Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4069 State: PUBLISHED Published: 2024-04-23T21:31:04.764Z Last Updated: 2024-08-01T20:26:57.260Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Kashipara Products: Online Furniture Shopping Ecommerce Website Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. This affects an unknown part of the file search.php. The manipulation of the argument txtSearch leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261795. Additional
been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261795. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261795 - https://vuldb.com/?ctiid.261795 - https://vuldb.com/?submit.321443 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%201.pdf
CVE ID: CVE-2024-4070 State: PUBLISHED Published: 2024-04-23T22:00:05.602Z Last Updated: 2024-08-01T20:26:57.264Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Kashipara Products: Online Furniture Shopping Ecommerce Website Problem Types: CWE-89 Description: A vulnerability has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This vulnerability affects unknown code of the file prodList.php. The manipulation of the argument prodType leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261796. Additional Analyst Not
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261796. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261796 - https://vuldb.com/?ctiid.261796 - https://vuldb.com/?submit.321444 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%202.pdf
CVE ID: CVE-2024-4071 State: PUBLISHED Published: 2024-04-23T22:00:07.212Z Last Updated: 2024-08-01T20:26:57.415Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Kashipara Products: Online Furniture Shopping Ecommerce Website Problem Types: CWE-89 Description: A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This issue affects some unknown processing of the file prodInfo.php. The manipulation of the argument prodId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261797 was assigned to this vulnerability. Additional Analy
disclosed to the public and may be used. The identifier VDB-261797 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261797 - https://vuldb.com/?ctiid.261797 - https://vuldb.com/?submit.321445 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%203.pdf
CVE ID: CVE-2024-4072 State: PUBLISHED Published: 2024-04-23T22:31:04.805Z Last Updated: 2024-08-01T20:26:57.326Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Kashipara Products: Online Furniture Shopping Ecommerce Website Problem Types: CWE-79 Description: A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been classified as problematic. Affected is an unknown function of the file search.php. The manipulation of the argument txtSearch leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261798 is the identifier assigned to this vulnerability. Ad
xploit has been disclosed to the public and may be used. VDB-261798 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261798 - https://vuldb.com/?ctiid.261798 - https://vuldb.com/?submit.321446 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%204.pdf
CVE ID: CVE-2024-4073 State: PUBLISHED Published: 2024-04-23T22:31:06.209Z Last Updated: 2024-08-01T20:26:57.278Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Kashipara Products: Online Furniture Shopping Ecommerce Website Problem Types: CWE-79 Description: A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file prodList.php. The manipulation of the argument prodType leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerabilit
d remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261799. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261799 - https://vuldb.com/?ctiid.261799 - https://vuldb.com/?submit.321447 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%205.pdf
CVE ID: CVE-2024-4074 State: PUBLISHED Published: 2024-04-23T23:00:05.201Z Last Updated: 2024-08-01T20:26:57.327Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Kashipara Products: Online Furniture Shopping Ecommerce Website Problem Types: CWE-79 Description: A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file prodInfo.php. The manipulation of the argument prodId leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261800. Addit
The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261800. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261800 - https://vuldb.com/?ctiid.261800 - https://vuldb.com/?submit.321450 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%206.pdf
CVE ID: CVE-2024-4075 State: PUBLISHED Published: 2024-04-23T23:00:06.799Z Last Updated: 2024-08-01T20:26:57.327Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Kashipara Products: Online Furniture Shopping Ecommerce Website Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. This affects an unknown part of the file login.php. The manipulation of the argument txtAddress leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261801 was assigned to this vulnerability. Additional
s been disclosed to the public and may be used. The identifier VDB-261801 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261801 - https://vuldb.com/?ctiid.261801 - https://vuldb.com/?submit.321451 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%207.pdf
CVE ID: CVE-2024-4076 State: PUBLISHED Published: 2024-07-23T14:40:57.256Z Last Updated: 2025-02-13T17:53:23.437Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Description: Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-202
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2024-4076 - http://www.openwall.com/lists/oss-security/2024/07/23/1 - http://www.openwall.com/lists/oss-security/2024/07/31/2
CVE ID: CVE-2024-4077 State: PUBLISHED Published: 2024-04-25T09:15:22.154Z Last Updated: 2024-08-01T20:33:51.669Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: AndonDesign Products: UDesign Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign allows Reflected XSS.This issue affects UDesign: from n/a through 4.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/u-design/wordpress-udesign-theme-4-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-4078 State: PUBLISHED Published: 2024-05-16T09:03:49.562Z Last Updated: 2024-08-08T14:40:25.921Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-77 Description: A vulnerability in the parisneo/lollms, specifically in the `/unInstall_binding` endpoint, allows for arbitrary code execution due to insufficient sanitization of user input. The issue arises from the lack of path sanitization when handling the `name` parameter in the `unInstall_binding` function, allowing an attacker to traverse directories and execute arbitrary code by loading a malicious `__init__.py` file. This vulnerability
ttacker to traverse directories and execute arbitrary code by loading a malicious `__init__.py` file. This vulnerability affects the latest version of the software. The exploitation of this vulnerability could lead to remote code execution on the system where parisneo/lollms is deployed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a55a8c04-df44-49b2-bcfa-2a2b728a299d - https://github.com/parisneo/lollms/commit/7ebe08da7e0026b155af4f7be1d6417bc64cf02f
CVE ID: CVE-2024-4079 State: PUBLISHED Published: 2024-07-23T13:19:35.141Z Last Updated: 2025-08-27T20:42:58.816Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-125 Description: An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-update
nt: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html
CVE ID: CVE-2024-4080 State: PUBLISHED Published: 2024-07-23T13:29:55.012Z Last Updated: 2025-09-29T18:55:07.333Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-787 Description: A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-an
SA ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-issues-due-to-improper-length-checks-in-labview.html
CVE ID: CVE-2024-4081 State: PUBLISHED Published: 2024-07-23T13:32:52.584Z Last Updated: 2025-09-30T13:44:11.363Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-787 Description: A memory corruption issue due to an improper length check in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects NI LabVIEW 2024 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-sec
P Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-issues-due-to-improper-length-checks-in-labview.html
CVE ID: CVE-2024-4082 State: PUBLISHED Published: 2024-05-09T20:03:37.730Z Last Updated: 2024-08-01T20:33:51.649Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpjoli Products: Joli FAQ SEO – WordPress FAQ Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Joli FAQ SEO – WordPress FAQ Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into p
icated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c45b6163-7ebf-4f18-afd6-735d02d9170d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3081648%40joli-faq-seo%2Ftrunk&old=3076380%40joli-faq-seo%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4083 State: PUBLISHED Published: 2024-05-02T16:51:47.830Z Last Updated: 2024-08-01T20:33:51.678Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: way2neelam Products: Easy Restaurant Table Booking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Easy Restaurant Table Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performin
ttackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1492440d-c6c8-46c0-bc88-c9e3f9933ad4?source=cve - https://wordpress.org/plugins/fd-elementor-imagebox/
CVE ID: CVE-2024-4084 State: PUBLISHED Published: 2024-06-05T00:00:14.901Z Last Updated: 2024-08-01T20:33:52.113Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intended to restrict access to intranet IP addresses and protocols. Despite efforts to filter out intranet IP addresses starting with 192, 172, 10, and 127 through regular expressions and limit access protocols to HTTP and HTTPS, attackers can still bypass these
, 10, and 127 through regular expressions and limit access protocols to HTTP and HTTPS, attackers can still bypass these restrictions using alternative representations of IP addresses and accessing other ports running on localhost. This vulnerability enables attackers to access any asset on the internal network, attack web services on the internal network, scan hosts on the internal network, and potentially access AWS metadata endpoints. The vulnerability is due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/bf44517e-a07d-4f54
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/bf44517e-a07d-4f54-89b4-3b05fca2a008
CVE ID: CVE-2024-4085 State: PUBLISHED Published: 2024-05-02T16:52:32.538Z Last Updated: 2024-08-01T20:33:51.643Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: docolli Products: Tabellen von faustball.com Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Tabellen von faustball.com plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary
This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b7417e25-be35-4134-9d38-f8ee91f0d1cf?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078169%40docollipics-faustball-de%2Ftrunk&old=3076848%40docollipics-faustball-de%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4086 State: PUBLISHED Published: 2024-05-02T16:52:51.436Z Last Updated: 2024-08-01T20:33:51.657Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: creativemindssolutions Products: CM Tooltip Glossary Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings or reset them via a forged request granted they can trick a
or unauthenticated attackers to change the plugin's settings or reset them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e2ddde-1421-4352-b93a-1492574f624e?source=cve - https://plugins.trac.wordpress.org/changeset/3076616/enhanced-tooltipglossary/trunk/settings/CMTT_Settings.php?contextall=1&old=3029791&old_path=%2Fenhanced-tooltipglossary%2Ftrunk%2Fsettings%2FCMTT_Settings.php
CVE ID: CVE-2024-4087 State: PUBLISHED Published: 2024-06-01T05:38:11.223Z Last Updated: 2024-08-01T20:33:51.651Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widget in all versions up to, and including, 1.3.975 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,
input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cca7bb88-4a2c-4406-8610-15ce6e77c31f?source=cve - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.3.972/modules/back-to-top/widgets/wpr-back-to-top.php#L684 - https://plugins.trac.wordpress.org/changeset/3094946/royal-elementor-addons/tags/1.3.976/modules/back-to-
top.php#L684 - https://plugins.trac.wordpress.org/changeset/3094946/royal-elementor-addons/tags/1.3.976/modules/back-to-top/widgets/wpr-back-to-top.php?old=3086875&old_path=royal-elementor-addons%2Ftags%2F1.3.975%2Fmodules%2Fback-to-top%2Fwidgets%2Fwpr-back-to-top.php
CVE ID: CVE-2024-4088 State: PUBLISHED Published: 2024-06-05T06:50:29.799Z Last Updated: 2024-08-01T20:33:51.675Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: shafayat-alam Products: Gutenberg Blocks and Page Layouts – Attire Blocks Problem Types: CWE-862 Missing Authorization Description: The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable_fe_assets function in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with subscriber access or above, to change the plugin's settings. Additionally, n
possible for authenticated attackers, with subscriber access or above, to change the plugin's settings. Additionally, no nonce check is performed resulting in a CSRF vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef47feb7-76fd-470d-ba48-55ba3c323c6d?source=cve - https://plugins.trac.wordpress.org/changeset/3085600/attire-blocks/trunk/admin/AttireBlocksSettings.php?old=2996841&old_path=attire-blocks%2Ftrunk%2Fadmin%2FAttireBlocksSettings.php
CVE ID: CVE-2024-4089 State: PUBLISHED Published: 2024-10-11T15:15:29.047Z Last Updated: 2024-10-11T16:14:59.285Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: SuperFile Problem Types: CWE-427 Description: A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/423563