Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10009 State: PUBLISHED Published: 2025-05-15T20:06:39.335Z Last Updated: 2025-05-20T16:16:16.662Z Vendors: Unknown Products: Melapress File Monitor Problem Types: CWE-89 SQL Injection Description: The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c2b1f9f4-d5f3-4975-afd1-50eaf193e2ab/
CVE ID: CVE-2024-10010 State: PUBLISHED Published: 2024-12-12T06:00:09.430Z Last Updated: 2024-12-12T15:10:49.393Z Vendors: Unknown Products: LearnPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8a258d33-a354-4cbb-bfcb-31b7f1b1a036/
CVE ID: CVE-2024-10011 State: PUBLISHED Published: 2024-10-25T06:51:24.333Z Last Updated: 2024-10-25T14:11:50.388Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: buddypress Products: BuddyPress Problem Types: CWE-22 Description: The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files
ile uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions. This vulnerability only affects Windows. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4327f414-64f4-4193-a5c0-2a5ecdd75e11?source=cve - https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1370 - https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1270 - https://codex.buddypress.org/releases/version-14-2-1/ - https://plugins.trac.wordpress.org/changeset/3173924/buddypress/trunk/bp-core/bp-core-avatars.php?c
es/version-14-2-1/ - https://plugins.trac.wordpress.org/changeset/3173924/buddypress/trunk/bp-core/bp-core-avatars.php?contextall=1&old=3102524&old_path=%2Fbuddypress%2Ftrunk%2Fbp-core%2Fbp-core-avatars.php
CVE ID: CVE-2024-10012 State: PUBLISHED Published: 2024-11-13T15:19:06.329Z Last Updated: 2024-11-13T19:34:56.312Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik UI for WPF Problem Types: CWE-502 Description: In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1111), a code execution attack is possible through an insecure deserialization vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/wpf/knowledge-base/kb-security-unsafe-deserialization-cve-2024-10012
CVE ID: CVE-2024-10013 State: PUBLISHED Published: 2024-11-13T15:17:07.237Z Last Updated: 2024-11-13T19:43:38.067Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik UI for WinForms Problem Types: CWE-502 Description: In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/winforms/knowledge-base/unsafe-deserialization-cve-2024-10013
CVE ID: CVE-2024-10014 State: PUBLISHED Published: 2024-10-18T04:32:57.342Z Last Updated: 2024-10-18T16:35:07.974Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tiandi Products: Flat UI Button Problem Types: CWE-79 Description: The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec5474ac-62d7-4431-b789-51c831dd1c20?source=cve - https://wordpress.org/plugins/flat-ui-button/#developers
CVE ID: CVE-2024-10015 State: PUBLISHED Published: 2024-11-16T03:20:50.139Z Last Updated: 2024-11-16T15:14:53.881Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jorisderuiter Products: ConvertCalculator for WordPress Problem Types: CWE-79 Description: The ConvertCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'type' parameters in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acc
with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1f55b51-cc93-4f45-9666-03740e147277?source=cve - https://wordpress.org/plugins/convertcalculator/#developers
CVE ID: CVE-2024-10016 State: PUBLISHED Published: 2024-10-25T08:34:40.071Z Last Updated: 2024-10-25T15:20:05.066Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jaredatch Products: File Upload Types by WPForms Problem Types: CWE-79 Description: The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additiona
s and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17988a66-5b48-4f57-96f8-74e539bc875e?source=cve - https://wordpress.org/plugins/file-upload-types/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3174398%40file-upload-types&old=3119996%40file-upload-types&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3174398/
CVE ID: CVE-2024-10017 State: PUBLISHED Published: 2024-11-16T03:20:44.022Z Last Updated: 2024-11-16T15:14:35.481Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: westi Products: PJW Mime Config Problem Types: CWE-79 Description: The PJW Mime Config plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vuln
web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2731e8ed-27db-4d2b-b76f-8fdccfb2226a?source=cve - https://wordpress.org/plugins/pjw-mime-config
CVE ID: CVE-2024-10018 State: PUBLISHED Published: 2024-10-16T02:33:13.144Z Last Updated: 2024-10-16T17:20:15.523Z Vendors: TECNO Products: com.transsion.aivoiceassistant Problem Types: CWE-732 Description: Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.tecno.com/SRC/blogdetail/323?lang=en_US - https://security.tecno.com/SRC/securityUpdates?type=SA
CVE ID: CVE-2024-10019 State: PUBLISHED Published: 2025-03-20T10:10:14.994Z Last Updated: 2025-10-15T12:50:07.232Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-78 Description: A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the `app_name` parameter, enabling an attacker to upload a malicious `server.py` file and execute arbitrary code by exploiting the path traversal vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.co
ting the path traversal vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3cf80890-2d8a-4fc7-8e0e-6d4bf648b3ea
CVE ID: CVE-2024-10020 State: PUBLISHED Published: 2024-11-06T06:43:30.854Z Last Updated: 2025-02-19T17:42:12.444Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: heateor Products: Heateor Social Login WordPress Problem Types: CWE-287 Description: The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they have access to the email and the user does not have an already-existing account
s any existing user on the site, if they have access to the email and the user does not have an already-existing account for the service returning the token. An attacker cannot authenticate as an administrator by default, but these accounts are also at risk if authentication for administrators has explicitly been allowed via the social login. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1d212b-75fe-4285-9c22-62b040e5a36c?source=cve - https://plugins.trac.wordpress.org/changeset/3177729/
CVE ID: CVE-2024-10021 State: PUBLISHED Published: 2024-10-16T12:00:07.602Z Last Updated: 2024-10-16T14:49:14.697Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /php/manage_purchase.php?action=search&tag=VOUCHER_NUMBER. The manipulation of the argument text leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichme
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280556 - https://vuldb.com/?ctiid.280556 - https://vuldb.com/?submit.424334 - https://gist.github.com/higordiego/439f2af836c2c7d6075ba9de2e1169da - https://code-projects.org/
CVE ID: CVE-2024-10022 State: PUBLISHED Published: 2024-10-16T12:00:09.221Z Last Updated: 2024-10-16T14:45:34.129Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the file /php/manage_supplier.php?action=search. The manipulation of the argument text leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280557 - https://vuldb.com/?ctiid.280557 - https://vuldb.com/?submit.424337 - https://gist.github.com/higordiego/2bd0a94e480906a60ce83b8a4ec26957 - https://code-projects.org/
CVE ID: CVE-2024-10023 State: PUBLISHED Published: 2024-10-16T13:00:05.518Z Last Updated: 2024-10-16T15:08:11.533Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /php/add_new_medicine.php. The manipulation of the argument name/packing/generic_name/suppliers_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280558 - https://vuldb.com/?ctiid.280558 - https://vuldb.com/?submit.424483 - https://gist.github.com/higordiego/01a35a20a4e20e937d384b677c000921 - https://code-projects.org/
CVE ID: CVE-2024-10024 State: PUBLISHED Published: 2024-10-16T13:00:07.218Z Last Updated: 2024-10-16T15:10:37.074Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. This issue affects some unknown processing of the file /php/manage_medicine_stock.php. The manipulation of the argument name/packing/generic_name/suppliers_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280559 - https://vuldb.com/?ctiid.280559 - https://vuldb.com/?submit.424529 - https://gist.github.com/higordiego/b0083f7f12dee245c2fbe7102e31d9a4 - https://code-projects.org/
CVE ID: CVE-2024-10025 State: PUBLISHED Published: 2024-10-17T09:58:03.111Z Last Updated: 2024-10-17T16:33:53.645Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: SICK AG Products: SICK CLV6xx, SICK Lector6xx, SICK RFx6xx Problem Types: CWE-798 Description: A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.cisa.gov/resource
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.pdf - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0003.json
CVE ID: CVE-2024-10026 State: PUBLISHED Published: 2025-01-30T19:12:27.994Z Last Updated: 2025-02-24T11:50:42.192Z Vendors: Google Products: gVisor Problem Types: CWE-328, CWE-339 Description: A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/google/gvisor/commit/f956b5ac17ae1f60a4d21999b59ba18c55f86d56 - https://github.com/google/gvisor/commit/e54bfde79278cafadedbf73c68ee10cb5982f2af - https://github.com/google/gvisor/commit/83f750
ithub.com/google/gvisor/commit/e54bfde79278cafadedbf73c68ee10cb5982f2af - https://github.com/google/gvisor/commit/83f75082e5b03fafca9201d9d9939028f712b0b2 - https://www.ndss-symposium.org/wp-content/uploads/2025-122-paper.pdf
CVE ID: CVE-2024-10027 State: PUBLISHED Published: 2024-11-07T06:00:05.843Z Last Updated: 2024-11-07T16:38:23.471Z Vendors: Unknown Products: WP Booking Calendar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a94c7b64-720a-47f1-a74a-691c3a9ed3a1/
CVE ID: CVE-2024-10028 State: PUBLISHED Published: 2024-11-05T23:28:42.426Z Last Updated: 2024-11-06T15:11:04.780Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: everestthemes Products: Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin Problem Types: CWE-922 Description: The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.13 via the exposed process stats file during the backup process. This makes it possible for unauthenticated attackers to obtain an archive file name and download the site's bac
process. This makes it possible for unauthenticated attackers to obtain an archive file name and download the site's backup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9b871957-a2b3-492f-b461-7040d9098b2b?source=cve - https://plugins.trac.wordpress.org/browser/everest-backup/tags/2.2.13/inc/classes/class-backup-directory.php#L514
CVE ID: CVE-2024-10029 State: PUBLISHED Published: 2025-07-16T10:55:35.408Z Last Updated: 2025-07-16T14:39:05.571Z Vendors: Eclipse Foundation Products: Eclipse Glassfish Problem Types: CWE-79 Description: In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/40
CVE ID: CVE-2024-10031 State: PUBLISHED Published: 2025-07-16T11:02:51.419Z Last Updated: 2025-07-16T14:38:59.823Z Vendors: Eclipse Foundation Products: Eclipse Glassfish Problem Types: CWE-79 Description: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/41
CVE ID: CVE-2024-10032 State: PUBLISHED Published: 2025-07-16T11:07:55.848Z Last Updated: 2025-07-16T14:38:55.074Z Vendors: Eclipse Foundation Products: Eclipse Glassfish Problem Types: CWE-79 Description: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/42
CVE ID: CVE-2024-10033 State: PUBLISHED Published: 2024-10-16T16:59:43.968Z Last Updated: 2025-11-20T18:11:34.539Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 Problem Types: CWE-79 Description: A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data. Additional Analyst Notes: - CISA ADP Vu
can lead to redirecting, injecting malicious script, stealing sessions and data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:8534 - https://access.redhat.com/security/cve/CVE-2024-10033 - https://bugzilla.redhat.com/show_bug.cgi?id=2319162
CVE ID: CVE-2024-10034 State: PUBLISHED Published: 2024-11-22T05:33:41.576Z Last Updated: 2024-11-22T11:34:08.768Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: gallerycreator Products: Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery Problem Types: CWE-79 Description: The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery link text parameter in all versions up to, and including, 3.2.4.2 due to insufficient input sanitization and outp
allery link text parameter in all versions up to, and including, 3.2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89bd70b2-0b5f-4edb-890b-d291bdb8a851?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3192798%40simply-gallery-block%2Ftrunk&old=3176753%40simply-gallery-block%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10035 State: PUBLISHED Published: 2024-11-04T11:48:53.789Z Last Updated: 2025-10-14T12:21:57.783Z Vendors: BG-TEK Informatics Security Technologies Products: CoslatV3 Problem Types: CWE-94, CWE-77, CWE-78 Description: Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in a Command ('Command Injection'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in BG-TEK Informatics Security Technologies CoslatV3 allows Command Injection, Privilege Escalation.This issue affects CoslatV3: through 3.1069. NOTE: The vendor was contacted and it was learned that the product is n
ion.This issue affects CoslatV3: through 3.1069. NOTE: The vendor was contacted and it was learned that the product is not supported. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1814
CVE ID: CVE-2024-10037 State: PUBLISHED Published: 2025-03-25T12:22:07.815Z Last Updated: 2025-03-31T16:17:05.591Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: RTU500 Problem Types: CWE-476 Description: A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection. An attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability. The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability