Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11106 State: PUBLISHED Published: 2024-12-10T11:09:11.914Z Last Updated: 2024-12-10T15:04:53.904Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpchill Products: Simple Restrict Problem Types: CWE-200 Description: The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-in
h as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb50bc9-5ad7-402e-a624-90f3302e1b0c?source=cve - https://plugins.trac.wordpress.org/changeset/3198971/simple-restrict
CVE ID: CVE-2024-11107 State: PUBLISHED Published: 2024-12-10T06:00:02.187Z Last Updated: 2024-12-10T15:15:07.287Z Vendors: Unknown Products: System Dashboard Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a89f1117-8df3-417b-b54f-6587545833ee/
CVE ID: CVE-2024-11108 State: PUBLISHED Published: 2024-12-20T06:00:04.403Z Last Updated: 2024-12-20T16:11:45.944Z Vendors: Unknown Products: Serious Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7790af9d-621b-474c-b28c-c774e2a292bb/
CVE ID: CVE-2024-11109 State: PUBLISHED Published: 2025-05-15T20:06:47.255Z Last Updated: 2025-05-20T15:09:08.861Z Vendors: Unknown Products: WP Google Review Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/93619da1-a8d6-43b6-b1be-8d50ab6f29f7/
CVE ID: CVE-2024-11110 State: PUBLISHED Published: 2024-11-12T20:09:25.966Z Last Updated: 2024-11-13T15:29:57.897Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Extensions in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/373263969
CVE ID: CVE-2024-11111 State: PUBLISHED Published: 2024-11-12T20:09:26.249Z Last Updated: 2024-11-13T15:27:22.201Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Autofill in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/360520331
CVE ID: CVE-2024-11112 State: PUBLISHED Published: 2024-11-12T20:09:26.760Z Last Updated: 2024-11-12T20:23:22.466Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Media in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/354824998
CVE ID: CVE-2024-11113 State: PUBLISHED Published: 2024-11-12T20:09:27.015Z Last Updated: 2024-11-12T20:22:13.811Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Accessibility in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/360274917
CVE ID: CVE-2024-11114 State: PUBLISHED Published: 2024-11-12T20:09:27.261Z Last Updated: 2024-11-12T20:26:00.381Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Views in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/370856871
CVE ID: CVE-2024-11115 State: PUBLISHED Published: 2024-11-12T20:09:27.477Z Last Updated: 2024-11-13T15:25:02.925Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 131.0.6778.69 allowed a remote attacker to perform privilege escalation via a series of UI gestures. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/371929521
CVE ID: CVE-2024-11116 State: PUBLISHED Published: 2024-11-12T20:09:27.786Z Last Updated: 2024-11-13T15:22:37.540Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/40942531
CVE ID: CVE-2024-11117 State: PUBLISHED Published: 2024-11-12T20:09:27.997Z Last Updated: 2024-11-13T15:20:26.268Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in FileSystem in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/40062534
CVE ID: CVE-2024-11118 State: PUBLISHED Published: 2024-11-16T03:20:47.028Z Last Updated: 2024-11-19T15:13:20.498Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: bilbud Products: 404 Error Monitor Problem Types: CWE-352 Description: The 404 Error Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the updatePluginSettings() function. This makes it possible for unauthenticated attackers to make changes to plugin settings and clear up all the error logs via a forged request granted they can trick a site administrator into performing an actio
nd clear up all the error logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ba7a54d-3497-4788-aa73-081d2c1015fc?source=cve - https://wordpress.org/plugins/404-error-monitor/#developers - https://plugins.trac.wordpress.org/browser/404-error-monitor/trunk/index.php#L274
CVE ID: CVE-2024-11119 State: PUBLISHED Published: 2024-11-26T08:31:53.929Z Last Updated: 2024-11-26T14:09:24.270Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bluenotes Products: BNE Gallery Extended Problem Types: CWE-79 Description: The BNE Gallery Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9277d8-ac81-4950-a1e5-4e6c6b042f84?source=cve - https://plugins.trac.wordpress.org/browser/bne-gallery-extended/trunk/bne-gallery-extended.php#L178 - https://wordpress.org/plugins/bne-gallery-extended/#developers - https://plugins.trac.wordpress.org/changeset/3191705/
CVE ID: CVE-2024-11120 State: PUBLISHED Published: 2024-11-15T02:00:27.361Z Last Updated: 2025-10-21T22:55:36.559Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GeoVision Products: GV-VS12, GV-VS11, GV-DSP_LPR_V3, GVLX 4 V2, GVLX 4 V3 Problem Types: CWE-78 Description: Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert
nd we have received related reports. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html - https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html
CVE ID: CVE-2024-11121 State: PUBLISHED Published: 2024-11-12T12:31:09.040Z Last Updated: 2024-11-12T15:55:02.598Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: 上海灵当信息科技有限公司 Products: Lingdang CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this vulnerability is an unknown functionality of the file /crm/WeiXinApp/marketing/index.php?module=Users&action=getActionList. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclo
remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283969 - https://vuldb.com/?ctiid.283969 - https://vuldb.com/?submit.436675 - https://wiki.shikangsi.com/post/share/4d05b8c3-5464-48f3-bb14-a852b6e70abc
CVE ID: CVE-2024-11122 State: PUBLISHED Published: 2024-11-12T12:31:19.484Z Last Updated: 2024-11-12T15:53:43.002Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: 上海灵当信息科技有限公司 Products: Lingdang CRM Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this issue is some unknown functionality of the file /crm/wechatSession/index.php?msgid=1&operation=upload. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disc
d remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283970 - https://vuldb.com/?ctiid.283970 - https://vuldb.com/?submit.436676 - https://wiki.shikangsi.com/post/share/8c9422c2-ecad-4471-97a2-6f8035a2ddf5
CVE ID: CVE-2024-11123 State: PUBLISHED Published: 2024-11-12T13:00:13.781Z Last Updated: 2024-11-12T15:52:04.520Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: 上海灵当信息科技有限公司 Products: Lingdang CRM Problem Types: CWE-22 Description: A vulnerability, which was classified as problematic, was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. This affects an unknown part of the file /crm/data/pdf.php. The manipulation of the argument url with the input ../config.inc.php leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but di
he exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283971 - https://vuldb.com/?ctiid.283971 - https://vuldb.com/?submit.436677 - https://wiki.shikangsi.com/post/share/39d736ad-73d1-49cd-a97f-59f396a58626
CVE ID: CVE-2024-11124 State: PUBLISHED Published: 2024-11-12T13:31:04.688Z Last Updated: 2024-11-12T14:13:26.626Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: TimGeyssens Products: UIOMatic Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in TimGeyssens UIOMatic 5 and classified as critical. This vulnerability affects unknown code of the file /src/UIOMatic/wwwroot/backoffice/resources/uioMaticObject.r. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283972 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283972 - https://vuldb.com/?ctiid.283972 - https://github.com/TimGeyssens/UIOMatic/pull/227 - https://github.com/TimGeyssens/UIOMatic/pull/227#issuecomment-2346074453 - https://github.com/TimGeyssens/UIOMatic/pull/227#issuecomment-2317993695
CVE ID: CVE-2024-11125 State: PUBLISHED Published: 2024-11-12T14:31:05.119Z Last Updated: 2024-11-12T15:46:07.836Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: GetSimpleCMS Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic. This issue affects some unknown processing of the file /admin/profile.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283973 - https://vuldb.com/?ctiid.283973 - https://vuldb.com/?submit.437090 - https://github.com/Zeynalxan/zero-day/blob/main/GetSimpleCMS-CVE.md
CVE ID: CVE-2024-11126 State: PUBLISHED Published: 2024-11-12T14:31:06.409Z Last Updated: 2024-11-12T20:13:26.812Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Digistar Products: AG-30 Plus Problem Types: CWE-307, CWE-799 Description: A vulnerability was found in Digistar AG-30 Plus 2.6b. It has been classified as problematic. Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of excessive authentication attempts. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst
to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283974 - https://vuldb.com/?ctiid.283974 - https://vuldb.com/?submit.437096
CVE ID: CVE-2024-11127 State: PUBLISHED Published: 2024-11-12T15:00:09.579Z Last Updated: 2024-11-12T15:57:15.318Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.28397
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283975 - https://vuldb.com/?ctiid.283975 - https://vuldb.com/?submit.441841 - https://github.com/ljllll123/cve/blob/main/sql-1.md - https://code-projects.org/
CVE ID: CVE-2024-11128 State: PUBLISHED Published: 2025-01-13T21:49:30.628Z Last Updated: 2025-01-14T00:17:56.801Z Vendors: Bitdefender Products: Virus Scanner Problem Types: CWE-269 Description: A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) without being blocked by AppleMobileFileIntegrity (AMFI). This issue is caused by the absence of Hardened Runtime or Library Validation signing. This issue affects Bitdefender Virus Scanner versions before 3.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/insufficient-har
t Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/insufficient-hardened-runtime-or-library-validation-signing-in-bitdefender-virus-scanner-for-macos/
CVE ID: CVE-2024-11129 State: PUBLISHED Published: 2025-04-10T13:02:48.148Z Last Updated: 2025-04-10T13:16:35.153Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-209 Description: An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/503722 - https://hackerone.com/reports/2717400
CVE ID: CVE-2024-11130 State: PUBLISHED Published: 2024-11-12T15:00:12.803Z Last Updated: 2024-11-12T15:51:29.758Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: ZZCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/msg.php. The manipulation of the argument keyword leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283976 - https://vuldb.com/?ctiid.283976
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283976 - https://vuldb.com/?ctiid.283976 - https://vuldb.com/?submit.439699 - https://github.com/En0t5/vul/blob/main/zzcms-msg-xss.md
CVE ID: CVE-2024-11131 State: PUBLISHED Published: 2025-03-19T02:15:27.507Z Last Updated: 2025-03-19T14:04:50.829Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: Camera Firmware Problem Types: CWE-125 Description: A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.2.0-0525 may be affected: BC500, CC400W and TC500. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_24
CVE ID: CVE-2024-11132 State: PUBLISHED Published: 2025-02-03T19:22:48.750Z Last Updated: 2025-02-03T20:19:57.879Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: imithemes Products: Eventer - WordPress Event & Booking Manager Plugin Problem Types: CWE-79 Description: The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user acces
contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b747d61-4528-485e-b746-6dddc64485b5?source=cve - https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534
CVE ID: CVE-2024-11133 State: PUBLISHED Published: 2025-02-03T19:22:43.870Z Last Updated: 2025-02-03T20:20:23.474Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: imithemes Products: Eventer - WordPress Event & Booking Manager Plugin Problem Types: CWE-862 Description: The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function in all versions up to, and including, 3.9.9. This makes it possible for unauthenticated attackers to download event tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabi
ckets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d78b823-fdff-41b2-8059-6564e3eb668d?source=cve - https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534
CVE ID: CVE-2024-11134 State: PUBLISHED Published: 2025-02-03T19:22:49.151Z Last Updated: 2025-02-03T20:19:33.435Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: imithemes Products: Eventer - WordPress Event & Booking Manager Plugin Problem Types: CWE-862 Description: The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to download bookings, which contains customers' personal data. Additional Analyst Notes: - CISA AD