Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12664 State: PUBLISHED Published: 2024-12-16T19:31:05.044Z Last Updated: 2024-12-17T14:30:43.857Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ruifang-tech Products: Rebuild Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in ruifang-tech Rebuild 3.8.5. This issue affects some unknown processing of the component Project Task Comment Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - C
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288533 - https://vuldb.com/?ctiid.288533 - https://vuldb.com/?submit.458622 - https://github.com/cydtseng/Vulnerability-Research/blob/main/rebuild/StoredXSS-TaskComments.md
CVE ID: CVE-2024-12665 State: PUBLISHED Published: 2024-12-16T19:31:06.544Z Last Updated: 2024-12-17T14:30:06.488Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ruifang-tech Products: Rebuild Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in ruifang-tech Rebuild 3.8.5. Affected is an unknown function of the component Task Comment Attachment Upload. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA AD
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288534 - https://vuldb.com/?ctiid.288534 - https://vuldb.com/?submit.458623 - https://github.com/cydtseng/Vulnerability-Research/blob/main/rebuild/StoredXSS-TaskCommentAttachments.md
CVE ID: CVE-2024-12666 State: PUBLISHED Published: 2024-12-16T20:00:12.804Z Last Updated: 2024-12-17T14:29:37.195Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: ClassCMS Problem Types: CWE-274, CWE-266 Description: A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288535 - https://vuldb.com/?ctiid.288535 - https://vuldb.com/?submit.461120 - https://github.com/Jack-Black-13/blob/blob/main/ClassCMS%20V4.8%20Vertical%20Privilege%20Escalation.md
CVE ID: CVE-2024-12667 State: PUBLISHED Published: 2024-12-16T20:00:14.643Z Last Updated: 2024-12-17T14:32:41.580Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: InvoicePlane Problem Types: CWE-613 Description: A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices/view. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to
e difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288536 - https://vuldb.com/?ctiid.288536 - https://vuldb.com/?submit.449923 - https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.2-beta-1
CVE ID: CVE-2024-12668 State: PUBLISHED Published: 2024-12-16T14:56:17.136Z Last Updated: 2024-12-16T16:14:22.987Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Velocidex Products: WinPmem Problem Types: CWE-787 Description: Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing a
g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1
CVE ID: CVE-2024-12669 State: PUBLISHED Published: 2024-12-17T15:27:17.052Z Last Updated: 2025-08-26T17:16:46.311Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-122 Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-
CVE ID: CVE-2024-12670 State: PUBLISHED Published: 2024-12-17T15:28:05.933Z Last Updated: 2025-08-26T17:17:03.296Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-122 Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-
CVE ID: CVE-2024-12671 State: PUBLISHED Published: 2024-12-17T15:28:48.438Z Last Updated: 2025-08-26T17:17:18.928Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-787 Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisori
CVE ID: CVE-2024-12672 State: PUBLISHED Published: 2024-12-19T20:58:29.049Z Last Updated: 2024-12-20T17:14:12.572Z Vendors: Rockwell Automation Products: Arena® Description: A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.html
CVE ID: CVE-2024-12673 State: PUBLISHED Published: 2025-02-12T20:31:18.910Z Last Updated: 2025-02-12T20:53:30.448Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Vantage Problem Types: CWE-250 Description: An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow a local attacker to elevate privileges on the system. This vulnerability only affects Vantage installed on these devices: * Lenovo V Series (Gen 5) * ThinkBook 14 (Gen 6, 7) * ThinkBook 16 (Gen 6, 7) * ThinkPad E Series (Gen 1) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://su
ok 16 (Gen 6, 7) * ThinkPad E Series (Gen 1) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-183176
CVE ID: CVE-2024-12677 State: PUBLISHED Published: 2024-12-20T16:44:08.747Z Last Updated: 2024-12-24T00:40:13.881Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DTM Soft Problem Types: CWE-502 Description: Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-03 - https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&q=dtm&sort_expr=cdate&sort_dir=DESC
CVE ID: CVE-2024-12678 State: PUBLISHED Published: 2024-12-20T01:49:40.583Z Last Updated: 2024-12-20T17:08:12.684Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-266 Description: Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2024-29-nomad-alloc
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2024-29-nomad-allocations-vulnerable-to-privilege-escalation-within-a-namespace-using-unredacted-workload-identity-token/72119
CVE ID: CVE-2024-12679 State: PUBLISHED Published: 2025-05-15T20:06:53.369Z Last Updated: 2025-05-20T19:32:51.031Z Vendors: Unknown Products: Prisna GWT Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7ca1438f-4269-4e34-be4a-766276a9f016/
CVE ID: CVE-2024-12680 State: PUBLISHED Published: 2025-05-15T20:06:53.573Z Last Updated: 2025-05-20T19:32:42.095Z Vendors: Unknown Products: Prisna GWT Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/28537fbc-3c2b-40c1-85f0-8b5f94eaad51/
CVE ID: CVE-2024-12681 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:36.102Z Description: No description available.
CVE ID: CVE-2024-12682 State: PUBLISHED Published: 2025-03-25T06:00:11.744Z Last Updated: 2025-03-25T13:57:26.993Z Vendors: Unknown Products: Smart Maintenance Mode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/79d0a139-0fb3-4a4b-ac33-80cbc6cb3831/
CVE ID: CVE-2024-12683 State: PUBLISHED Published: 2025-03-26T06:00:06.140Z Last Updated: 2025-03-26T19:00:12.737Z Vendors: Unknown Products: Smart Maintenance Mode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1569ee00-56c3-4a1b-940e-e0256a748675/
CVE ID: CVE-2024-12685 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:36.268Z Description: No description available.
CVE ID: CVE-2024-12686 State: PUBLISHED Published: 2024-12-18T20:23:57.909Z Last Updated: 2025-10-21T22:55:34.086Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: BeyondTrust Products: Remote Support(RS) & Privileged Remote Access(PRA) Problem Types: CWE-78 Description: A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nvd.nist.gov/vuln/detail/CVE-2024-12686 - https://www.beyondtrust.com/trust-center/security-advisories/bt24-11
CVE ID: CVE-2024-12687 State: PUBLISHED Published: 2024-12-16T19:09:08.481Z Last Updated: 2024-12-17T14:31:34.017Z Vendors: PlexTrac Products: PlexTrac Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0
CVE ID: CVE-2024-12692 State: PUBLISHED Published: 2024-12-18T21:42:56.456Z Last Updated: 2025-01-07T16:03:25.391Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html - https://issues.chromium.org/issues/382291459
CVE ID: CVE-2024-12693 State: PUBLISHED Published: 2024-12-18T21:42:56.781Z Last Updated: 2025-03-13T16:53:48.384Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html - https://issues.chromium.org/issues/382190919
CVE ID: CVE-2024-12694 State: PUBLISHED Published: 2024-12-18T21:42:56.986Z Last Updated: 2025-01-03T14:04:36.234Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Compositing in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html - https://issues.chromium.org/issues/368222741
CVE ID: CVE-2024-12695 State: PUBLISHED Published: 2024-12-18T21:42:57.172Z Last Updated: 2025-01-06T14:24:42.569Z Vendors: Google Products: Chrome Problem Types: CWE-787 Description: Out of bounds write in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html - https://issues.chromium.org/issues/383647255
CVE ID: CVE-2024-12696 State: PUBLISHED Published: 2025-01-18T07:05:10.013Z Last Updated: 2025-01-21T21:21:26.692Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: videowhisper Products: Picture Gallery – Frontend Image Uploads, AJAX Photo List Problem Types: CWE-79 Description: The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisper_picture_upload_guest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu
ation and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a116c846-72df-4701-893a-744a26b191d6?source=cve - https://wordpress.org/plugins/picture-gallery/#developers - https://plugins.trac.wordpress.org/changeset/3224277/
CVE ID: CVE-2024-12697 State: PUBLISHED Published: 2024-12-21T07:03:01.617Z Last Updated: 2024-12-28T00:50:19.479Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: realmaster-1 Products: real.Kit Problem Types: CWE-79 Description: The real.Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83e1f631-28ec-4924-9d69-caaba00fe276?source=cve - https://wordpress.org/plugins/real-kit/#developers
CVE ID: CVE-2024-12698 State: PUBLISHED Published: 2024-12-18T05:07:21.026Z Last Updated: 2025-11-20T18:22:24.463Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.18 Problem Types: CWE-400 Description: An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were protected, not streams created by authenticated sources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:6122 - https://access.redhat.com/security/cve/CVE-2024-12698 - https://bugzi
https://access.redhat.com/errata/RHSA-2024:6122 - https://access.redhat.com/security/cve/CVE-2024-12698 - https://bugzilla.redhat.com/show_bug.cgi?id=2332674
CVE ID: CVE-2024-12699 State: PUBLISHED Published: 2025-01-07T09:22:16.015Z Last Updated: 2025-01-07T16:11:12.443Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themepoints Products: Service Box Problem Types: CWE-79 Description: The Service Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ges that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a65630-0852-4ffc-8c23-295be95bd7f0?source=cve - https://wordpress.org/plugins/service-boxs/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3216752%40service-boxs&new=3216752%40service-boxs&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12700 State: PUBLISHED Published: 2024-12-19T22:50:58.512Z Last Updated: 2024-12-20T17:38:17.699Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tibbo Products: AggreGate Network Manager Problem Types: CWE-434 Description: There is an unrestricted file upload vulnerability where it is possible for an authenticated user (low privileged) to upload an jsp shell and execute code with the privileges of user running the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-05 - https://aggregate.digital/downloads.html
CVE ID: CVE-2024-12701 State: PUBLISHED Published: 2025-01-04T07:24:23.207Z Last Updated: 2025-01-06T16:30:37.889Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: xylus Products: WP Smart Import : Import any XML File to WordPress Problem Types: CWE-79 Description: The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user in
unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/27153c13-6bdc-4873-8a05-8aab6ba4243d?source=cve - https://plugins.trac.wordpress.org/browser/wp-smart-import/trunk/controller/manage_controller.php#L82 - https://plugins.trac.wordpress.org/browser/wp-smart-import/trunk/controller/file_manage_controller.php#L39 - https://plugins.trac.wordpress.org/changeset/3212009/
CVE ID: CVE-2024-12703 State: PUBLISHED Published: 2025-01-17T10:23:52.108Z Last Updated: 2025-02-12T18:46:28.032Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: RemoteConnect and SCADAPack x70 Utilities Problem Types: CWE-502 Description: CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when a non-admin authenticated user opens a malicious project file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-06&p_enDocType=Security+an
richment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-06.pdf