Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12616 State: PUBLISHED Published: 2025-01-09T11:11:03.339Z Last Updated: 2025-01-09T14:30:19.566Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: bitlydeveloper Products: Bitly&#039;s WordPress Plugin Problem Types: CWE-862 Description: The Bitly&#039;s WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and retrieve plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
d above, to update and retrieve plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1312c34-45c6-41e5-b6fc-a45ac2c8a0ca?source=cve - https://plugins.trac.wordpress.org/browser/wp-bitly/trunk/includes/class-wp-bitly-auth.php#L115
CVE ID: CVE-2024-12617 State: PUBLISHED Published: 2024-12-24T04:22:45.832Z Last Updated: 2024-12-24T16:55:16.450Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: kkarpieszuk Products: WC Price History for Omnibus Problem Types: CWE-862 Description: The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and modify history data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat
d modify history data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b380b053-9847-48a8-ba12-d07db9df2baf?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209687%40wc-price-history&new=3209687%40wc-price-history&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12618 State: PUBLISHED Published: 2025-01-09T11:10:53.329Z Last Updated: 2025-01-09T15:07:31.981Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: newsletter2go Products: Newsletter2Go Problem Types: CWE-862 Description: The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in all versions up to, and including, 4.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset styles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabiliti
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/09b2d763-63ce-4cc7-aa04-589bb8697ce9?source=cve - https://plugins.trac.wordpress.org/browser/newsletter2go/trunk/gui/N2Go_Gui.php#L294
CVE ID: CVE-2024-12619 State: PUBLISHED Published: 2025-03-28T10:02:13.406Z Last Updated: 2025-03-28T13:46:51.887Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-1220 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/509324 - https://hackerone.com/reports/2888260
CVE ID: CVE-2024-12620 State: PUBLISHED Published: 2025-02-01T03:21:12.444Z Last Updated: 2025-02-03T16:38:27.021Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: creativeinteractivemedia Products: AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations Problem Types: CWE-862 Description: The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'agl_json' AJAX action in all versions up to, and including, 1.4.23. This makes it possible for unauthenticated attackers to update the plugin's settings. Additi
to, and including, 1.4.23. This makes it possible for unauthenticated attackers to update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/841a028d-ff36-4e3f-903b-e25951648075?source=cve - https://wordpress.org/plugins/animategl/
CVE ID: CVE-2024-12621 State: PUBLISHED Published: 2025-01-09T11:10:59.390Z Last Updated: 2025-01-09T14:29:40.355Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: yumpu Products: Yumpu E-Paper publishing Problem Types: CWE-79 Description: The Yumpu E-Paper publishing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'YUMPU' shortcode in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60c0db19-deda-4b95-a341-cf33883dc9b4?source=cve - https://plugins.trac.wordpress.org/browser/yumpu-epaper-publishing/tags/3.0.8/lib/Shortcode.php#L24 - https://plugins.trac.wordpress.org/browser/yumpu-epaper-publishing/tags/3.0.8/lib/Shortcode.php#L81
CVE ID: CVE-2024-12622 State: PUBLISHED Published: 2024-12-24T05:23:44.399Z Last Updated: 2024-12-24T15:27:58.642Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wptipsntricks Products: WordPress Simple Shopping Cart Problem Types: CWE-79 Description: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' and 'wp_cart_display_product' shortcodes in all versions up to, and including, 5.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject ar
ed attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/adfba556-6a96-4836-af0f-39c214099481?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.0.7/wp_shopping_cart_shortcodes.php#L5 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.0.7/wp_shopping_cart_shortcodes.php#L11 - https://plugins.trac.wordpress.org/browser/wordpress-simpl
hopping-cart/tags/5.0.7/wp_shopping_cart_shortcodes.php#L11 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.0.7/wp_shopping_cart_shortcodes.php#L49 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.0.7/includes/wpsc-shortcodes-related.php#L3 - https://plugins.trac.wordpress.org/changeset/3210506/wordpress-simple-paypal-shopping-cart/trunk/includes/wpsc-shortcodes-related.php
CVE ID: CVE-2024-12623 State: PUBLISHED Published: 2025-03-25T07:04:55.620Z Last Updated: 2025-03-31T17:40:42.428Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ivmartel Products: DICOM Support Problem Types: CWE-79 Description: The DICOM Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode in all versions up to, and including, 0.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec
tor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d76052f8-34b3-4930-a5bf-182420b07968?source=cve - https://plugins.trac.wordpress.org/browser/dicom-support/trunk/DicomSupport.php#L120 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3257320%40dicom-support&new=3257320%40dicom-support&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12624 State: PUBLISHED Published: 2025-01-07T06:40:56.716Z Last Updated: 2025-01-07T17:15:38.698Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shaonsina Products: Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) Problem Types: CWE-79 Description: The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up to, and including, 3.5.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated
sufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39f6fb61-25a9-4386-9b61-7343760fd28c?source=cve - https://plugins.trac.wordpress.org/changeset/3211218/sina-extension-for-elementor
CVE ID: CVE-2024-12626 State: PUBLISHED Published: 2024-12-19T11:14:15.433Z Last Updated: 2024-12-20T17:41:04.415Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: rubengc Products: AutomatorWP – The #1 automator plugin for no-code automation in WordPress Problem Types: CWE-79 Description: The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-search_field_value’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers
, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. When used in conjunction with the plugin's import and code action feature, this vulnerability can be leveraged to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8abcc7b-6c68-4fc8-81af-e88624e417dd?source=cve - https://plugins.trac.wordpress.org/changeset/3209794/automatorwp
CVE ID: CVE-2024-12627 State: PUBLISHED Published: 2025-01-11T02:20:54.151Z Last Updated: 2025-01-13T19:54:08.371Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: galdub Products: Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups Problem Types: CWE-502 Description: The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.5 via deserialization of untrusted input from post content passed to the capture_email AJAX action. This makes it possible for authenticated attackers, with Contributor-leve
ntent passed to the capture_email AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/468be776-8804-4d2f-8eaf-841bbf598ef9?source=cve - https://plugins.trac.wordpress.org/changeset/3219466/coupon-x-discount-pop-up/trunk/inc/class-cx-rest.php
CVE ID: CVE-2024-12628 State: PUBLISHED Published: 2024-12-14T06:45:13.804Z Last Updated: 2024-12-16T17:48:20.161Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: budiony Products: bodi0`s Easy cache Problem Types: CWE-79 Description: The bodi0`s Easy cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cache-folder' parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This
s and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/087034aa-efd0-44b9-9a2f-3a625806bcaa?source=cve - https://www.getastra.com/blog/cms/stored-xss-vulnerability-in-bodi0/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153314%40bodi0s-easy-cache&new=3153314%40bodi0s-easy-cache&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12629 State: PUBLISHED Published: 2025-02-12T15:37:51.840Z Last Updated: 2025-02-12T15:55:43.633Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Progress Software Products: Telerik KendoReact Problem Types: CWE-1321 Description: In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-protoype-pollution-2024-12629
CVE ID: CVE-2024-12632 State: REJECTED Published: N/A Last Updated: 2024-12-13T20:46:00.000Z Description: No description available.
CVE ID: CVE-2024-12633 State: PUBLISHED Published: 2025-01-07T05:23:57.261Z Last Updated: 2025-01-07T16:14:51.903Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: beardev Products: JoomSport – for Sports: Team & League, Football, Hockey & more Problem Types: CWE-79 Description: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe
makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b4503e2c-0d0d-45de-a597-baace44a98a7?source=cve - https://plugins.trac.wordpress.org/changeset/3209054/joomsport-sports-league-results-management
CVE ID: CVE-2024-12634 State: PUBLISHED Published: 2025-03-07T11:12:54.726Z Last Updated: 2025-03-07T14:35:57.162Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pickplugins Products: Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins Problem Types: CWE-352 Description: The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 2.0.59. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via
nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29d22612-8e0d-4275-b370-9729352c951e?source=cve - https://plugins.trac.wordpress.org/browser/related-post/tags/2.0.58b/includes/menu/settings.php#L129 - https://wordpress.org/plugins/related-post/#developers - https://plugins.trac.wordpress.org/changeset/3251482/
CVE ID: CVE-2024-12635 State: PUBLISHED Published: 2024-12-21T07:03:00.630Z Last Updated: 2024-12-28T00:50:33.806Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: fahadmahmood Products: WP Docs Problem Types: CWE-89 Description: The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be us
s, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability was partially patched in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbbfe66-09fe-48c9-9af1-0b7b90ac222a?source=cve - https://plugins.trac.wordpress.org/browser/wp-docs/tags/2.1.8/inc/functions.php#L1963 - https://plugins.trac.wordpress.org/changeset/3210656/ - https://plugins.trac.wordpress.org/changeset/3210644/
CVE ID: CVE-2024-12636 State: PUBLISHED Published: 2024-12-25T04:22:03.605Z Last Updated: 2024-12-26T19:57:26.462Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wplegalpages Products: Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages Problem Types: CWE-352 Description: The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.6. This is due to missing or incorrect nonce validation on the 'create_popup_delete_process' function. This makes it possible for unauthenticated attackers
ect nonce validation on the 'create_popup_delete_process' function. This makes it possible for unauthenticated attackers to delete popups via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8da64b2f-8546-4276-9dbf-b60e885a0309?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212527%40wplegalpages&new=3212527%40wplegalpages&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12637 State: PUBLISHED Published: 2025-01-17T07:01:28.253Z Last Updated: 2025-02-12T18:44:10.720Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: katsushi-kawamori Products: Moving Users Problem Types: CWE-200 Description: The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality. The JSON files are stored in predictable locations with guessable file names when exporting user data. This could allow unauthenticated attackers to extract sensitive user data, for instance, email addresses, hashed passwords, and IP addresses. Additional Analyst Not
o extract sensitive user data, for instance, email addresses, hashed passwords, and IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8209761c-2cfe-49b9-ab4c-49a9a13b5dcf?source=cve - https://wordpress.org/plugins/moving-users/
CVE ID: CVE-2024-12638 State: PUBLISHED Published: 2025-01-30T06:00:09.593Z Last Updated: 2025-01-30T15:48:21.121Z Vendors: Unknown Products: Bulk Me Now! Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a6f5b0fe-00a0-4e30-aec6-87882c035beb/
CVE ID: CVE-2024-12641 State: PUBLISHED Published: 2024-12-16T06:14:09.779Z Last Updated: 2024-12-16T16:44:08.298Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Chunghwa Telecom Products: TenderDocTransfer Problem Types: CWE-79 Description: TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use specific APIs through phishing to execute arbitrary JavaScript code in the user’s browser. Since the web server set by the app
ic APIs through phishing to execute arbitrary JavaScript code in the user’s browser. Since the web server set by the application supports Node.Js features, attackers can further leverage this to run OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8292-4fd98-1.html - https://www.twcert.org.tw/en/cp-139-8299-42168-2.html
CVE ID: CVE-2024-12642 State: PUBLISHED Published: 2024-12-16T06:30:31.108Z Last Updated: 2024-12-16T16:43:44.651Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Chunghwa Telecom Products: TenderDocTransfer Problem Types: CWE-352, CWE-23 Description: TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to
through phishing. Additionally, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to write arbitrary files to any path on the user's system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8294-44d13-1.html - https://www.twcert.org.tw/en/cp-139-8300-2eaa1-2.html