Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nclude/frontend.php#L20 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3143241%40clean-login&new=3143241%40clean-login&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8253 State: PUBLISHED Published: 2024-09-11T03:31:07.619Z Last Updated: 2024-09-11T18:56:30.780Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pickplugins Products: Post Grid and Gutenberg Blocks Problem Types: CWE-266 Description: The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not properly restricting what user meta values can be updated and ensuring a form is active. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta to become an administrator. Additional Analyst Notes
, with subscriber-level access and above, to update their user meta to become an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f5f18cae-b7f8-4afd-adfa-c616c63f9419?source=cve - https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L3032 - https://plugins.trac.wordpress.org/changeset/3130155/post-grid/tags/2.2.87/includes/blocks/form-wrap/functions.php - https://plugins.trac.wordpress.org/changeset/3146752/post-grid/tags/2.2.91/includes/blocks/form-wrap/functions.php
CVE ID: CVE-2024-8254 State: PUBLISHED Published: 2024-10-02T06:46:02.280Z Last Updated: 2024-10-02T13:35:59.445Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: icegram Products: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce Problem Types: CWE-94 Description: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that does not properly validate a value before runnin
4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4ae4a7-aec1-4cc1-bea0-61dde44027fc?source=cve - https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.7.29/lite/includes/class-es-common.php#L244 - https://plugins.trac.wordpress.org/changeset/3157336/
CVE ID: CVE-2024-8255 State: PUBLISHED Published: 2024-08-29T15:18:23.355Z Last Updated: 2024-08-29T16:27:26.826Z Vendors: Delta Electronics Products: DTN Soft Problem Types: CWE-502 Description: Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-242-02
CVE ID: CVE-2024-8256 State: PUBLISHED Published: 2024-12-10T08:56:55.195Z Last Updated: 2024-12-10T15:35:59.297Z Vendors: Teltonika Networks Products: RUTOS, TSWOS Problem Types: CWE-732 Description: In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.deepcove.support/teltonika-responsible-disclosure-proactive-testing-report/
CVE ID: CVE-2024-8258 State: PUBLISHED Published: 2024-09-10T08:36:34.326Z Last Updated: 2024-09-10T13:56:50.325Z Vendors: Logitech Products: Logitech Options Plus Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.electronjs.org/docs/latest/tutorial/fuses - https://nvd.nist.gov/vuln/detail/CVE-2023-50643 - https://nvd.nist.gov/vuln/detail/CVE-2023-49314 - https://github.com/r3ggi/electroniz3r
CVE ID: CVE-2024-8259 State: PUBLISHED Published: 2024-12-09T13:23:06.505Z Last Updated: 2025-04-03T19:26:35.191Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Eryaz Information Technologies Products: NatraCar B2B Dealer Management Program Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was contacted and it was learned that the product is not supported. Additional Analyst Notes: - CI
024. NOTE: The vendor was contacted and it was learned that the product is not supported. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1881
CVE ID: CVE-2024-8260 State: PUBLISHED Published: 2024-08-30T12:22:45.964Z Last Updated: 2024-08-30T13:17:20.246Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: Styra Products: OPA Problem Types: CWE-294 Description: A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2024-36
CVE ID: CVE-2024-8261 State: PUBLISHED Published: 2025-03-03T14:21:39.505Z Last Updated: 2025-09-12T07:01:37.366Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Proliz Software Products: OBS Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Proliz Software OBS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OBS: before 24.0927. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0049
CVE ID: CVE-2024-8262 State: PUBLISHED Published: 2025-03-03T14:25:48.344Z Last Updated: 2025-09-12T07:06:28.200Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Proliz Software Products: OBS Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Proliz Software OBS allows Path Traversal.This issue affects OBS: before 24.0927. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0049
CVE ID: CVE-2024-8263 State: PUBLISHED Published: 2024-09-23T20:12:51.005Z Last Updated: 2024-09-23T20:36:38.566Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-269 Description: An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.1
Notes: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.1 - https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.4 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.9 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.15 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.17
CVE ID: CVE-2024-8264 State: PUBLISHED Published: 2024-10-09T22:44:35.429Z Last Updated: 2024-10-10T20:16:18.755Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Fortra Products: Robot Schedule Enterprise Problem Types: CWE-532 Description: Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisories/product-security/fi-2024-012 - https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Robot/RobotScheduleEnterprise.htm
CVE ID: CVE-2024-8266 State: PUBLISHED Published: 2025-02-13T00:54:15.748Z Last Updated: 2025-02-13T15:06:49.385Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-250 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a pipeline as project owner under certain circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/481531 - https://hackerone.com/reports/2649798
CVE ID: CVE-2024-8267 State: PUBLISHED Published: 2024-09-24T06:40:55.395Z Last Updated: 2025-08-27T21:43:06.368Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: princeahmed Products: Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress Problem Types: CWE-79 Description: The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute within the 'wp:radio-player' Gutenberg block in all versions up to, and including, 2.0.78 due to insufficient input sanitization and output escaping. This makes it possible for authenticate
nd including, 2.0.78 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49581614-14a8-4450-8f83-d8d22a3feee9?source=cve - https://plugins.trac.wordpress.org/browser/radio-player/trunk/block/class-block.php#L26 - https://wordpress.org/plugins/radio-player/#developers - https://plugins.trac.wordpress.org/changeset/3152379/ - https://plugins.trac.wordpress.org/changeset/315
r/#developers - https://plugins.trac.wordpress.org/changeset/3152379/ - https://plugins.trac.wordpress.org/changeset/3152379/radio-player/trunk/block/class-block.php
CVE ID: CVE-2024-8268 State: PUBLISHED Published: 2024-09-10T02:05:10.921Z Last Updated: 2024-09-10T13:43:09.485Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: vinoth06 Products: Frontend Dashboard Problem Types: CWE-94 Description: The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords. Additional
ove, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d66694a-c99f-44f8-8004-1a47ad9f9250?source=cve - https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.4/route/class-fed-request.php#L29 - https://plugins.trac.wordpress.org/changeset/3147868/frontend-dashboard/tags/2.2.5/route/class-fed-request.php?old=3048034&old_path=frontend-dashboard%2Ftags%2F2.2.4%2Froute%2Fclass-fed-request.php
CVE ID: CVE-2024-8269 State: PUBLISHED Published: 2024-09-13T15:10:38.839Z Last Updated: 2024-09-13T18:05:46.615Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: inspireui Products: MStore API – Create Native Android & iOS Apps On The Cloud Problem Types: CWE-284 Description: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user account through the register() function. This makes it possible for unauthenticated attackers to create user accoun
user account through the register() function. This makes it possible for unauthenticated attackers to create user accounts on sites, even when user registration is disabled and plugin functionality is not activated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/59c5b6e7-74b0-430d-8b4a-5a42220f3ec9?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.15.2/controllers/flutter-user.php#L406 - https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.15.2/controllers/flutter-user.php#L454 - https://plugins.trac.wordpress.org/changeset/3147900/mstore-api/trunk/controllers/flutter-user.php
CVE ID: CVE-2024-8270 State: PUBLISHED Published: 2025-06-10T23:22:10.307Z Last Updated: 2025-06-11T13:49:40.053Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Rocket.Chat Products: Rocket.Chat Desktop Problem Types: CWE-863 Description: The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploitation or abuse of permissions specified in its entitlements (e.g., microphone, camera, automation, network client). Since Rocket.Chat was not signed with the Hardened Runtime nor set to enforce Library Validation, it is vulnerable to DYLIB injection attacks, which can
with the Hardened Runtime nor set to enforce Library Validation, it is vulnerable to DYLIB injection attacks, which can lead to unauthorized actions or escalation of permissions. Consequently, an attacker gains capabilities that are not permitted by default under the Sandbox and its application profile. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pentraze.com/ - https://pentraze.com/vulnerability-reports/
CVE ID: CVE-2024-8271 State: PUBLISHED Published: 2024-09-14T02:04:21.236Z Last Updated: 2024-09-16T18:32:13.070Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: realmag777 Products: FOX – Currency Switcher Professional for WooCommerce Problem Types: CWE-94 Description: The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode in the 'woocs_get_custom_price_html' function. This makes it possible for unauthenticated
ue before running do_shortcode in the 'woocs_get_custom_price_html' function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dec51bd6-2ffe-47b6-9423-6131395bf439?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-currency-switcher/tags/1.4.2.1/classes/woocs.php#L4604 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3150596%40woocommerce-currency-switcher&new=3150596%40woocommerce-currency-switcher&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8272 State: PUBLISHED Published: 2024-11-25T17:52:14.805Z Last Updated: 2024-11-25T18:42:00.202Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Universal Audio Products: UAConnect Problem Types: CWE-862 Description: The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service's methods and escalate privi
nnection. This lack of proper validation allows unauthorized clients to exploit the service's methods and escalate privileges to root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pentraze.com/vulnerability-reports
CVE ID: CVE-2024-8274 State: PUBLISHED Published: 2024-08-30T09:29:48.794Z Last Updated: 2024-08-30T13:26:07.765Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpdevelop Products: WP Booking Calendar Problem Types: CWE-79 Description: The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to, and including, 10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on
ry web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83804c2a-2c4a-4f69-b833-dcd53ddab94d?source=cve - https://plugins.trac.wordpress.org/browser/booking/tags/10.4/core/timeline/v2/wpbc-class-timeline_v2.php#L520 - https://plugins.trac.wordpress.org/changeset/3143364/booking/trunk/core/timeline/v2/wpbc-class-timeline_v2.php?old=3139443&old_path=booking%2Ftrunk%2Fcore%2Ftimeline%2Fv2%2Fwpbc-class-timeline_v2.php
CVE ID: CVE-2024-8275 State: PUBLISHED Published: 2024-09-25T04:30:28.690Z Last Updated: 2024-09-25T13:49:03.800Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: theeventscalendar Products: The Events Calendar Problem Types: CWE-89 Description: The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing quer
query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f59891c7-db1a-4688-8616-8877d7d7960d?source=cve - https://theeventscalendar.com/knowledgebase/customizing-template-files-2-legacy/ - https://docs.theeventscalendar.com/reference/functions/tribe_has_next_event/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&repo
.com/reference/functions/tribe_has_next_event/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3152853%40the-events-calendar&new=3152853%40the-events-calendar&sfp_email=&sfph_mail=#file18
CVE ID: CVE-2024-8276 State: PUBLISHED Published: 2024-08-31T07:36:54.206Z Last Updated: 2024-09-03T15:25:10.929Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpzoom Products: WPZOOM Portfolio Lite – Filterable Portfolio Plugin Problem Types: CWE-79 Description: The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject
output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7d5503-0a6e-4611-bb7c-b2871be828be?source=cve - https://plugins.trac.wordpress.org/browser/wpzoom-portfolio/trunk/build/blocks/portfolio-layouts/index.php#L63 - https://wordpress.org/plugins/wpzoom-portfolio/#developers - https://plugins.trac.wordpress.org/changeset/3144394
CVE ID: CVE-2024-8277 State: PUBLISHED Published: 2024-09-11T08:31:05.071Z Last Updated: 2024-09-11T18:07:22.496Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: villatheme Products: WooCommerce Photo Reviews Premium Problem Types: CWE-288 Description: The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login() function and not properly verifying the user's identity. This makes it possible for unauthenticated attackers to log in as user that has dismissed an admin notice in
identity. This makes it possible for unauthenticated attackers to log in as user that has dismissed an admin notice in the past 30 days, which is often an administrator. Alternatively, a user can log in as any user with any transient that has a valid user_id as the value, though it would be more difficult to exploit this successfully. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e2d370-a716-4d6b-8e23-74db2fbd0760?source=cve - https://codecanyon.net/item/woocommerce-photo-reviews/21245349
CVE ID: CVE-2024-8278 State: PUBLISHED Published: 2024-09-13T17:27:19.968Z Last Updated: 2024-09-13T21:02:31.667Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: HX5530 Appliance (ThinkAgile) XCC, HX7530 Appliance (ThinkAgile) XCC, ST250 V3 (ThinkSystem) XCC, VX3331 Certified Node (ThinkAgile) XCC, HX Enclosure Certified Node (ThinkAgile) XCC, HX1021 Edge Certified Node 3yr (ThinkAgile) XCC, HX1320 Appliance (ThinkAgile) XCC, HX1321 Certified Node (ThinkAgile) XCC, HX1331 Certified Node (ThinkAgile) XCC, HX1520-R Appliance (ThinkAgile) XCC, HX1521-R Certified Node (ThinkAgile) XCC, HX2320-E Appliance (ThinkAgile) XCC, HX2321 Certified Node (Th
hinkAgile) XCC, HX1521-R Certified Node (ThinkAgile) XCC, HX2320-E Appliance (ThinkAgile) XCC, HX2321 Certified Node (ThinkAgile) XCC, HX2330 Appliance (ThinkAgile) XCC, HX2331 Certified Node (ThinkAgile) XCC, HX2720-E Appliance (ThinkAgile) XCC, HX3320 Appliance (ThinkAgile) XCC, HX3321 Certified Node (ThinkAgile) XCC, HX3330 Appliance (ThinkAgile) XCC, HX3331 Certified Node (ThinkAgile) XCC, HX3331 Node SAP HANA (ThinkAgile) XCC, HX3375 Appliance (ThinkAgile) XCC, HX3376 Certified Node (ThinkAgile) XCC, HX3520-G Appliance (ThinkAgile) XCC, HX3521-G Certified Node (ThinkAgile) XCC, HX3720 Appliance (ThinkAgile) XCC, HX3721 Certified Node (ThinkAgile) XCC, HX5520 Appliance (ThinkAgile) XCC,