Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-0963 State: PUBLISHED Published: 2024-02-02T11:34:15.217Z Last Updated: 2025-05-07T20:08:24.892Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codepeople Products: Calculated Fields Form Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it possible for authenticated attackers with
tion and output escaping on user supplied 'location' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d870ff8d-ea4b-4777-9892-0d9982182b9f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3029782%40calculated-fields-form&new=3029782%40calculated-fields-form&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3029782/calculated-f
29782%40calculated-fields-form&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3029782/calculated-fields-form/trunk/inc/cpcff_main.inc.php
CVE ID: CVE-2024-0964 State: PUBLISHED Published: 2024-02-05T22:53:44.859Z Last Updated: 2024-08-26T18:01:55.393Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-22 Description: A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741 - https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70
CVE ID: CVE-2024-0965 State: PUBLISHED Published: 2024-02-08T08:32:08.194Z Last Updated: 2024-11-07T19:57:16.741Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: pluginsandsnippets Products: Simple Page Access Restriction Problem Types: CWE-284 Improper Access Control Description: The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's page restriction and view page content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
view page content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d99dc270-1b28-4e76-9346-38b2b96be01c?source=cve - https://plugins.trac.wordpress.org/changeset/3030099/simple-page-access-restriction
CVE ID: CVE-2024-0966 State: PUBLISHED Published: 2024-03-12T23:33:50.511Z Last Updated: 2024-08-01T19:07:44.107Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: 3uu Products: Shariff Wrapper Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping on user supplied attributes like 'info_text'. This makes it possible for authenticated attackers with contributor-level and above permi
d attributes like 'info_text'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks the information icon. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8588f9e8-441c-4b9e-bd78-8526d8c28fa3?source=cve - https://plugins.trac.wordpress.org/browser/shariff/trunk/services/shariff-info.php#L46 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030487%40shariff&new=3030487%40shariff&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0967 State: PUBLISHED Published: 2024-03-01T14:26:09.689Z Last Updated: 2024-12-02T15:12:49.871Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: OpenText Products: ArcSight Enterprise Security Manager Problem Types: Remote Vulnerability Description: A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Enterprise Security Manager (ESM). The vulnerability could be remotely exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.microfocus.com/s/article/KM000027060
CVE ID: CVE-2024-0968 State: REJECTED Published: 2024-03-02T21:38:41.309Z Last Updated: 2024-04-08T11:06:07.879Z Description: No description available.
CVE ID: CVE-2024-0969 State: PUBLISHED Published: 2024-02-05T21:22:05.137Z Last Updated: 2024-08-26T18:06:13.338Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: reputeinfosystems Products: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Problem Types: CWE-284 Improper Access Control Description: The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Default Restriction" feature and view restricted post content. Additional Analyst Notes: - CVE Progra
pass the plugin's "Default Restriction" feature and view restricted post content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea4e6718-4e1e-44ce-8463-860f0d3d80f5?source=cve - https://plugins.trac.wordpress.org/changeset/3030044/armember-membership/trunk/core/classes/class.arm_restriction.php
CVE ID: CVE-2024-0970 State: PUBLISHED Published: 2025-05-15T20:09:32.658Z Last Updated: 2025-11-13T21:07:50.088Z Vendors: Unknown Products: User Activity Tracking and Log Problem Types: CWE-290 Authentication Bypass by Spoofing Description: This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7df6877c-6640-41be-aacb-20c7da61e4db/
CVE ID: CVE-2024-0971 State: PUBLISHED Published: 2024-02-06T23:38:32.704Z Last Updated: 2024-08-01T18:26:30.266Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Tenable Products: Nessus Problem Types: CWE-89 Description: A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter scan DB content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/tns-2024-01
CVE ID: CVE-2024-0972 State: PUBLISHED Published: 2024-06-06T03:53:11.546Z Last Updated: 2024-08-01T18:26:30.359Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: zhuyi Products: BuddyPress Members Only Problem Types: CWE-284 Improper Access Control Description: The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.5 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "All Other Sections On Your Site Will be Opened to Guest" feature (when unset) and view restricted page and post content. Additional Analyst Notes: - CISA ADP Vulnrichme
o Guest" feature (when unset) and view restricted page and post content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfead67-d75d-46ae-ac68-a34643ac2f52?source=cve - https://plugins.trac.wordpress.org/browser/buddypress-members-only/trunk/buddypress-members-only.php#L682
CVE ID: CVE-2024-0973 State: PUBLISHED Published: 2024-03-18T19:05:46.858Z Last Updated: 2024-08-28T21:07:30.092Z Vendors: Unknown Products: Widget for Social Page Feeds Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/798de421-4814-46a9-a055-ebb95a7218ed/
CVE ID: CVE-2024-0974 State: PUBLISHED Published: 2024-07-12T06:00:04.368Z Last Updated: 2024-08-01T18:26:30.265Z Vendors: Unknown Products: Social Media Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/7f8e5e63-a928-443e-9771-8b3f51f5eb9e/
CVE ID: CVE-2024-0975 State: PUBLISHED Published: 2024-02-28T08:33:06.117Z Last Updated: 2024-08-01T18:26:30.346Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: brandonwamboldt Products: WordPress Access Control Problem Types: CWE-284 Improper Access Control Description: The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Make Website Members Only" feature (when unset) and view restricted page and post content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
(when unset) and view restricted page and post content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31f13524-2bd7-4157-b378-455ac4f822a1?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-access-control/trunk/wordpress-access-control.php#L289
CVE ID: CVE-2024-0976 State: PUBLISHED Published: 2024-03-13T15:26:48.336Z Last Updated: 2024-08-01T18:26:30.195Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpeventmanager Products: WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the plugin parameter in all versions up to, and including, 3.1.41 due to insufficient input sanitization and output esca
the plugin parameter in all versions up to, and including, 3.1.41 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7f4d17-8318-4ab3-b4a2-81d7a017c397?source=cve - https://plugins.trac.wordpress.org/browser/wp-event-manager/trunk/admin/wp-event-manager-shortcode-list.php#L32 - https://plugins.trac.wordpress.org/changeset/3039683/wp-event-m
er/trunk/admin/wp-event-manager-shortcode-list.php#L32 - https://plugins.trac.wordpress.org/changeset/3039683/wp-event-manager/trunk/admin/wp-event-manager-shortcode-list.php
CVE ID: CVE-2024-0977 State: PUBLISHED Published: 2024-02-07T07:32:18.502Z Last Updated: 2024-08-01T18:26:30.147Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: narinder-singh Products: Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image URLs in the plugin's timeline widget in all versions up to, and including, 1.5.3 due to insufficient input saniti
image URLs in the plugin's timeline widget in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, changes the slideshow type, and then changes it back to an image. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03073726-58d0-45b3-b7a6-7d12dbede919?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_m
ties/id/03073726-58d0-45b3-b7a6-7d12dbede919?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3029865%40timeline-widget-addon-for-elementor&new=3029865%40timeline-widget-addon-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0978 State: PUBLISHED Published: 2024-02-20T18:56:37.577Z Last Updated: 2024-08-08T18:51:19.618Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dgewirtz Products: My Private Site Problem Types: CWE-284 Improper Access Control Description: The My Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.14 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's site privacy feature and view restricted page and post content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/t
t. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/970bc71c-7d0a-4761-874a-379cda71418e?source=cve - https://plugins.trac.wordpress.org/changeset/3036015/jonradio-private-site
CVE ID: CVE-2024-0979 State: PUBLISHED Published: 2024-06-13T08:31:32.095Z Last Updated: 2024-08-01T18:26:30.271Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: specialk Products: Dashboard Widgets Suite Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they c
ng. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe4d99c-9cbd-4255-8f90-f904313d46b4?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3101348%40dashboard-widgets-suite&new=3101348%40dashboard-widgets-suite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0980 State: PUBLISHED Published: 2024-03-27T23:16:37.513Z Last Updated: 2024-08-01T18:26:30.489Z Vendors: Okta Products: Okta Verify for Windows Problem Types: CWE-22, CWE-427 Description: The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980
CVE ID: CVE-2024-0981 State: PUBLISHED Published: 2024-07-23T20:49:31.774Z Last Updated: 2024-08-01T18:26:30.219Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Okta Products: Okta Browser Plugin Problem Types: CWE-79 Description: Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerability. Importantly, if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not aff
if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not affected by this issue. The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981
CVE ID: CVE-2024-0983 State: PUBLISHED Published: 2024-02-20T18:56:20.718Z Last Updated: 2024-08-01T18:26:30.260Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-862 Missing Authorization Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enableOptimization function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to enable image optimization. Additional Analyst Notes: - CISA ADP
ed attackers, with subscriber-level access and above, to enable image optimization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/175dd04d-ce06-45a0-8cfe-14498e2f9198?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-0984 State: PUBLISHED Published: 2024-02-20T18:56:45.626Z Last Updated: 2024-08-07T17:46:29.972Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-862 Missing Authorization Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disableOptimization function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to disable the image optimization setting. Additional Analyst Not
ted attackers, with subscriber-level access and above, to disable the image optimization setting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc9dd55d-3c37-4f24-81a1-fdc8ca284566?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-0985 State: PUBLISHED Published: 2024-02-08T13:00:02.411Z Last Updated: 2025-06-13T15:09:30.114Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: PostgreSQL Problem Types: CWE-271 Description: Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRE
er of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.postgresql.org/support/security/CVE-2024-0985/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00017.html - https://saites.dev/projects/personal/postgres-cve-2024-0985/
CVE ID: CVE-2024-0986 State: PUBLISHED Published: 2024-01-28T23:31:04.667Z Last Updated: 2025-05-29T15:11:05.761Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Issabel Products: PBX Problem Types: CWE-78 Description: A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_cli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252251. NOTE: The vendor was contacted early ab
and may be used. The associated identifier of this vulnerability is VDB-252251. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252251 - https://vuldb.com/?ctiid.252251 - https://drive.google.com/file/d/10BYLQ7Rk4oag96afLZouSvDDPvsO7SoJ/view?usp=drive_link - https://www.vicarius.io/vsociety/posts/issabel-authenticated-remote-code-execution-cve-2024-0986
CVE ID: CVE-2024-0987 State: PUBLISHED Published: 2024-01-29T00:00:08.965Z Last Updated: 2024-08-27T20:32:28.243Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Sichuan Yougou Technology Products: KuERP Problem Types: CWE-117 Description: A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log. The manipulation leads to improper output neutralization for logs. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252252. NOTE: The vendor was contacted early about this disclosure but did not respond in any
this vulnerability is VDB-252252. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252252 - https://vuldb.com/?ctiid.252252 - https://note.zhaoj.in/share/mhLwGOcLxYfP