Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5000 State: PUBLISHED Published: 2024-06-04T08:54:06.522Z Last Updated: 2024-08-01T20:55:10.389Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: CODESYS Products: CODESYS Control for BeagleBone SL, CODESYS Control for emPC-A/iMX6 SL, CODESYS Control for IOT2000 SL, CODESYS Control for Linux ARM SL, CODESYS Control for Linux SL, CODESYS Control for PFC100 SL, CODESYS Control for PFC200 SL, CODESYS Control for PLCnext SL, CODESYS Control for Raspberry Pi SL, CODESYS Control for WAGO Touch Panels 600 SL, CODESYS Control RTE (for Beckhoff CX) SL, CODESYS Control RTE (SL), CODESYS Runtime Toolkit, CODESYS Control Win (SL), CODESYS HMI (SL) Problem
Beckhoff CX) SL, CODESYS Control RTE (SL), CODESYS Runtime Toolkit, CODESYS Control Win (SL), CODESYS HMI (SL) Problem Types: CWE-131 Description: An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-026 - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=18355&token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1&download=
CVE ID: CVE-2024-5001 State: PUBLISHED Published: 2024-06-06T02:02:57.776Z Last Updated: 2024-08-01T20:55:10.386Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: biplob018 Products: Image Hover Effects for Elementor with Lightbox and Flipbox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id', 'oxi_addons_f_title_tag', and 'content_description_tag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and outpu
description_tag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c384f05-96dd-47bb-822d-16212527091a?source=cve - https://plugins.trac.wordpress.org/browser/image-hover-effects-with-carousel/trunk/Modules/Image/Data.php#L2838 - https://plugins.trac.wordpress.org/browser/image-hover-effect
effects-with-carousel/trunk/Modules/Image/Data.php#L2838 - https://plugins.trac.wordpress.org/browser/image-hover-effects-with-carousel/trunk/Modules/Flipbox/Flipbox.php#L3211 - https://plugins.trac.wordpress.org/browser/image-hover-effects-with-carousel/trunk/Modules/Caption/Caption.php#L2622
CVE ID: CVE-2024-5002 State: PUBLISHED Published: 2024-07-13T06:00:07.139Z Last Updated: 2024-08-01T20:55:10.411Z Vendors: Unknown Products: User Submitted Posts Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/da09b99a-fa40-428f-80b4-0af764fd2f4f/
CVE ID: CVE-2024-5003 State: PUBLISHED Published: 2024-06-07T06:00:03.057Z Last Updated: 2025-03-14T15:37:17.542Z Vendors: Unknown Products: WP Stacker Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1d7d0372-bbc5-40b2-a668-253c819415c4/
CVE ID: CVE-2024-5004 State: PUBLISHED Published: 2024-07-22T06:00:01.790Z Last Updated: 2024-08-01T20:55:10.410Z Vendors: Unknown Products: CM Popup Plugin for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4bea7baa-84a2-4b21-881c-4f17822329e7/
CVE ID: CVE-2024-5005 State: PUBLISHED Published: 2024-10-11T11:30:57.104Z Last Updated: 2024-10-11T13:41:55.311Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-684 Description: An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5, all versions starting from 17.4 before 17.4.2 It was possible for guest users to disclose project templates using the API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/462108 - https://hackerone.com/reports/2501461
CVE ID: CVE-2024-5006 State: PUBLISHED Published: 2024-06-05T07:34:53.193Z Last Updated: 2024-08-01T20:55:10.382Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: duongancol Products: Boostify Header Footer Builder for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level
cient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72c2a5d4-f201-4cc8-ac49-cde1160ca468?source=cve - https://plugins.trac.wordpress.org/browser/boostify-header-footer-builder/trunk/inc/elementor/widgets/class-mega-menu.php#L525 - https://plugins.trac.wordpress.org/browser/boostify-header-footer-builder/trunk/inc/elementor/widgets/class-mega-menu-vertical.php#L
ins.trac.wordpress.org/browser/boostify-header-footer-builder/trunk/inc/elementor/widgets/class-mega-menu-vertical.php#L393 - https://plugins.trac.wordpress.org/changeset/3097085/#file9 - https://wordpress.org/plugins/boostify-header-footer-builder/#developers
CVE ID: CVE-2024-5007 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:33.567Z Description: No description available.
CVE ID: CVE-2024-5008 State: PUBLISHED Published: 2024-06-25T19:57:16.744Z Last Updated: 2024-08-01T20:55:10.375Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-434 Description: In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Secur
References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE ID: CVE-2024-5009 State: PUBLISHED Published: 2024-06-25T19:58:48.237Z Last Updated: 2024-08-01T20:55:10.390Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-269 Description: In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE ID: CVE-2024-5010 State: PUBLISHED Published: 2024-06-25T20:00:07.728Z Last Updated: 2025-02-13T17:53:45.609Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-200 Description: In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. A specially crafted unauthenticated HTTP request can lead to a disclosure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulleti
: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1933
CVE ID: CVE-2024-5011 State: PUBLISHED Published: 2024-06-25T20:01:47.996Z Last Updated: 2025-02-13T17:53:46.175Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-400 Description: In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request to the TestController Chart functionality can lead to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-
Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1934
CVE ID: CVE-2024-5012 State: PUBLISHED Published: 2024-06-25T20:10:33.358Z Last Updated: 2024-08-01T20:55:10.401Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-287 Description: In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unauthenticated attackers to disclose Windows Credentials stored in the product Credential Library. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress
ichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE ID: CVE-2024-5013 State: PUBLISHED Published: 2024-06-25T20:11:58.100Z Last Updated: 2024-08-01T20:55:10.406Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-400 Description: In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.pr
Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE ID: CVE-2024-5014 State: PUBLISHED Published: 2024-06-25T20:13:21.304Z Last Updated: 2024-08-01T20:55:10.440Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-918 Description: In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-
- https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE ID: CVE-2024-5015 State: PUBLISHED Published: 2024-06-25T20:15:07.575Z Last Updated: 2024-08-01T20:55:10.387Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-918 Description: In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to Admin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monito
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE ID: CVE-2024-5016 State: PUBLISHED Published: 2024-06-25T20:23:46.895Z Last Updated: 2024-08-01T20:55:10.382Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-502 Description: In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing routines NmDistributed.DistributedServiceBehavior.OnMessage for server and NmDistributed.DistributedClient.OnMessage for clients. Additional Analyst Notes: - CISA ADP Vulnrichment:
or server and NmDistributed.DistributedClient.OnMessage for clients. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE ID: CVE-2024-5017 State: PUBLISHED Published: 2024-06-25T20:25:37.761Z Last Updated: 2025-02-13T17:53:46.772Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-22 Description: In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. A specially crafted unauthenticated HTTP request to AppProfileImport can lead can lead to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June
tps://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1932
CVE ID: CVE-2024-5018 State: PUBLISHED Published: 2024-06-25T20:27:11.395Z Last Updated: 2024-08-01T20:55:10.444Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-22 Description: In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNMScript. This allows allows reading of any file from the applications web-root directory . Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/
nt: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE ID: CVE-2024-5019 State: PUBLISHED Published: 2024-06-25T20:29:00.522Z Last Updated: 2024-08-01T20:55:10.378Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-22 Description: In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS. This vulnerability allows reading of any file with iisapppool\NmConsole privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s
t: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
CVE ID: CVE-2024-5020 State: PUBLISHED Published: 2024-12-04T08:22:46.855Z Last Updated: 2024-12-04T14:09:09.188Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: extendthemes, smub, bqworks, 10web, jetmonsters, firelightwp, dfactory, shapedplugin, colorlibplugins, nko, wpclever, Easy Social Feed, foliovision Products: Colibri Page Builder, Gallery Plugin for WordPress – Envira Photo Gallery, Accordion Slider, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder, Getwid – Gutenberg Blocks, Firelight Lightbox, Responsive Lightbox & Gallery, Carousel, Slider, Gallery by WP Carousel – Image Carousel with Lightbox & Photo Gallery, Video Slider,
htbox & Gallery, Carousel, Slider, Gallery by WP Carousel – Image Carousel with Lightbox & Photo Gallery, Video Slider, Post Carousel & Post Grid, Product Carousel & Product Grid, FancyBox for WordPress, Visual Portfolio, Photo Gallery & Post Grid, Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery, WPC Smart Quick View for WooCommerce, Easy Social Feed Premium, FV Flowplayer Video Player Problem Types: CWE-79 Description: Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes
3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=cve - https://plugins.trac.wordpress.org/changeset/3150376/woo-smart-quick-view - https://plugins.trac.wordpress.org/changeset/3153081/colibri-page-builder - https://plugins.trac.wordpress.org/changeset/3157076/nextg
s.trac.wordpress.org/changeset/3153081/colibri-page-builder - https://plugins.trac.wordpress.org/changeset/3157076/nextgen-gallery - https://plugins.trac.wordpress.org/changeset/3158415/envira-gallery-lite - https://plugins.trac.wordpress.org/changeset/3156791/form-maker - https://plugins.trac.wordpress.org/changeset/3160432/visual-portfolio - https://plugins.trac.wordpress.org/changeset/3161422/fv-wordpress-flowplayer - https://plugins.trac.wordpress.org/changeset/3160232/easy-fancybox - https://plugins.trac.wordpress.org/changeset/3161892/wp-carousel-free - https://plugins.trac.wordpress.org/changeset/3173097/responsive-lightbox - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfp
s.trac.wordpress.org/changeset/3173097/responsive-lightbox - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3175577%40getwid%2Ftrunk&old=3119180%40getwid%2Ftrunk&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3186301%40fancybox-for-wordpress%2Ftrunk&old=3058912%40fancybox-for-wordpress%2Ftrunk&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3169926/accordion-slider
CVE ID: CVE-2024-5021 State: PUBLISHED Published: 2024-06-19T03:12:28.669Z Last Updated: 2024-08-01T20:55:10.394Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: nimble3 Products: WordPress Picture / Portfolio / Media Gallery Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.1 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify
ers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/224a2d6d-7fdc-43a8-a8c9-26213b604433?source=cve - https://plugins.trac.wordpress.org/browser/nimble-portfolio/trunk/includes/prettyphoto/download-image.php#L17
CVE ID: CVE-2024-5022 State: PUBLISHED Published: 2024-05-17T18:42:24.791Z Last Updated: 2024-10-28T20:14:31.596Z Vendors: Mozilla Products: Focus for iOS Problem Types: URLs with file scheme could have been used to spoof addresses in the location bar Description: The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affects Focus for iOS < 126. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1874560 - https://www.mozilla.org/security/advisories/mfsa2024-24/
CVE ID: CVE-2024-5023 State: PUBLISHED Published: 2024-05-16T18:05:40.240Z Last Updated: 2024-08-01T21:03:09.642Z Vendors: Netflix Products: ConsoleMe Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-002.md
CVE ID: CVE-2024-5024 State: PUBLISHED Published: 2024-08-30T03:24:15.980Z Last Updated: 2024-08-30T14:06:36.442Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: MemberPress Products: Memberpress Problem Types: CWE-79 Description: The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mepr_screenname' and 'mepr_key' parameter in all versions up to, and including, 1.11.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a