Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1635 State: PUBLISHED Published: 2024-02-19T21:23:14.496Z Last Updated: 2025-11-07T20:40:22.694Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2, Red Hat Fuse 7.13.0, Red Hat JBoss Enterprise Application Platform, Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat
for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, RHSSO 7.6.8, OpenShift Serverless, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 2, Red Hat Build of Keycloak, Red Hat build of OptaPlanner 8, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Integration Camel K 1, Red Hat Integration Camel Quarkus 2, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 8, Red H
, Red Hat Integration Camel Quarkus 2, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Fuse Service Works 6, Red Hat Process Automation 7, streams for Apache Kafka Problem Types: CWE-400 Description: A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks conne
depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO
eTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1674 - https://access.redhat.com/errata/RHSA-2024:1675 - https://access.redhat.com/errata/RHSA-2024:1676 - https://access.redhat.com/errata/RHSA-2024:1677 - https://access.redhat.com/errata/RHSA-2024:1860 - https://access.redhat.com/errata/RHSA-2024:1861 - https://access.redhat.com/errata/RHSA-2024:1862 - https://access.redhat
ttps://access.redhat.com/errata/RHSA-2024:1861 - https://access.redhat.com/errata/RHSA-2024:1862 - https://access.redhat.com/errata/RHSA-2024:1864 - https://access.redhat.com/errata/RHSA-2024:1866 - https://access.redhat.com/errata/RHSA-2024:3354 - https://access.redhat.com/errata/RHSA-2024:4884 - https://access.redhat.com/errata/RHSA-2025:4226 - https://access.redhat.com/errata/RHSA-2025:9583 - https://access.redhat.com/security/cve/CVE-2024-1635 - https://bugzilla.redhat.com/show_bug.cgi?id=2264928
CVE ID: CVE-2024-1636 State: PUBLISHED Published: 2024-02-28T12:05:23.082Z Last Updated: 2024-08-01T19:14:11.892Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: Sitefinity Problem Types: CWE-79 Description: Potential Cross-Site Scripting (XSS) in the page editing area. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.progress.com/sitefinity-cms - https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024
CVE ID: CVE-2024-1637 State: PUBLISHED Published: 2024-04-09T18:58:36.352Z Last Updated: 2024-08-01T18:48:21.536Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: jtermaat Products: 360 Javascript Viewer Problem Types: CWE-862 Missing Authorization Description: The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access or higher, to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
ber access or higher, to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba33c84-5198-4c77-8995-d0a315d68990?source=cve - https://plugins.trac.wordpress.org/browser/360deg-javascript-viewer/trunk/admin/pages/class-jsv-360-admin_page_abstract.php#L42 - https://plugins.trac.wordpress.org/changeset/3047449/360deg-javascript-viewer/trunk/admin/pages/class-jsv-360-admin_page_abstract.php?contextall=1&old=3015478&old_path=%2F360deg-javascript-viewer%2Ftrunk%2Fadmin%2Fpages%2Fclass-jsv-360-admin_page_abstract.php
CVE ID: CVE-2024-1638 State: PUBLISHED Published: 2024-02-19T21:19:51.915Z Last Updated: 2025-04-24T15:07:49.502Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-20 Description: The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_E
ned with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p6f3-f63q-5mc2
CVE ID: CVE-2024-1639 State: PUBLISHED Published: 2024-06-21T02:05:42.864Z Last Updated: 2024-08-01T18:48:21.511Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: wpexpertsio Products: License Manager for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted
nticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the "license" JS variable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/92e444db-72d5-444f-811e-ade0bc097769?source=cve - https://plugins.trac.wordpress.org/browser/license-manager-for-woocommerce/tags/3.0.5/includes/Controllers/License.php
CVE ID: CVE-2024-1640 State: PUBLISHED Published: 2024-03-13T15:26:47.390Z Last Updated: 2024-08-01T18:48:20.672Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: bitpressadmin Products: Contact Form Builder by Bit Form: Create Contact Form, Multi Step Form, Conversational Form Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient user validation on the bitforms_update_form_entry AJAX action in all versions up to, and including
due to a insufficient user validation on the bitforms_update_form_entry AJAX action in all versions up to, and including, 2.10.1. This makes it possible for unauthenticated attackers to modify form submissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49ed7d6a-4a65-4efc-90e5-ffa5470d4011?source=cve - https://plugins.trac.wordpress.org/changeset/3048523/bit-form/trunk/includes/Frontend/Ajax/FrontendAjax.php
CVE ID: CVE-2024-1641 State: PUBLISHED Published: 2024-04-09T18:58:32.158Z Last Updated: 2024-08-01T18:48:21.807Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: pickplugins Products: Accordion Problem Types: CWE-862 Missing Authorization Description: The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'accordions_duplicate_post_as_draft' function in all versions up to, and including, 2.2.96. This makes it possible for authenticated attackers, with contributor access and above, to duplicate arbitrary posts, allowing access to the contents of password-protected posts
contributor access and above, to duplicate arbitrary posts, allowing access to the contents of password-protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7e7c70-4d07-4550-9cf8-5135b87b67ca?source=cve - https://plugins.trac.wordpress.org/browser/accordions/tags/2.2.96/includes/duplicate-post.php - https://plugins.trac.wordpress.org/changeset?old_path=/accordions/tags/2.2.96&old=3050599&new_path=/accordions/tags/2.2.97&new=3050599&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1642 State: PUBLISHED Published: 2024-03-13T15:26:41.285Z Last Updated: 2024-08-01T18:48:21.690Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: mainwp Products: MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bulk' function. This makes it possible for unauthenticated attackers to delete arbitrary p
ce validation on the 'posting_bulk' function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c2d9569-a551-46f5-8581-464b9f35b71c?source=cve - https://plugins.trac.wordpress.org/browser/mainwp/tags/4.6.0.1/pages/page-mainwp-post-page-handler.php - https://plugins.trac.wordpress.org/changeset/3042125/mainwp/trunk/pages/page-mainwp-post-page-handler.php?old=3017011&old_path=mainwp/trunk/pages/page-ma
g/changeset/3042125/mainwp/trunk/pages/page-mainwp-post-page-handler.php?old=3017011&old_path=mainwp/trunk/pages/page-mainwp-post-page-handler.php
CVE ID: CVE-2024-1643 State: PUBLISHED Published: 2024-04-10T17:07:57.614Z Last Updated: 2024-08-01T18:48:21.516Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-200 Description: By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posing a significant security risk. The flaw is due to insufficient verification of user permissions when joining an organization. Additional Analyst Notes: - CISA ADP Vulnric
insufficient verification of user permissions when joining an organization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/ce2563a2-3d81-4e2e-954e-abecb9332416 - https://github.com/lunary-ai/lunary/commit/67eaefe1c77c882c628780940c704a117b561d51
CVE ID: CVE-2024-1644 State: PUBLISHED Published: 2024-02-19T23:54:29.274Z Last Updated: 2024-08-01T18:48:22.061Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Suite CRM Products: Suite CRM Problem Types: CWE-434 Description: Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/ - https://fluidattacks.com/advisories/silva/
CVE ID: CVE-2024-1645 State: PUBLISHED Published: 2024-03-11T21:30:57.333Z Last Updated: 2024-08-27T20:52:12.631Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ndijkstra Products: Mollie Forms Problem Types: CWE-862 Missing Authorization Description: The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrations function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to export payment data collected by this plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
payment data collected by this plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/353c244f-6d5d-47d6-988e-33da722a02f9?source=cve - https://plugins.trac.wordpress.org/browser/mollie-forms/trunk/classes/Admin.php#L904 - https://plugins.trac.wordpress.org/changeset/3046896/mollie-forms/trunk/classes/Admin.php
CVE ID: CVE-2024-1646 State: PUBLISHED Published: 2024-04-16T00:00:14.201Z Last Updated: 2024-08-01T18:48:20.668Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-288 Description: parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized access to endpoints such as '/restart_program', '/update_software', '/check_update', '/start_recording', and '/stop_recording'. This
dpoints such as '/restart_program', '/update_software', '/check_update', '/start_recording', and '/stop_recording'. This vulnerability can lead to denial of service, unauthorized disabling or overriding of recordings, and potentially other impacts if certain features are enabled in the configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/2f769c46-aa85-4ab8-8b08-fe791313b7ba - https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8
CVE ID: CVE-2024-1647 State: PUBLISHED Published: 2024-02-19T23:59:17.082Z Last Updated: 2024-08-23T19:34:38.896Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: pyhtml2pdf Products: pyhtml2pdf Problem Types: CWE-79 Description: Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/pyhtml2pdf/ - https://fluidattacks.com/advisories/oliver/
CVE ID: CVE-2024-1648 State: PUBLISHED Published: 2024-02-20T00:01:50.680Z Last Updated: 2024-08-01T18:48:21.883Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: electron-pdf Products: electron-pdf Problem Types: CWE-79 Description: electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.npmjs.com/package/electron-pdf/ - https://fluidattacks.com/advisories/drake
CVE ID: CVE-2024-1649 State: PUBLISHED Published: 2024-02-27T11:05:10.127Z Last Updated: 2024-08-01T18:48:21.797Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: frenify Products: Categorify – WordPress Media Library Category & File Manager Problem Types: CWE-862 Missing Authorization Description: The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete categories. Additional Analyst Notes: - CISA ADP Vul
icated attackers, with subscriber-level access and above, to delete categories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c63ddc62-a4f1-4da4-a65e-4573369d6c30?source=cve - https://plugins.trac.wordpress.org/changeset/3034410/categorify
CVE ID: CVE-2024-1650 State: PUBLISHED Published: 2024-02-27T11:05:10.630Z Last Updated: 2024-08-07T17:42:56.370Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: frenify Products: Categorify – WordPress Media Library Category & File Manager Problem Types: CWE-862 Missing Authorization Description: The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to rename categories. Additional Analyst Notes: - CVE Program
icated attackers, with subscriber-level access and above, to rename categories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9a3dc87-5309-41fe-bfc3-60b5878b6c57?source=cve - https://plugins.trac.wordpress.org/changeset/3034410/categorify
CVE ID: CVE-2024-1651 State: PUBLISHED Published: 2024-02-19T23:49:28.471Z Last Updated: 2024-08-27T18:42:28.186Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Torrentpier Products: Torrentpier Problem Types: CWE-502 Description: Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torrentpier/torrentpier - https://fluidattacks.com/advisories/xavi/
CVE ID: CVE-2024-1652 State: PUBLISHED Published: 2024-02-27T11:05:08.954Z Last Updated: 2024-08-01T18:48:21.820Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: frenify Products: Categorify – WordPress Media Library Category & File Manager Problem Types: CWE-862 Missing Authorization Description: The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear categories. Additional Analyst Notes: - CISA ADP Vulnr
cated attackers, with subscriber-level access and above, to clear categories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/acccc6ae-553d-4ed5-8ba9-06a9061d725c?source=cve - https://plugins.trac.wordpress.org/changeset/3034410/categorify
CVE ID: CVE-2024-1653 State: PUBLISHED Published: 2024-02-27T11:05:06.723Z Last Updated: 2025-04-22T16:09:28.333Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: frenify Products: Categorify – WordPress Media Library Category & File Manager Problem Types: CWE-862 Missing Authorization Description: The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxUpdateFolderPosition in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the folder position of categories as well as update the
ted attackers, with subscriber-level access and above, to update the folder position of categories as well as update the metadata of other taxonomies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45badd20-1ba8-44be-8a7c-2ce21261e208?source=cve - https://plugins.trac.wordpress.org/changeset/3034410/categorify
CVE ID: CVE-2024-1654 State: PUBLISHED Published: 2024-03-14T03:06:54.867Z Last Updated: 2024-08-01T18:48:21.853Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: PaperCut Products: PaperCut NG, PaperCut MF Problem Types: CWE-183 Description: This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE ID: CVE-2024-1655 State: PUBLISHED Published: 2024-04-15T04:01:43.203Z Last Updated: 2024-08-01T18:48:21.610Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: ExpertWiFi EBM63, ExpertWiFi EBM68, RT-AX57 Go Problem Types: CWE-78 Description: Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by sending a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7737-1acd0-1.html
CVE ID: CVE-2024-1656 State: PUBLISHED Published: 2024-09-11T04:05:31.487Z Last Updated: 2024-12-06T18:50:10.627Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Octopus Deploy Products: Octopus Server Problem Types: Insufficient Content Security Policy Configuration Description: Affected versions of Octopus Server had a weak content security policy. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2024/sa2024-08/