Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
es it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4185a0e-d944-408f-8a43-8f9c6bc3964d?source=cve - https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/video-encoder/class.fv-player-encoder-list-table.php#L308 - https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers - https://plugins.trac.wordpress.org/changeset/3121532/
CVE ID: CVE-2024-6339 State: PUBLISHED Published: 2024-08-21T07:33:24.873Z Last Updated: 2024-08-21T20:53:45.281Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: averta Products: Phlox PRO Problem Types: CWE-79 Description: The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA A
y can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b5ad113-f739-455a-9db6-b4f300b92837?source=cve - https://owasp.org/www-community/attacks/xss/ - https://github.com/skmorshed75/ferdykorp/blob/9176d0782558ac2bd620777174e942cefc27fb21/wp-content/themes/phlox/templates/theme-parts/entry/search-advanced.php#L69
CVE ID: CVE-2024-6340 State: PUBLISHED Published: 2024-07-03T07:32:37.632Z Last Updated: 2024-08-01T21:33:05.364Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-le
and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed80507-f3e5-45a8-9498-8cebf97155ff?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/assets/frontend/js/premium-countdown-timer.js#L31 - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/assets/frontend/js/premium-countdown-timer.js#L113
plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/assets/frontend/js/premium-countdown-timer.js#L113 - https://wordpress.org/plugins/premium-addons-for-elementor/#developers - https://plugins.trac.wordpress.org/changeset/3111117/
CVE ID: CVE-2024-6341 State: REJECTED Published: N/A Last Updated: 2024-07-02T17:26:13.327Z Description: No description available.
CVE ID: CVE-2024-6342 State: PUBLISHED Published: 2024-09-10T01:55:13.215Z Last Updated: 2024-09-10T15:18:36.873Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NAS326 firmware, NAS542 firmware Problem Types: CWE-78 Description: **UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/g
ng a crafted HTTP POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-nas-products-09-10-2024
CVE ID: CVE-2024-6343 State: PUBLISHED Published: 2024-09-03T01:28:27.056Z Last Updated: 2024-09-03T13:47:31.099Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacke
6 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024
CVE ID: CVE-2024-6344 State: PUBLISHED Published: 2024-06-26T10:31:03.685Z Last Updated: 2025-07-10T07:02:31.856Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: ZKTeco Products: ZKBio CVSecurity V5000 Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Configuration Section. The manipulation of the argument Configuration Name leads to cross site scripting. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component. The vendor explains, that "[s]ince ZKBio CVSecurity v5000 has b
ly. It is recommended to upgrade the affected component. The vendor explains, that "[s]ince ZKBio CVSecurity v5000 has been withdrawn from the market, we recommend upgrading to ZKBio CVSecurity V6600 6.1.3_R or above". This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269733 - https://vuldb.com/?ctiid.269733 - https://vuldb.com/?submit.358596 - https://www.zkteco.com/en/Security_Bulletinsibs/17
CVE ID: CVE-2024-6345 State: PUBLISHED Published: 2024-07-15T00:00:14.545Z Last Updated: 2025-11-04T16:15:51.183Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: pypa Products: pypa/setuptools Problem Types: CWE-94 Description: A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The is
s are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5 - https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0
CVE ID: CVE-2024-6346 State: PUBLISHED Published: 2024-08-01T09:29:47.875Z Last Updated: 2024-08-02T15:40:10.787Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pickplugins Products: Gutenberg Blocks, Page Builder – ComboBlocks Problem Types: CWE-79 Description: The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL parameter of the Date Countdown widget, in all versions up to, and including, 2.2.85a due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above,
user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1512d911-167f-4653-ab20-cb057b83dab1?source=cve - https://plugins.trac.wordpress.org/browser/post-grid/tags/2.2.84/includes/blocks/date-countdown/front-scripts.js#L117 - https://plugins.trac.wordpress.org/browser/post-grid/tags/2.2.84/includes/blocks/date-countdown/index.php#L283
CVE ID: CVE-2024-6347 State: PUBLISHED Published: 2024-08-15T14:37:38.448Z Last Updated: 2024-08-15T15:32:49.639Z Vendors: Nissan Products: Altima Problem Types: CWE-285, CWE-306 Description: * Unprotected privileged mode access through UDS session in the Blind Spot Detection Sensor ECU firmware in Nissan Altima (2022) allows attackers to trigger denial-of-service (DoS) by unauthorized access to the ECU's programming session. * No preconditions implemented for ECU management functionality through UDS session in the Blind Spot Detection Sensor ECU in Nissan Altima (2022) allows attackers to disrupt normal ECU operations by triggering a control command without authentication. Additional Analys
ows attackers to disrupt normal ECU operations by triggering a control command without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://asrg.io/security-advisories/CVE-2024-6347
CVE ID: CVE-2024-6348 State: PUBLISHED Published: 2024-08-19T15:12:25.216Z Last Updated: 2024-08-19T19:26:54.514Z Vendors: Nissan Products: Altima Problem Types: CWE-330 Description: Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://asrg.io/security-advisories/
CVE ID: CVE-2024-6349 State: REJECTED Published: N/A Last Updated: 2024-06-26T14:43:00.870Z Description: No description available.
CVE ID: CVE-2024-6350 State: PUBLISHED Published: 2025-01-08T17:12:58.226Z Last Updated: 2025-01-08T17:27:34.087Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: Simplicity SDK Problem Types: CWE-120 Description: A malformed 802.15.4 packet causes a buffer overflow to occur leading to an assert and a denial of service. A watchdog reset clears the error condition automatically. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/069Vm00000HtvDgIAJ - https://github.com/SiliconLabs/simplicity_sdk/releases
CVE ID: CVE-2024-6351 State: PUBLISHED Published: 2025-01-28T14:00:15.771Z Last Updated: 2025-02-18T19:06:43.799Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: silabs.com Products: SiSDK Problem Types: CWE-120 Description: A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember ZNet stack and lead to an assert Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/simplicity_sdk/releases - https://community.silabs.com/069Vm00000HtvDgIAJ
CVE ID: CVE-2024-6352 State: PUBLISHED Published: 2025-01-13T16:39:43.897Z Last Updated: 2025-08-27T21:43:06.116Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: silabs.com Products: SiSDK Problem Types: CWE-120 Description: A malformed packet can cause a buffer overflow in the APS layer of the Ember ZNet stack and lead to an assert Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/simplicity_sdk/releases - https://community.silabs.com/069Vm00000HtvDgIAJ
CVE ID: CVE-2024-6353 State: PUBLISHED Published: 2024-07-12T08:32:13.089Z Last Updated: 2024-08-01T21:33:05.445Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: subratamal Products: Wallet for WooCommerce Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'search[value]' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscr
ack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7d5a077-8836-4c28-8884-5047585a99e5?source=cve - https://plugins.trac.wordpress.org/browser/woo-wallet/trunk/includes/class-woo-wallet-ajax.php#L393 - https://wordpress.org/plugins/woo-wallet/#developers - https://plugins.trac.wordpress.org/changeset/3116025/
CVE ID: CVE-2024-6354 State: PUBLISHED Published: 2024-06-26T16:20:42.264Z Last Updated: 2025-03-13T18:28:31.840Z Vendors: Devolutions Products: Remote Desktop Manager Description: Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2024-0010
CVE ID: CVE-2024-6355 State: PUBLISHED Published: 2024-06-26T21:00:05.252Z Last Updated: 2024-08-01T21:33:05.432Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Genexis Products: Tilgin Fiber Home Gateway HG1522 Problem Types: CWE-79 Description: A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /status/product_info/. The manipulation of the argument product_info leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerabil
hed remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269755. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269755 - https://vuldb.com/?ctiid.269755 - https://vuldb.com/?submit.359289
CVE ID: CVE-2024-6356 State: PUBLISHED Published: 2025-02-05T10:02:22.677Z Last Updated: 2025-02-05T14:29:45.373Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-286 Description: An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/469108 - https://hackerone.com/reports/2575051
CVE ID: CVE-2024-6357 State: PUBLISHED Published: 2024-08-06T13:08:46.927Z Last Updated: 2024-08-06T14:22:10.514Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: OpenText Products: ArcSight Intelligence Problem Types: CWE-639 Description: Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000032593
CVE ID: CVE-2024-6358 State: PUBLISHED Published: 2024-08-06T13:08:42.954Z Last Updated: 2024-08-06T19:39:17.083Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: OpenText Products: ArcSight Intelligence Problem Types: CWE-863 Description: Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000032595
CVE ID: CVE-2024-6359 State: PUBLISHED Published: 2024-08-06T13:08:45.219Z Last Updated: 2024-08-06T13:37:14.491Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: OpenText Products: ArcSight Intelligence Problem Types: CWE-269 Description: Privilege escalation vulnerability identified in OpenText ArcSight Intelligence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000032594
CVE ID: CVE-2024-6360 State: PUBLISHED Published: 2024-10-02T15:19:15.457Z Last Updated: 2024-10-02T16:30:37.533Z Vendors: OpenText™ Products: Vertica Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privileges to Vertica agent apikey. This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000033373?language=en_US
CVE ID: CVE-2024-6361 State: PUBLISHED Published: 2024-08-05T18:22:14.283Z Last Updated: 2024-11-01T17:44:47.667Z Vendors: OpenText™ Products: ALM Octane. Problem Types: CWE-79 Description: Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane. The vulnerability affects all version prior to version 23.4. The vulnerability could cause remote code execution attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000032605?language=en_US
CVE ID: CVE-2024-6362 State: PUBLISHED Published: 2024-07-29T06:00:07.759Z Last Updated: 2024-08-01T21:33:05.331Z Vendors: Unknown Products: Ultimate Blocks Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/d2e2d06b-0f07-40b9-9b87-3373f62ae1a9/
CVE ID: CVE-2024-6363 State: PUBLISHED Published: 2024-06-29T07:05:34.703Z Last Updated: 2024-08-01T21:33:05.395Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: urkekg Products: Stock Ticker Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including, 3.24.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to in
supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/280a5d6d-192a-43aa-927e-45c50b126463?source=cve - https://wordpress.org/plugins/stock-ticker/#developers - https://plugins.trac.wordpress.org/browser/stock-ticker/trunk/stock-ticker.php
CVE ID: CVE-2024-6364 State: PUBLISHED Published: 2025-05-13T17:00:07.443Z Last Updated: 2025-05-13T17:37:58.419Z Vendors: Absolute Security Products: Absolute Persistence Description: A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both physical access to the device, and full hostile network control, to initiate OS commands on the device. To remediate this vulnerability, update the device firmware to the latest available version. Please contact the device manufacturer for upgrade instructions or contact Absolute Security, see reference below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ons or contact Absolute Security, see reference below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.absolute.com/platform/vulnerability-archive/cve-2024-6364
CVE ID: CVE-2024-6365 State: PUBLISHED Published: 2024-07-09T03:33:03.786Z Last Updated: 2024-08-01T21:33:05.444Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: woobewoo Products: Product Table by WBW Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' function. This is due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file. This makes it possible for unauthenticated attackers to execute code on the server. Ad
e languages/customTitle.php file. This makes it possible for unauthenticated attackers to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba84711f-bdbe-46d3-a9a3-cc2b1dcefd1a?source=cve - https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/modules/wootablepress/models/wootablepress.php#L7 - https://plugins.trac.wordpress.org/browser/woo-product-tables/trunk/languages/customTitle.php - https://plugins.trac.wordpress.org/changeset/3113335/
CVE ID: CVE-2024-6366 State: PUBLISHED Published: 2024-07-29T06:00:08.248Z Last Updated: 2024-08-01T21:33:05.436Z Vendors: Unknown Products: User Profile Builder Problem Types: CWE-862 Missing Authorization Description: The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e/
CVE ID: CVE-2024-6367 State: PUBLISHED Published: 2024-06-27T11:31:04.154Z Last Updated: 2024-08-01T21:33:05.387Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: LabVantage Products: LIMS Problem Types: CWE-79 Description: A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?command=file&file=WEB-CORE/elements/files/filesembedded.jsp of the component POST Request Handler. The manipulation of the argument sdcid/keyid1/keyid2/keyid3 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of thi