Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4168 State: PUBLISHED Published: 2024-04-25T12:00:06.832Z Last Updated: 2024-08-01T20:33:52.702Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: 4G300 Problem Types: CWE-121 Description: A vulnerability was found in Tenda 4G300 1.01.42. It has been classified as critical. This affects the function sub_4260F0. The manipulation of the argument upfilen leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-261987. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
y about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261987 - https://vuldb.com/?ctiid.261987 - https://vuldb.com/?submit.318987 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/4G300/sub_4260F0.md
CVE ID: CVE-2024-4169 State: PUBLISHED Published: 2024-04-25T12:31:04.756Z Last Updated: 2024-08-01T20:33:52.514Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: 4G300 Problem Types: CWE-121 Description: A vulnerability was found in Tenda 4G300 1.01.42. It has been declared as critical. This vulnerability affects the function sub_42775C/sub_4279CC. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The identifier of this vulnerability is VDB-261988. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261988 - https://vuldb.com/?ctiid.261988 - https://vuldb.com/?submit.318988 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/4G300/sub_42775C.md
CVE ID: CVE-2024-4170 State: PUBLISHED Published: 2024-04-25T13:00:06.597Z Last Updated: 2024-08-01T20:33:52.721Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: 4G300 Problem Types: CWE-121 Description: A vulnerability was found in Tenda 4G300 1.01.42. It has been rated as critical. This issue affects the function sub_429A30. The manipulation of the argument list1 leads to stack-based buffer overflow. The attack may be initiated remotely. The identifier VDB-261989 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261989 - https://vuldb.com/?ctiid.261989 - https://vuldb.com/?submit.318991 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/4G300/sub_429A30.md
CVE ID: CVE-2024-4171 State: PUBLISHED Published: 2024-04-25T13:31:05.998Z Last Updated: 2024-08-01T20:33:52.999Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W30E Problem Types: CWE-121 Description: A vulnerability classified as critical has been found in Tenda W30E 1.0/1.0.1.25. Affected is the function fromWizardHandle of the file /goform/WizardHandle. The manipulation of the argument PPW leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did n
0 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261990 - https://vuldb.com/?ctiid.261990 - https://vuldb.com/?submit.318995 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromWizardHandle.md
CVE ID: CVE-2024-4172 State: PUBLISHED Published: 2024-04-25T14:00:04.911Z Last Updated: 2024-08-01T20:33:52.872Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: idcCMS Problem Types: CWE-352 Description: A vulnerability classified as problematic was found in idcCMS 1.35. Affected by this vulnerability is an unknown functionality of the file /admin/admin_cl.php?mudi=revPwd. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261991. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refere
of this vulnerability is VDB-261991. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261991 - https://vuldb.com/?ctiid.261991 - https://vuldb.com/?submit.322300 - https://github.com/bigbigbigbaby/cms2/blob/main/1.md
CVE ID: CVE-2024-4173 State: PUBLISHED Published: 2024-04-25T07:30:44.685Z Last Updated: 2024-08-01T20:33:52.534Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Brocade Products: Brocade SANnav Problem Types: CWE-200 Description: A vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform various attacks, including DOS against the Brocade SANnav. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/23285
CVE ID: CVE-2024-4174 State: PUBLISHED Published: 2024-04-25T11:44:30.736Z Last Updated: 2024-08-01T20:33:53.020Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Hyperion Products: Hyperion Web Server Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in Hyperion Web Server affecting version 2.0.15. This vulnerability could allow an attacker to execute malicious Javascript code on the client by injecting that code into the URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hyperion-web-server
CVE ID: CVE-2024-4175 State: PUBLISHED Published: 2024-04-25T11:51:36.458Z Last Updated: 2024-08-01T20:33:52.938Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Hyperion Products: Hyperion Web Server Problem Types: CWE-20 Description: Unicode transformation vulnerability in Hyperion affecting version 2.0.15. This vulnerability could allow an attacker to send a malicious payload with Unicode characters that will be replaced by ASCII characters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hyperion-web-server
CVE ID: CVE-2024-4176 State: PUBLISHED Published: 2024-06-13T08:59:37.481Z Last Updated: 2024-08-01T20:33:52.528Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Trellix Products: Trellix EDR UI (XConsole) Problem Types: CWE-79 Description: An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Injection using command line variables. A malicious threat actor could execute commands on the victim's browser for sending carefully crafted malicious links to the EDR XConsole end user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://thriv
onsole end user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://thrive.trellix.com/s/article/000013455
CVE ID: CVE-2024-4177 State: PUBLISHED Published: 2024-06-06T07:59:22.990Z Last Updated: 2024-08-01T20:33:52.891Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bitdefender Products: GravityZone Console On-Premise Problem Types: CWE-116 Description: A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitdefender.com/consumer/support/support/security-advisories/
lnrichment: - CVE Program Container: References: - https://bitdefender.com/consumer/support/support/security-advisories/host-whitelist-parser-issue-in-gravityzone-console-on-premise-va-11554/
CVE ID: CVE-2024-4180 State: PUBLISHED Published: 2024-06-04T06:00:02.616Z Last Updated: 2025-03-18T18:41:26.666Z Vendors: Unknown Products: The Events Calendar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/b2a92316-e404-4a5e-8426-f88df6e87550/
CVE ID: CVE-2024-4181 State: PUBLISHED Published: 2024-05-16T09:03:47.278Z Last Updated: 2024-08-01T20:33:52.659Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: run-llama Products: run-llama/llama_index Problem Types: CWE-94 Description: A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploit
ing provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/1a204520-598a-434e-b13d-0d34f2a5ddc1 - https://github.com/run-llama/llama_index/commit/d73715eaf0642705583e7897c78b9c8dd2d3a7ba
CVE ID: CVE-2024-4182 State: PUBLISHED Published: 2024-04-26T08:25:37.093Z Last Updated: 2024-08-01T20:33:52.520Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-754 Description: Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-4183 State: PUBLISHED Published: 2024-04-26T08:25:47.088Z Last Updated: 2024-08-01T20:33:52.871Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-4184 State: PUBLISHED Published: 2024-10-16T16:41:02.472Z Last Updated: 2024-10-16T18:55:04.438Z Vendors: OpenText Products: OpenText Application Automation Tools Problem Types: CWE-611 Description: Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000033540?language=en_US
CVE ID: CVE-2024-4185 State: PUBLISHED Published: 2024-04-30T08:32:23.492Z Last Updated: 2024-08-01T20:33:52.503Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: algoritmika Products: Customer Email Verification for WooCommerce Problem Types: CWE-330 Use of Insufficiently Random Values Description: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification, and if both the "Login the user automatically after
ble for unauthenticated attackers to bypass the email verification, and if both the "Login the user automatically after the account is verified" and "Verify account for current users" options are checked, then it potentially makes it possible for attackers to bypass authentication for other users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ebae4b18-5b5f-45c3-86e2-02eefd7abdb7?source=cve - https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.7.4/includes/alg-wc-ev-functions.php#L299 - https://plugins.trac.wordpress.org/browser/emails-verification-for-woocom
/2.7.4/includes/alg-wc-ev-functions.php#L299 - https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.7.4/includes/class-alg-wc-ev-core.php#L731 - https://plugins.trac.wordpress.org/changeset/3078804/emails-verification-for-woocommerce#file2
CVE ID: CVE-2024-4186 State: PUBLISHED Published: 2024-05-07T05:32:58.532Z Last Updated: 2024-08-01T20:33:52.547Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wisdmlabs Products: Edwiser Bridge – WordPress Moodle LMS Integration Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The Build App Online plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.5. This is due to the 'eb_user_email_verification_key' default value is empty, and the not empty check is missing in the 'eb_user_email_verify' function. This makes it possible for unauthenticated attackers to log in as
ck is missing in the 'eb_user_email_verify' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. This can only be exploited if the 'Email Verification' setting is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6969d281-f280-4714-9859-38ac66e9cc60?source=cve - https://plugins.trac.wordpress.org/browser/edwiser-bridge/tags/3.0.4/includes/class-eb-user-manager.php#L1571 - https://plugins.trac.wordpress.org/changeset/3081961/edwiser-bridge#file1
CVE ID: CVE-2024-4187 State: PUBLISHED Published: 2024-07-31T20:28:22.578Z Last Updated: 2024-08-12T13:49:42.081Z Vendors: OpenText™ Products: Filr Problem Types: CWE-356 Description: Stored XSS vulnerability has been discovered in OpenText™ Filr product, affecting versions 24.1.1 and 24.2. The vulnerability could cause users to not be warned when clicking links to external sites. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000032291
CVE ID: CVE-2024-4188 State: PUBLISHED Published: 2024-07-30T14:35:09.650Z Last Updated: 2024-08-12T20:09:00.265Z Vendors: OpenText™ Products: Documentum™ Server Problem Types: CWE-523 Description: Unprotected Transport of Credentials vulnerability in OpenText™ Documentum™ Server could allow Credential Stuffing.This issue affects Documentum™ Server: from 16.7 through 23.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0815868
CVE ID: CVE-2024-4189 State: PUBLISHED Published: 2024-10-16T16:41:19.784Z Last Updated: 2024-10-16T18:54:37.354Z Vendors: OpenText Products: OpenText Application Automation Tools Problem Types: CWE-611 Description: Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000033547?language=en_US
CVE ID: CVE-2024-4190 State: PUBLISHED Published: 2024-06-11T17:48:21.272Z Last Updated: 2024-08-01T20:33:52.879Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: OpenText Products: ArcSight Logger Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerabilities have been identified in OpenText ArcSight Logger. The vulnerabilities could be remotely exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.microfocus.com/s/article/KM000030655
CVE ID: CVE-2024-4192 State: PUBLISHED Published: 2024-04-30T23:01:58.874Z Last Updated: 2024-09-03T18:16:25.046Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: CNCSoft-G2 DOPSoft Problem Types: CWE-121 Description: Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-121-01
CVE ID: CVE-2024-4193 State: PUBLISHED Published: 2024-05-09T20:03:38.696Z Last Updated: 2024-08-01T20:33:52.937Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: davidanderson Products: Testimonial Slider Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'testimonialcategory' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level acces
t escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7ed687-4049-4957-86e9-b2f59621c747?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3080579%40testimonial-slider&new=3080579%40testimonial-slider&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4194 State: PUBLISHED Published: 2024-06-06T02:02:57.036Z Last Updated: 2024-08-01T20:33:52.852Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: wponlinesupport Products: Album and Image Gallery plus Lightbox Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to e
oes not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4822f1c7-3f83-416c-8957-17e4b53d7e69?source=cve - https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album-slider.php#L207 - https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album.php#L185
CVE ID: CVE-2024-4195 State: PUBLISHED Published: 2024-04-26T08:26:00.685Z Last Updated: 2024-08-01T20:33:52.915Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-4196 State: PUBLISHED Published: 2024-06-25T04:00:30.307Z Last Updated: 2025-10-01T01:32:20.651Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Avaya Products: IP Office Problem Types: CWE-782 Description: An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.avaya.com/css/public/documents/101090768
CVE ID: CVE-2024-4197 State: PUBLISHED Published: 2024-06-25T04:01:17.685Z Last Updated: 2024-08-01T20:33:52.976Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Avaya Products: IP Office Problem Types: CWE-434 Description: An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected versions include all versions prior to 11.1.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.avaya.com/css/public/documents/101090768
CVE ID: CVE-2024-4198 State: PUBLISHED Published: 2024-04-26T08:26:11.493Z Last Updated: 2024-08-01T20:33:52.786Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-4199 State: PUBLISHED Published: 2024-05-15T01:56:54.769Z Last Updated: 2024-08-01T20:33:52.605Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ithemelandco Products: Bulk Posts Editing For WordPress Problem Types: CWE-862 Missing Authorization Description: The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to invoke their corresponding functions. This may lead to post creation and duplica