Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to any user's account, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/91754c4d-a0d0-4d35-a70a-446d2bdf6c73?source=cve - https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636
CVE ID: CVE-2024-11287 State: PUBLISHED Published: 2024-12-21T07:02:58.343Z Last Updated: 2024-12-28T00:51:09.756Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: motovnet Products: Ebook Store Problem Types: CWE-79 Description: The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.8001. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA AD
can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/001289a3-a1a9-441f-b399-e9b699094e1a?source=cve - https://plugins.trac.wordpress.org/browser/ebook-store/trunk/functions.php#L827
CVE ID: CVE-2024-11288 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:13.729Z Description: No description available.
CVE ID: CVE-2024-11289 State: PUBLISHED Published: 2024-12-06T09:22:59.584Z Last Updated: 2024-12-06T17:10:29.065Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pencidesign Products: Soledad Problem Types: CWE-98 Description: The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.5.9 via several functions like penci_archive_more_post_ajax_func, penci_more_post_ajax_func, and penci_more_featured_post_ajax_func. This makes it possible for unauthenticated attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access control
HP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. The exploitability of this is limited to Windows. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/927674db-05f1-4f3b-8297-8a907955ea87?source=cve - https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398
CVE ID: CVE-2024-11290 State: PUBLISHED Published: 2025-01-07T04:22:17.572Z Last Updated: 2025-01-07T16:20:34.538Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: brownoxford Products: Member Access Problem Types: CWE-200 Description: The Member Access plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-in
h as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c7c448-fe9d-496d-84f2-0da8d1e13d64?source=cve - https://wordpress.org/plugins/member-access/#developers
CVE ID: CVE-2024-11291 State: PUBLISHED Published: 2024-12-18T11:09:31.646Z Last Updated: 2024-12-18T16:29:54.185Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: madalinungureanu Products: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Problem Types: CWE-200 Description: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts
WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e207f1a3-2ca5-46d1-91a9-89652451266c?source=cve - https://plugins.trac.wordpress.org/changeset/3206206/paid-member-subscriptions
CVE ID: CVE-2024-11292 State: PUBLISHED Published: 2024-12-06T08:24:50.717Z Last Updated: 2024-12-06T18:22:00.551Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nimeshrmr Products: WP Private Content Plus Problem Types: CWE-200 Description: The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordf
er-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30c46b91-e371-480f-943a-3906d8b6bbba?source=cve - https://wordpress.org/plugins/wp-private-content-plus/
CVE ID: CVE-2024-11293 State: PUBLISHED Published: 2024-12-04T07:32:26.085Z Last Updated: 2025-02-19T17:40:59.463Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Genetech Solutions Products: Pie Register - Social Sites Login (Add on) Problem Types: CWE-287 Description: The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthentica
insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/466ff226-a47e-46f1-a46c-6260208ffd42?source=cve - https://pieregister.com/
CVE ID: CVE-2024-11294 State: PUBLISHED Published: 2024-12-17T08:22:46.366Z Last Updated: 2024-12-17T14:37:53.936Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: memberful Products: Memberful – Membership Plugin Problem Types: CWE-200 Description: The Memberful plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.73.9 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as site members. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com
l roles such as site members. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/19ad787d-e027-48f5-8b5f-9263338b4fc3?source=cve - https://plugins.trac.wordpress.org/changeset/3204895/memberful-wp
CVE ID: CVE-2024-11295 State: PUBLISHED Published: 2024-12-18T07:02:46.168Z Last Updated: 2024-12-18T16:33:27.786Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: pluginsandsnippets Products: Simple Page Access Restriction Problem Types: CWE-200 Description: The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.29 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
been restricted to higher-level roles such as logged-in users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed92806e-5d75-4a23-a588-821e9ada1b32?source=cve - https://plugins.trac.wordpress.org/changeset/3205648/simple-page-access-restriction
CVE ID: CVE-2024-11296 State: REJECTED Published: N/A Last Updated: 2024-11-22T23:07:22.177Z Description: No description available.
CVE ID: CVE-2024-11297 State: PUBLISHED Published: 2024-12-20T06:59:07.444Z Last Updated: 2024-12-20T15:57:37.358Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: cyberlord92 Products: Page Restriction WordPress (WP) – Protect WP Pages/Post Problem Types: CWE-200 Description: The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analy
xtract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d12ab8c-d5d0-4e02-986e-e894fae073e5?source=cve - https://wordpress.org/plugins/page-and-post-restriction/
CVE ID: CVE-2024-11298 State: REJECTED Published: N/A Last Updated: 2024-11-22T23:04:09.217Z Description: No description available.
CVE ID: CVE-2024-11299 State: PUBLISHED Published: 2025-04-22T11:12:21.968Z Last Updated: 2025-04-22T13:22:12.865Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: MemberPress Products: Memberpress Problem Types: CWE-200 Description: The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-inte
as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/787cd2bb-489f-471a-82e0-073b4766b45a?source=cve - https://memberpress.com/change-log/#1.12.0
CVE ID: CVE-2024-11300 State: PUBLISHED Published: 2025-03-20T10:11:19.503Z Last Updated: 2025-10-15T12:49:29.238Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-639 Description: In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user. This issue affects version 1.6.2 and the main branch. The vulnerability allows unauthorized users to view sensitive prompt data by accessing specific URLs, leading to potential exposure of critical information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr
tential exposure of critical information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8dca7994-0d92-491e-a419-02adfe23ffa4 - https://github.com/lunary-ai/lunary/commit/79dc370596d979b756f6ea0250d97a2d02385ecd
CVE ID: CVE-2024-11301 State: PUBLISHED Published: 2025-03-20T10:10:00.614Z Last Updated: 2025-03-20T14:42:18.450Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-837 Description: In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator. The lack of database constraints or application-layer validation to prevent duplicates exposes the application to data integrity issu
atabase constraints or application-layer validation to prevent duplicates exposes the application to data integrity issues. This vulnerability can result in corrupted data and potentially malicious actions, impairing the system's functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3d99aca5-b135-4833-b48b-7806bc4bf861 - https://github.com/lunary-ai/lunary/commit/79dc370596d979b756f6ea0250d97a2d02385ecd
CVE ID: CVE-2024-11302 State: PUBLISHED Published: 2025-03-20T10:08:50.183Z Last Updated: 2025-03-20T19:02:01.118Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-304 Description: A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /install_binding and /reinstall_binding endpoints, among others, enabling unauthorized access and manipulation of binding settings without requiring the client_id value. Additional Analyst Notes: - CISA ADP Vulnrichment: R
pulation of binding settings without requiring the client_id value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e341304b-4651-4de9-b7b9-b89aead3b46e
CVE ID: CVE-2024-11303 State: PUBLISHED Published: 2024-11-18T13:24:37.376Z Last Updated: 2024-11-21T22:02:46.052Z Vendors: Korenix Products: JetPort 5601 Problem Types: CWE-22 Description: The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601: through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/en/en-st-polten-uas-path-traversal-in-korenix-jetport/
CVE ID: CVE-2024-11304 State: PUBLISHED Published: 2024-11-18T14:26:08.676Z Last Updated: 2024-11-21T22:02:47.577Z Vendors: SEH Computertechnik Products: utnserver Pro, utnserver ProMAX, INU-100 Problem Types: CWE-79 Description: Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS). This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/en/en-st-polten-uas-stored-cross-site-scripting-in-seh-utnserver-pro/index.html
CVE ID: CVE-2024-11305 State: PUBLISHED Published: 2024-11-18T00:31:04.617Z Last Updated: 2024-11-19T16:27:10.184Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Altenergy Products: Power Control Software Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee of the file /index.php/display/status_zigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respon
as been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284914 - https://vuldb.com/?ctiid.284914 - https://vuldb.com/?submit.439800 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/HYO%3BY)v%3B4%5C)jLCjp/Altenergy%20has%20a%20SQL%20injection%20vulnerability_status_zigbee.pdf
CVE ID: CVE-2024-11306 State: PUBLISHED Published: 2024-11-18T01:31:03.950Z Last Updated: 2024-11-19T16:28:22.622Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Altenergy Products: Power Control Software Problem Types: CWE-285, CWE-266 Description: A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processing of the file /index.php/display/database/. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other endpoints might be affected as well. The vendor was cont
exploit has been disclosed to the public and may be used. Other endpoints might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284915 - https://vuldb.com/?ctiid.284915 - https://vuldb.com/?submit.439804 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/HYO%3BY)v%3B4%5C)jLCjp/Altenergy%20Power%20Control%20Software%20Information%20Disclosure%20Vulnerability_database.pdf
CVE ID: CVE-2024-11308 State: PUBLISHED Published: 2024-11-18T05:59:30.085Z Last Updated: 2024-11-18T13:57:50.912Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TRCore Products: DVC Problem Types: CWE-321 Description: The DVC from TRCore encrypts files using a hardcoded key. Attackers can use this key to decrypt the files and restore the original content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8240-562c3-1.html - https://www.twcert.org.tw/en/cp-139-8241-1af92-2.html
CVE ID: CVE-2024-11309 State: PUBLISHED Published: 2024-11-18T06:02:59.603Z Last Updated: 2024-11-18T13:57:51.120Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TRCore Products: DVC Problem Types: CWE-23 Description: The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8242-384a1-1.html - https://www.twcert.org.tw/en/cp-139-8243-3d818-2.html
CVE ID: CVE-2024-11310 State: PUBLISHED Published: 2024-11-18T06:07:39.890Z Last Updated: 2024-11-18T13:57:51.244Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TRCore Products: DVC Problem Types: CWE-23 Description: The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8244-c45b5-1.html - https://www.twcert.org.tw/en/cp-139-8245-ad7d7-2.html
CVE ID: CVE-2024-11311 State: PUBLISHED Published: 2024-11-18T06:24:25.095Z Last Updated: 2024-11-18T13:57:51.361Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TRCore Products: DVC Problem Types: CWE-23, CWE-434 Description: The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8246-d462a-1.html - https://www.twcert.org.tw/en/cp-139-8247-83457-2.html
CVE ID: CVE-2024-11312 State: PUBLISHED Published: 2024-11-18T06:35:21.487Z Last Updated: 2024-11-18T13:57:51.501Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TRCore Products: DVC Problem Types: CWE-23, CWE-434 Description: The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8248-8dac9-1.html - https://www.twcert.org.tw/en/cp-139-8249-65252-2.html
CVE ID: CVE-2024-11313 State: PUBLISHED Published: 2024-11-18T06:39:04.518Z Last Updated: 2024-11-18T13:57:51.659Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TRCore Products: DVC Problem Types: CWE-23, CWE-434 Description: The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8250-1837b-1.html - https://www.twcert.org.tw/en/cp-139-8251-3455e-2.html
CVE ID: CVE-2024-11314 State: PUBLISHED Published: 2024-11-18T06:41:38.347Z Last Updated: 2024-11-18T13:48:30.521Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TRCore Products: DVC Problem Types: CWE-23, CWE-434 Description: The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8252-91d6a-1.html - https://www.twcert.org.tw/en/cp-139-8253-bc363-2.html
CVE ID: CVE-2024-11315 State: PUBLISHED Published: 2024-11-18T06:47:31.052Z Last Updated: 2024-11-18T14:07:52.977Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TRCore Products: DVC Problem Types: CWE-23, CWE-434 Description: The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8254-8daa2-1.html - https://www.twcert.org.tw/en/cp-139-8255-0bb1a-2.html
CVE ID: CVE-2024-11316 State: PUBLISHED Published: 2024-12-05T12:27:03.272Z Last Updated: 2024-12-05T18:35:25.727Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ABB Products: ASPECT-Enterprise, NEXUS Series, MATRIX Series Problem Types: CWE-770 Description: Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch