024-08-01T21:33:05.425Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: LabVantage Products: LIMS Problem Types: CWE-79 Description: A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?command=page of the component POST Request Handler. The manipulation of the argument param1 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269801 was assigned to this vulnerability. NOTE: The vendor was conta
to the public and may be used. The identifier VDB-269801 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269801 - https://vuldb.com/?ctiid.269801 - https://vuldb.com/?submit.359372 - https://gentle-khaan-c53.notion.site/Reflected-XSS-in-Labvantage-LIMS-53b90219d193451aa81f28dea480d5f2?pvs=4
CVE ID: CVE-2024-6369 State: PUBLISHED Published: 2024-06-27T12:00:06.595Z Last Updated: 2024-08-01T21:33:05.451Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: LabVantage Products: LIMS Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in LabVantage LIMS 2017. Affected is an unknown function of the file /labvantage/rc?command=page&sdcid=LV_ReagentLot of the component POST Request Handler. The manipulation of the argument mode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269802 is the identifier assigned to this vulnerability. Additional Anal
en disclosed to the public and may be used. VDB-269802 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269802 - https://vuldb.com/?ctiid.269802 - https://vuldb.com/?submit.359373 - https://gentle-khaan-c53.notion.site/Reflected-XSS-in-Labvantage-LIMS-960bf61d35124c858e3360785cfe40b3?pvs=4
CVE ID: CVE-2024-6370 State: PUBLISHED Published: 2024-06-27T12:00:09.407Z Last Updated: 2024-08-01T21:33:05.322Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: LabVantage Products: LIMS Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp of the component POST Request Handler. The manipulation of the argument bulletinbody leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifie
attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269803. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269803 - https://vuldb.com/?ctiid.269803 - https://vuldb.com/?submit.359374 - https://gentle-khaan-c53.notion.site/HTML-Injection-in-Labvantage-LIMS-a229aae13fa14977a677921e7a442619?pvs=4
CVE ID: CVE-2024-6371 State: PUBLISHED Published: 2024-06-27T12:31:04.019Z Last Updated: 2024-08-01T21:33:05.455Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Pool of Bethesda Online Reservation System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in itsourcecode Pool of Bethesda Online Reservation System 1.0. Affected by this issue is some unknown functionality of the file controller.php. The manipulation of the argument rmtype_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269
remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269804. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269804 - https://vuldb.com/?ctiid.269804 - https://vuldb.com/?submit.364101 - https://github.com/L1OudFd8cl09/CVE/blob/main/25_06_2024_b.md
CVE ID: CVE-2024-6372 State: PUBLISHED Published: 2024-06-27T13:00:06.217Z Last Updated: 2024-08-01T21:33:05.456Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file customeradd.php. The manipulation of the argument fullname/address/phonenumber/sex/email/city/comment leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269805 was assigned to this vulne
tely. The exploit has been disclosed to the public and may be used. The identifier VDB-269805 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269805 - https://vuldb.com/?ctiid.269805 - https://vuldb.com/?submit.364752 - https://github.com/Galaxy-lrc/cve/issues/1
CVE ID: CVE-2024-6373 State: PUBLISHED Published: 2024-06-27T13:00:08.480Z Last Updated: 2024-08-01T21:33:05.338Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Food Ordering System Problem Types: CWE-434 Description: A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file /addproduct.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269806 is the identifier assigned to this vulnerability. Additional Analyst Notes:
d to the public and may be used. VDB-269806 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269806 - https://vuldb.com/?ctiid.269806 - https://vuldb.com/?submit.364646 - https://github.com/Abyssun/abyssun-/issues/1
CVE ID: CVE-2024-6374 State: PUBLISHED Published: 2024-06-27T13:31:05.025Z Last Updated: 2024-08-01T21:33:05.517Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: lahirudanushka Products: School Management System Problem Types: CWE-79 Description: A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic. This issue affects some unknown processing of the file /subject.php of the component Subject Page. The manipulation of the argument Subject Title/Sybillus Details leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vu
e initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269807. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269807 - https://vuldb.com/?ctiid.269807 - https://vuldb.com/?submit.364874 - https://secretive-agate-23c.notion.site/School-Management-System-PHP-MySQL-stored-1-0-1-XSS-50088f0ed9e94efda9c57772ce192980 - https://secretive-agate-23c.notion.site/School-Management-System-PHP-MySQL-stored-1-0-1-Stored-XSS-41c9f85f307441c5885fb0df3d3fcc08
CVE ID: CVE-2024-6375 State: PUBLISHED Published: 2024-07-01T14:40:32.566Z Last Updated: 2024-08-01T21:33:05.457Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-285 Description: A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3. Additional Analyst Notes:
MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-79327
CVE ID: CVE-2024-6376 State: PUBLISHED Published: 2024-07-01T14:57:31.704Z Last Updated: 2024-08-01T21:33:05.431Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MongoDB Inc Products: MongoDB Compass Problem Types: CWE-20 Description: MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/COMPASS-7496
CVE ID: CVE-2024-6377 State: PUBLISHED Published: 2024-08-20T13:45:35.407Z Last Updated: 2024-08-27T08:05:08.293Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: 3DSwymer Problem Types: CWE-601 Description: An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-6378 State: PUBLISHED Published: 2024-08-20T13:45:10.521Z Last Updated: 2024-08-20T17:23:48.066Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-6379 State: PUBLISHED Published: 2024-08-20T13:44:53.360Z Last Updated: 2024-08-27T08:09:32.404Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: 3DSwymer Problem Types: CWE-79 Description: A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-6380 State: PUBLISHED Published: 2024-10-16T11:28:28.769Z Last Updated: 2024-10-16T16:18:04.990Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-6381 State: PUBLISHED Published: 2024-07-02T17:14:48.908Z Last Updated: 2025-11-03T19:34:28.669Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: MongoDB Inc Products: libbson Problem Types: CWE-680 Description: The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/CDRIVER-5622
CVE ID: CVE-2024-6382 State: PUBLISHED Published: 2024-07-02T17:17:50.237Z Last Updated: 2024-08-01T21:41:03.220Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: MongoDB Inc Products: MongoDB Rust Driver Problem Types: CWE-228 Description: Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/RUST-1881
CVE ID: CVE-2024-6383 State: PUBLISHED Published: 2024-07-03T21:33:47.598Z Last Updated: 2025-11-03T19:34:31.467Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: MongoDB Inc Products: libbson Problem Types: CWE-122 Description: The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/CDRIVER-5628
CVE ID: CVE-2024-6384 State: PUBLISHED Published: 2024-08-13T14:22:22.847Z Last Updated: 2024-11-15T13:08:20.203Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-285 Description: "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/b
3.3 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-93516
CVE ID: CVE-2024-6385 State: PUBLISHED Published: 2024-07-11T06:56:54.515Z Last Updated: 2024-09-18T13:11:50.553Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-284 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/469217 - https://hackerone.com/reports
VE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/469217 - https://hackerone.com/reports/2578672
CVE ID: CVE-2024-6386 State: PUBLISHED Published: 2024-08-21T20:29:23.090Z Last Updated: 2024-08-21T20:36:58.048Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: WPML Products: WPML Problem Types: CWE-1336 Description: The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.word
above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7fc91cc-e529-4362-8269-bf7ee0766e1e?source=cve - https://wpml.org/ - https://sec.stealthcopter.com/wpml-rce-via-twig-ssti/
CVE ID: CVE-2024-6387 State: PUBLISHED Published: 2024-07-01T12:37:25.431Z Last Updated: 2025-11-11T16:12:24.347Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enter
d Hat Ceph Storage 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-364 Description: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4312 - https://access.redhat.com/errata/RHSA-2024:4340 - https://access.redhat.com/errata/RHSA-2024:4389 - http
HSA-2024:4312 - https://access.redhat.com/errata/RHSA-2024:4340 - https://access.redhat.com/errata/RHSA-2024:4389 - https://access.redhat.com/errata/RHSA-2024:4469 - https://access.redhat.com/errata/RHSA-2024:4474 - https://access.redhat.com/errata/RHSA-2024:4479 - https://access.redhat.com/errata/RHSA-2024:4484 - https://access.redhat.com/security/cve/CVE-2024-6387 - https://bugzilla.redhat.com/show_bug.cgi?id=2294604 - https://santandersecurityresearch.github.io/blog/sshing_the_masses.html - https://www.openssh.com/txt/release-9.8 - https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
CVE ID: CVE-2024-6388 State: PUBLISHED Published: 2024-06-27T15:39:04.168Z Last Updated: 2024-08-01T21:41:03.306Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Canonical Ltd. Products: Ubuntu Advantage Desktop Pro Problem Types: CWE-497 Description: Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944 - https://www.cve.org/CVERecord?id=CVE-2024-6388 - https://github
net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944 - https://www.cve.org/CVERecord?id=CVE-2024-6388 - https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24
CVE ID: CVE-2024-6389 State: PUBLISHED Published: 2024-09-12T16:56:48.267Z Last Updated: 2024-09-13T14:17:35.852Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-497 Description: An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/469367 - https://hackerone.com/reports/257339
ram Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/469367 - https://hackerone.com/reports/2573397
CVE ID: CVE-2024-6390 State: PUBLISHED Published: 2024-08-03T06:00:05.411Z Last Updated: 2024-08-05T14:09:05.215Z Vendors: Unknown Products: Quiz and Survey Master (QSM) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/00586687-33c7-4d84-b606-0478b1063d24/
CVE ID: CVE-2024-6391 State: PUBLISHED Published: 2024-07-09T11:33:21.554Z Last Updated: 2024-08-01T21:41:03.363Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bobbingwide Products: oik Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bw_button shortcode in all versions up to, and including, 4.10.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary w
utes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3dfa92a-57da-49ab-95f7-504fa99ed47f?source=cve - https://wordpress.org/plugins/oik/#developers - https://plugins.trac.wordpress.org/browser/oik/trunk/shortcodes/oik-button.php#L34 - https://plugins.trac.wordpress.org/changeset/3112763/
CVE ID: CVE-2024-6392 State: PUBLISHED Published: 2024-07-11T21:31:34.282Z Last Updated: 2024-08-01T21:41:03.377Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: sirv Products: Image Optimizer, Resizer and CDN – Sirv Problem Types: CWE-862 Missing Authorization Description: The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one. Addit
ckers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/229490c3-d820-4831-b105-a429512c2c60?source=cve - https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5197 - https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.6/sirv.php#L5338