Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416, CWE-591 Description: Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability Additional An
escription: Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49126
CVE ID: CVE-2024-49127 State: PUBLISHED Published: 2024-12-10T17:49:47.340Z Last Updated: 2025-05-13T15:25:46.023Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Additional Analyst Notes: -
n: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49127
CVE ID: CVE-2024-49128 State: PUBLISHED Published: 2024-12-10T17:49:47.953Z Last Updated: 2025-05-13T15:25:50.284Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-591, CWE-416 Descri
ation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-591, CWE-416 Description: Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49128
CVE ID: CVE-2024-49129 State: PUBLISHED Published: 2024-12-10T17:49:27.121Z Last Updated: 2025-05-13T15:25:31.155Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-400 Description: Wi
ation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-400 Description: Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49129
CVE ID: CVE-2024-49132 State: PUBLISHED Published: 2024-12-10T17:49:27.674Z Last Updated: 2025-05-13T15:25:31.852Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-591, CWE-416 Description: Windows Remote Desktop Services
indows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-591, CWE-416 Description: Windows Remote Desktop Services Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49132
CVE ID: CVE-2024-49138 State: PUBLISHED Published: 2024-12-10T17:49:48.419Z Last Updated: 2025-10-21T22:55:34.532Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-122 Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnr
n: Windows Common Log File System Driver Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138
CVE ID: CVE-2024-49142 State: PUBLISHED Published: 2024-12-10T17:49:33.983Z Last Updated: 2025-05-13T15:25:32.461Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Access 2016 (32-bit edition), Microsoft Access 2016 (64-bit edition) Problem Types: CWE-416 Description: Microsoft Access Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49142
CVE ID: CVE-2024-49147 State: PUBLISHED Published: 2024-12-12T19:07:35.528Z Last Updated: 2025-05-13T15:25:33.153Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Update Catalog Problem Types: CWE-502 Description: Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49147
CVE ID: CVE-2024-49193 State: PUBLISHED Published: 2024-10-12T00:00:00 Last Updated: 2024-10-16T20:06:28.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and used to grant additional authorization for ticket viewing, the mechanism for detecting spoofed e-mail messages is insufficient, and the support e-mail addresses associated with individual tickets are predictable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b9d2cf2e52 - https://news.ycombina
ulnrichment: References: - https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b9d2cf2e52 - https://news.ycombinator.com/item?id=41818459 - https://x.com/hackermondev/status/1844877950698537323
CVE ID: CVE-2024-49194 State: PUBLISHED Published: 2024-12-17T00:00:00.000Z Last Updated: 2025-07-02T11:57:43.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.datab
RL that uses the property krbJAASFile. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.databricks.com/en_US/data-sources/security-bulletin-databricks-jdbc-driver-vulnerability-advisory-cve-2024-49194
CVE ID: CVE-2024-49195 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-11-25T20:53:41.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/ - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-10-1/
CVE ID: CVE-2024-49196 State: PUBLISHED Published: 2025-05-27T00:00:00.000Z Last Updated: 2025-05-29T18:25:48.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. Type confusion leads to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-49196/
CVE ID: CVE-2024-49197 State: PUBLISHED Published: 2025-05-27T00:00:00.000Z Last Updated: 2025-05-29T18:23:26.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack of a boundary check in STOP_KEEP_ALIVE_OFFLOAD leads to out-of-bounds access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-49197/
CVE ID: CVE-2024-49200 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-16T18:30:42.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. This can be leveraged by an attacker to perform arbitrary writes, potentially leading to arbitrary code execution. The issue has been fixed in kernel 5.2, Version 05.29.44; kernel 5.3, Version 05.38.44; kernel 5.4, Version 05.46.44
on. The issue has been fixed in kernel 5.2, Version 05.29.44; kernel 5.3, Version 05.38.44; kernel 5.4, Version 05.46.44; kernel 5.5, Version 05.54.44; kernel 5.6, Version 05.61.44; and kernel 5.7, Version 05.70.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/SA-2024015
CVE ID: CVE-2024-49201 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-20T23:32:02.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://keyfactor.com - https://github.com/Keyfactor/remote-file-orchestrator/releases/tag/2.8.1
CVE ID: CVE-2024-49202 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-20T23:29:51.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://keyfactor.com - https://software.keyfactor.com/Core-OnPrem/v12.5/Content/ReleaseNotes/ReleaseNoteDetails-12_5.htm
CVE ID: CVE-2024-49203 State: PUBLISHED Published: 2024-11-20T00:00:00.000Z Last Updated: 2025-02-21T16:52:31.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/querydsl/querydsl/releases/tag/QUERYDSL_5_1_0 - https://www.csirt.sk/querydsl-java-library-vulnerability-permits-sql-hql-injection.html - https://github.com/querydsl/querydsl
//www.csirt.sk/querydsl-java-library-vulnerability-permits-sql-hql-injection.html - https://github.com/querydsl/querydsl/issues/3757 - https://github.com/OpenFeign/querydsl/ - https://github.com/OpenFeign/querydsl/releases/tag/5.6.1 - https://github.com/OpenFeign/querydsl/pull/742 - https://github.com/advisories/GHSA-6q3q-6v5j-h6vg - https://github.com/OpenFeign/querydsl/releases/tag/6.10.1 - https://github.com/OpenFeign/querydsl/pull/743 - https://github.com/spring-projects/spring-data-jpa/issues/3693
CVE ID: CVE-2024-49208 State: PUBLISHED Published: 2024-10-22T00:00:00.000Z Last Updated: 2025-03-14T15:45:54.023Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AC:H/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and delete system icons. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb - https://www.archerirm.communi
- https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/747545
CVE ID: CVE-2024-49209 State: PUBLISHED Published: 2024-10-22T00:00:00.000Z Last Updated: 2025-03-14T15:44:36.443Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:N/C:N/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and upload additional system icons. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb - https://www.ar
t: References: - https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/747545
CVE ID: CVE-2024-49210 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-30T18:37:31.614Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application. Additional Analy
ed back to the victim and executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/747545
CVE ID: CVE-2024-49211 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-30T18:37:57.958Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application. Additional
eflected back to the victim and executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/747545
CVE ID: CVE-2024-49214 State: PUBLISHED Published: 2024-10-14T00:00:00 Last Updated: 2024-10-29T15:16:03.727Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.haproxy.org/download/3.1/src/CHANGELOG - https://github.com/haproxy/haproxy/commit/f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46 - https://www.mail-archive.com/haproxy%40formilux.org/msg4529
xy/haproxy/commit/f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46 - https://www.mail-archive.com/haproxy%40formilux.org/msg45291.html - https://www.mail-archive.com/haproxy%40formilux.org/msg45314.html - https://www.mail-archive.com/haproxy%40formilux.org/msg45315.html - https://www.haproxy.org/download/3.0/src/CHANGELOG - https://www.haproxy.org/download/2.9/src/CHANGELOG
CVE ID: CVE-2024-49215 State: REJECTED Published: 2024-10-21T00:00:00 Last Updated: 2024-12-09T22:36:11.613174Z Description: No description available.
CVE ID: CVE-2024-49216 State: PUBLISHED Published: 2024-10-16T13:42:11.146Z Last Updated: 2024-10-16T14:11:58.569Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Joshua Clayton Products: Feed Comments Number Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Clayton Feed Comments Number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through 0.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/feed-comments-number/wordpress-feed-comments-number-plugin-0-2-1-arbitrary-file-upload-vulnerability?
base/vulnerability/feed-comments-number/wordpress-feed-comments-number-plugin-0-2-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49217 State: PUBLISHED Published: 2024-10-17T17:42:37.144Z Last Updated: 2024-10-17T18:46:47.765Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Madiri Salman Aashish Products: Adding drop down roles in registration Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Madiri Salman Aashish Adding drop down roles in registration allows Privilege Escalation.This issue affects Adding drop down roles in registration: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/user-drop-down-roles-in-registration/wordpress-adding-drop-down-r
ences: - https://patchstack.com/database/vulnerability/user-drop-down-roles-in-registration/wordpress-adding-drop-down-roles-in-registration-plugin-1-1-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-49218 State: PUBLISHED Published: 2024-10-16T13:21:31.196Z Last Updated: 2024-10-16T14:36:58.760Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Al Imran Akash Products: Recently Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently allows Object Injection.This issue affects Recently: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/recently-viewed-most-viewed-and-sold-products-for-woocommerce/wordpress-recently-plugin-1-1-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-49219 State: PUBLISHED Published: 2024-10-17T17:41:01.737Z Last Updated: 2024-10-17T18:48:25.513Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themexpo Products: RS-Members Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in themexpo RS-Members allows Privilege Escalation.This issue affects RS-Members: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/rs-members/wordpress-rs-members-plugin-1-0-3-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-49220 State: PUBLISHED Published: 2024-10-17T18:05:58.629Z Last Updated: 2024-10-17T18:34:27.571Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Cookie Scanner – Nikel Schubert Products: Cookie Scanner Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Cookie Scanner – Nikel Schubert Cookie Scanner allows Stored XSS.This issue affects Cookie Scanner: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cookie-scanner/wordpress-cookie-scanner-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve