Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ile) XCC, HX3720 Appliance (ThinkAgile) XCC, HX3721 Certified Node (ThinkAgile) XCC, HX5520 Appliance (ThinkAgile) XCC, HX5520-C Appliance (ThinkAgile) XCC, HX5521 Certified Node (ThinkAgile) XCC, HX5521-C Certified Node (ThinkAgile) XCC, HX5531 Certified Node (ThinkAgile) XCC, HX7520 Appliance (ThinkAgile) XCC, HX7521 Certified Node (ThinkAgile) XCC, HX7530 Appl for SAP HANA (ThinkAgile) XCC, HX7531 Certified Node (ThinkAgile) XCC, HX7531 Node SAP HANA (ThinkAgile) XCC, HX7820 Appliance (ThinkAgile) XCC, HX7821 Certified Node (ThinkAgile) XCC, MX Edge Appliance - MX1020 (ThinkAgile) XCC, MX3330-F All-flash Appliance (ThinkAgile) XCC, MX3330-H Hybrid Appliance (ThinkAgile) XCC, MX3331-F All-
hinkAgile) XCC, MX3330-F All-flash Appliance (ThinkAgile) XCC, MX3330-H Hybrid Appliance (ThinkAgile) XCC, MX3331-F All-flash Certified node (ThinkAgile) XCC, MX3331-H Hybrid Certified node (ThinkAgile) XCC, MX3530 F All flash Appliance (ThinkAgile) XCC, MX3530-H Hybrid Appliance (ThinkAgile) XCC, MX3531 H Hybrid Certified node (ThinkAgile) XCC, MX3531-F All-flash Certified node (ThinkAgile) XCC, P920 Rack Workstation (ThinkStation) XCC, SD530 (ThinkSystem) XCC, SD530 V3 (ThinkSystem) XCC, SD550 V3 (ThinkSystem) XCC, SD630 V2 (ThinkSystem) XCC, SD650 DWC Dual Node Tray (ThinkSystem) XCC, SD650 V2 (ThinkSystem) XCC, SD650 V3 (ThinkSystem) XCC, SD650-N V2 (ThinkSystem) XCC, SD665 V3 (ThinkSyst
nkSystem) XCC, SD650 V2 (ThinkSystem) XCC, SD650 V3 (ThinkSystem) XCC, SD650-N V2 (ThinkSystem) XCC, SD665 V3 (ThinkSystem) XCC, SE350 (ThinkSystem) XCC, SE350 V2 (ThinkEdge) XCC, SE360 V2 (ThinkEdge) XCC, SE450 (ThinkEdge) XCC, SE455 V3 (ThinkEdge) XCC, SN550 (ThinkSystem) XCC, SN550 V2 (ThinkSystem) XCC, SN850 (ThinkSystem) XCC, SR150 (ThinkSystem) XCC, SR158 (ThinkSystem) XCC, SR250 (ThinkSystem) XCC, SR250 V2 (ThinkSystem) XCC, SR250 V3 (ThinkSystem) XCC, SR258 (ThinkSystem) XCC, SR258 V2 (ThinkSystem) XCC, SR258 V3 (ThinkSystem) XCC, SR530 (ThinkSystem) XCC, SR550 (ThinkSystem) XCC, SR570 (ThinkSystem) XCC, SR590 (ThinkSystem) XCC, SR630 (ThinkSystem) XCC, SR630 V2 (ThinkSystem) XCC, SR
nkSystem) XCC, SR570 (ThinkSystem) XCC, SR590 (ThinkSystem) XCC, SR630 (ThinkSystem) XCC, SR630 V2 (ThinkSystem) XCC, SR630 V3 (ThinkSystem) XCC, SR635 V3 (ThinkSystem) XCC, SR645 (ThinkSystem) XCC, SR645 V3 (ThinkSystem) XCC, SR650 (ThinkSystem) XCC, SR650 V2 (ThinkSystem) XCC, SR650 V3 (ThinkSystem) XCC, SR655 V3 (ThinkSystem) XCC, SR665 (ThinkSystem) XCC, SR665 V3 (ThinkSystem) XCC, SR670 (ThinkSystem) XCC, SR670 V2 (ThinkSystem) XCC, SR675 V3 (ThinkSystem) XCC, SR850 (ThinkSystem) XCC, SR850 V2 (ThinkSystem) XCC, SR850 V3 (ThinkSystem) XCC, SR850P (ThinkSystem) XCC, SR860 (ThinkSystem) XCC, SR860 V2 (ThinkSystem) XCC, SR860 V3 (ThinkSystem) XCC, SR950 (ThinkSystem) XCC, SR950 V3 (ThinkSy
60 (ThinkSystem) XCC, SR860 V2 (ThinkSystem) XCC, SR860 V3 (ThinkSystem) XCC, SR950 (ThinkSystem) XCC, SR950 V3 (ThinkSystem) XCC, ST250 (ThinkSystem) XCC, ST250 V2 (ThinkSystem) XCC, ST258 (ThinkSystem) XCC, ST258 V2 (ThinkSystem) XCC, ST258 V3 (ThinkSystem) XCC, ST550 (ThinkSystem) XCC, ST650 V2 (ThinkSystem) XCC, ST650 V3 (ThinkSystem) XCC, ST658 V2 (ThinkSystem) XCC, ST658 V3 (ThinkSystem) XCC, ThinkAgile MX1021 on SE350 XCC, VX 1SE Certified Node (ThinkAgile) XCC, VX 2U4N Certified Node (ThinkAgile) XCC, VX 4U Certified Node (ThinkAgile) XCC, VX1320 (ThinkAgile) XCC, VX2320 (ThinkAgile) XCC, VX2330 Appliance (ThinkAgile) XCC, VX3320 (ThinkAgile) XCC, VX3330 Appliance (ThinkAgile) XCC, V
X2320 (ThinkAgile) XCC, VX2330 Appliance (ThinkAgile) XCC, VX3320 (ThinkAgile) XCC, VX3330 Appliance (ThinkAgile) XCC, VX3520-G (ThinkAgile) XCC, VX3530-G Appliance (ThinkAgile) XCC, VX3720 (ThinkAgile) XCC, VX5520 (ThinkAgile) XCC, VX5530 Appliance (ThinkAgile) XCC, VX635 V3 Integrated System (ThinkAgile) XCC, VX645 V3 Certified Node (ThinkAgile) XCC, VX645 V3 Integrated System (ThinkAgile) XCC, VX655 V3 Certified Node (ThinkAgile) XCC, VX655 V3 Integrated System (ThinkAgile) XCC, VX665 V3 Certified Node (ThinkAgile) XCC, VX665 V3 Integrated System (ThinkAgile) XCC, VX7320 N (ThinkAgile) XCC, VX7330 Appliance (Thinkagile) XCC, VX7520 (ThinkAgile) XCC, VX7520 N (ThinkAgile) XCC, VX7530 Appli
N (ThinkAgile) XCC, VX7330 Appliance (Thinkagile) XCC, VX7520 (ThinkAgile) XCC, VX7520 N (ThinkAgile) XCC, VX7530 Appliance (ThinkAgile) XCC, VX7531 Certified Node (ThinkAgile) XCC, VX7820 (ThinkAgile) XCC Problem Types: CWE-78 Description: A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-172051
CVE ID: CVE-2024-8279 State: PUBLISHED Published: 2024-09-13T17:27:30.967Z Last Updated: 2024-09-13T21:02:15.683Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: HX5530 Appliance (ThinkAgile) XCC, HX7530 Appliance (ThinkAgile) XCC, ST250 V3 (ThinkSystem) XCC, VX3331 Certified Node (ThinkAgile) XCC, HX Enclosure Certified Node (ThinkAgile) XCC, HX1021 Edge Certified Node 3yr (ThinkAgile) XCC, HX1320 Appliance (ThinkAgile) XCC, HX1321 Certified Node (ThinkAgile) XCC, HX1331 Certified Node (ThinkAgile) XCC, HX1520-R Appliance (ThinkAgile) XCC, HX1521-R Certified Node (ThinkAgile) XCC, HX2320-E Appliance (ThinkAgile) XCC, HX2321 Certified Node (Th
N (ThinkAgile) XCC, VX7330 Appliance (Thinkagile) XCC, VX7520 (ThinkAgile) XCC, VX7520 N (ThinkAgile) XCC, VX7530 Appliance (ThinkAgile) XCC, VX7531 Certified Node (ThinkAgile) XCC, VX7820 (ThinkAgile) XCC Problem Types: CWE-78 Description: A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-172051
CVE ID: CVE-2024-8280 State: PUBLISHED Published: 2024-09-13T17:27:39.022Z Last Updated: 2024-09-13T21:01:59.322Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: HX5530 Appliance (ThinkAgile) XCC, HX7530 Appliance (ThinkAgile) XCC, ST250 V3 (ThinkSystem) XCC, VX3331 Certified Node (ThinkAgile) XCC, HX Enclosure Certified Node (ThinkAgile) XCC, HX1021 Edge Certified Node 3yr (ThinkAgile) XCC, HX1320 Appliance (ThinkAgile) XCC, HX1321 Certified Node (ThinkAgile) XCC, HX1331 Certified Node (ThinkAgile) XCC, HX1520-R Appliance (ThinkAgile) XCC, HX1521-R Certified Node (ThinkAgile) XCC, HX2320-E Appliance (ThinkAgile) XCC, HX2321 Certified Node (Th
N (ThinkAgile) XCC, VX7330 Appliance (Thinkagile) XCC, VX7520 (ThinkAgile) XCC, VX7520 N (ThinkAgile) XCC, VX7530 Appliance (ThinkAgile) XCC, VX7531 Certified Node (ThinkAgile) XCC, VX7820 (ThinkAgile) XCC Problem Types: CWE-78 Description: An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or cause a recoverable denial of service using a specially crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-172051
CVE ID: CVE-2024-8281 State: PUBLISHED Published: 2024-09-13T17:27:48.442Z Last Updated: 2024-09-13T20:53:47.959Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: HX5530 Appliance (ThinkAgile) XCC, HX7530 Appliance (ThinkAgile) XCC, ST250 V3 (ThinkSystem) XCC, VX3331 Certified Node (ThinkAgile) XCC, HX Enclosure Certified Node (ThinkAgile) XCC, HX1021 Edge Certified Node 3yr (ThinkAgile) XCC, HX1320 Appliance (ThinkAgile) XCC, HX1321 Certified Node (ThinkAgile) XCC, HX1331 Certified Node (ThinkAgile) XCC, HX1520-R Appliance (ThinkAgile) XCC, HX1521-R Certified Node (ThinkAgile) XCC, HX2320-E Appliance (ThinkAgile) XCC, HX2321 Certified Node (Th
N (ThinkAgile) XCC, VX7330 Appliance (Thinkagile) XCC, VX7520 (ThinkAgile) XCC, VX7520 N (ThinkAgile) XCC, VX7530 Appliance (ThinkAgile) XCC, VX7531 Certified Node (ThinkAgile) XCC, VX7820 (ThinkAgile) XCC Problem Types: CWE-78 Description: An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-172051
CVE ID: CVE-2024-8282 State: PUBLISHED Published: 2024-10-02T09:31:59.026Z Last Updated: 2024-10-02T15:34:54.985Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vowelweb Products: Ibtana – WordPress Website Builder Problem Types: CWE-79 Description: The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:ive/ive-productscarousel' Gutenberg block in all versions up to, and including, 1.2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scri
his makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a281774-226a-4cb7-ba4a-ebb76f20eb47?source=cve - https://plugins.trac.wordpress.org/browser/ibtana-visual-editor/trunk/dist/blocks.build.js - https://wordpress.org/plugins/ibtana-visual-editor/#developers - https://plugins.trac.wordpress.org/changeset/3160421/
CVE ID: CVE-2024-8283 State: PUBLISHED Published: 2024-09-30T06:00:06.824Z Last Updated: 2024-10-01T14:08:52.155Z Vendors: Unknown Products: Slider by 10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a60aed55-c0a2-4912-8844-cdddf31d90b6/
CVE ID: CVE-2024-8284 State: PUBLISHED Published: 2025-05-15T20:07:14.565Z Last Updated: 2025-05-17T03:21:56.815Z Vendors: Unknown Products: Download Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/93e38b8c-8a2e-4264-b520-ebdbe995d61e/
CVE ID: CVE-2024-8285 State: PUBLISHED Published: 2024-08-30T21:10:52.324Z Last Updated: 2025-11-20T20:57:19.811Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Streams for Apache Kafka 2.8.0, streams for Apache Kafka Problem Types: CWE-297 Description: A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing
attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. This issue is considered a high complexity attack, with additional high privileges required, as the attack would need access to the Kroxylicious configuration or a peer system. The result of a successful attack impacts both data integrity and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:9571 - https://access.redhat.com/security/cve/CVE-2024-8285 - https://bugzilla.redhat.com/show_bug.cgi?id=2308606
CVE ID: CVE-2024-8286 State: PUBLISHED Published: 2025-05-15T20:07:14.783Z Last Updated: 2025-05-17T03:20:31.865Z Vendors: Unknown Products: webtoffee-gdpr-cookie-consent Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/628bbac0-76b1-4666-9c00-bae84b48f85c/
CVE ID: CVE-2024-8287 State: PUBLISHED Published: 2024-09-18T18:35:25.803Z Last Updated: 2024-09-19T20:25:24.637Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canonical Ltd. Products: Anbox Cloud Problem Types: CWE-295 Description: Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discourse.ubuntu.com/t/anbox-cloud-1-23-1-has-been-released/481
st Notes: - CISA ADP Vulnrichment: References: - https://discourse.ubuntu.com/t/anbox-cloud-1-23-1-has-been-released/48141 - https://bugs.launchpad.net/anbox-cloud/+bug/2077570 - https://www.cve.org/CVERecord?id=CVE-2024-8287
CVE ID: CVE-2024-8288 State: PUBLISHED Published: 2024-10-01T08:30:15.453Z Last Updated: 2024-10-01T13:47:39.023Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: adreastrian Products: Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg Problem Types: CWE-79 Description: The Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:guten-post-layout/post-grid' Gutenberg block in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authen
p to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d6d9852-424a-4d98-9926-e849bef99c2d?source=cve - https://plugins.trac.wordpress.org/browser/guten-post-layout/trunk/src/blocks/post-grid/post-grid.php#L300 - https://wordpress.org/plugins/guten-post-layout/#developers - https://plugins.trac.wordpress.org/browser/guten-post-layout/trunk/src/blo
s.org/plugins/guten-post-layout/#developers - https://plugins.trac.wordpress.org/browser/guten-post-layout/trunk/src/blocks/post-grid/post-grid.php#L27
CVE ID: CVE-2024-8289 State: PUBLISHED Published: 2024-09-04T08:30:38.531Z Last Updated: 2024-09-04T14:08:02.811Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wcmp Products: MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution Problem Types: CWE-862 Description: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the update_item_permissions_check and create_item_permissions_check functions in all versions up to, and including, 4.2.0. This makes it possible for unauthenticate
_item_permissions_check functions in all versions up to, and including, 4.2.0. This makes it possible for unauthenticated attackers to change the password of any user with the vendor role, create new users with the vendor role, and demote other users like administrators to the vendor role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a85fbaff-d566-4ed2-8943-c174e0c4d2d8?source=cve - https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.0/api/class-mvx-rest-vendors-controller.php#L705 - https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.0/api/class-mvx-rest-vend
ler.php#L705 - https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.0/api/class-mvx-rest-vendors-controller.php#L641 - https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.0/api/class-mvx-rest-vendors-controller.php#L382 - https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/api/class-mvx-rest-vendors-controller.php?rev=3145638
CVE ID: CVE-2024-8290 State: PUBLISHED Published: 2024-09-25T06:49:01.430Z Last Updated: 2024-09-25T13:21:08.505Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wclovers Products: WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Problem Types: CWE-639 Description: The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFM_Customers_Manage_Controller::processing function due to missing validation on the ID user controlled key. This makes it possible for
nage_Controller::processing function due to missing validation on the ID user controlled key. This makes it possible for authenticated attackers, with subscriber/customer-level access and above, to change the email address of administrator user accounts which allows them to reset the password and access the administrator account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79172fe3-c0cf-48c4-8bc5-862c628c1a09?source=cve - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.12/controllers/customers/wcfm-controller-customers-manage.php#L97 - https://plugins.trac.wordpress.org/changeset/3156433/wc
controllers/customers/wcfm-controller-customers-manage.php#L97 - https://plugins.trac.wordpress.org/changeset/3156433/wc-frontend-manager/trunk/controllers/customers/wcfm-controller-customers-manage.php
CVE ID: CVE-2024-8291 State: PUBLISHED Published: 2024-09-24T21:17:00.734Z Last Updated: 2025-01-17T21:44:15.351Z Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-22 Description: Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 5.1 with vector https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks, Alexey Solovyev for reporting. (CNA updated this risk rank on 17 Ja
T:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks, Alexey Solovyev for reporting. (CNA updated this risk rank on 17 Jan 2025 by lowering the AC based on CVSS 4.0 documentation that access privileges should not be considered for AC). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/pull/12183 - https://github.com/concretecms/concretecms/commit/dbce253166f6b10ff3e0c09e50fd395370b8b065 - https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes - https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes
CVE ID: CVE-2024-8292 State: PUBLISHED Published: 2024-09-06T06:50:52.522Z Last Updated: 2024-09-06T13:31:51.951Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wppost Products: WP-Recall – Registration, Profile, Commerce & More Problem Types: CWE-639 Description: The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for unauthenticated attackers to supply any email through the user_email field and update the password f
kes it possible for unauthenticated attackers to supply any email through the user_email field and update the password for that user during new order creation. This requires the commerce addon to be enabled in order to exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa4b5df-dc71-49de-880b-895eb1d9cdca?source=cve - https://plugins.trac.wordpress.org/browser/wp-recall/tags/16.26.8/add-on/commerce/functions-frontend.php#L113 - https://plugins.trac.wordpress.org/browser/wp-recall/tags/16.26.8/add-on/commerce/classes/class-rcl-create-order.php#L127 - https://plugins.trac.wordpress.org/browser/wp-recall/tags/16.26
dd-on/commerce/classes/class-rcl-create-order.php#L127 - https://plugins.trac.wordpress.org/browser/wp-recall/tags/16.26.8/rcl-functions.php#L1339 - https://plugins.trac.wordpress.org/changeset/3145798/wp-recall/trunk/add-on/commerce/classes/class-rcl-create-order.php
CVE ID: CVE-2024-8294 State: PUBLISHED Published: 2024-08-29T11:00:22.696Z Last Updated: 2024-08-29T13:36:22.826Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: FeehiCMS Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1. This affects the function update of the file /admin/index.php?r=friendly-link%2Fupdate. The manipulation of the argument FriendlyLink[image] leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Addition
lic and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276069 - https://vuldb.com/?ctiid.276069 - https://vuldb.com/?submit.394556 - https://gitee.com/A0kooo/cve_article/blob/master/feehi_cms/Fichkems%20Friendley-Link%20file%20upload%20vulnerability.md
CVE ID: CVE-2024-8295 State: PUBLISHED Published: 2024-08-29T12:00:12.891Z Last Updated: 2024-08-29T13:34:45.590Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: FeehiCMS Problem Types: CWE-434 Description: A vulnerability has been found in FeehiCMS up to 2.1.1 and classified as critical. This vulnerability affects the function createBanner of the file /admin/index.php?r=banner%2Fbanner-create. The manipulation of the argument BannerForm[img] leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Addit
public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276070 - https://vuldb.com/?ctiid.276070 - https://vuldb.com/?submit.394560 - https://gitee.com/A0kooo/cve_article/blob/master/feehi_cms/file_upload2/Fichkems%20banner%20file%20upload%20vulnerability.md