Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-0405 State: PUBLISHED Published: 2024-01-17T04:32:16.771Z Last Updated: 2025-06-02T15:06:30.290Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: rogierlankhorst Products: Burst Statistics – Privacy-Friendly Analytics for WordPress Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', an
n/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and the lack of adequate preparation in SQL queries. As a result, authenticated attackers with editor access or higher can append additional SQL queries into existing ones, potentially leading to unauthorized access to sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e349f07d-a520-4700-a6e0-25e68c1deeae?source=cve - https://plugins.trac.word
ordfence.com/threat-intel/vulnerabilities/id/e349f07d-a520-4700-a6e0-25e68c1deeae?source=cve - https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/statistics/class-statistics.php?rev=3011996#L380 - https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/statistics/class-statistics.php?rev=3011996#L926 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3020809%40burst-statistics%2Ftrunk&old=3012004%40burst-statistics%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0406 State: PUBLISHED Published: 2024-04-06T16:11:02.643Z Last Updated: 2025-11-20T18:08:52.704Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.18, Red Hat Advanced Cluster Security 3, Red Hat Advanced Cluster Security 4 Problem Types: CWE-22 Description: A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library. Additional Analys
ow the creation or overwriting of files with the user's or application's privileges using the library. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:2449 - https://access.redhat.com/security/cve/CVE-2024-0406 - https://bugzilla.redhat.com/show_bug.cgi?id=2257749
CVE ID: CVE-2024-0407 State: PUBLISHED Published: 2024-02-20T18:35:41.291Z Last Updated: 2024-11-15T18:08:33.405Z Vendors: HP Inc. Products: Certain HP Enterprise LaserJet, HP LaserJet Managed Printers Description: Certain HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to information disclosure, when connections made by the device back to services enabled by some solutions may have been trusted without the appropriate CA certificate in the device's certificate store. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_10174094-10174120-16
CVE ID: CVE-2024-0408 State: PUBLISHED Published: 2024-01-18T15:40:06.955Z Last Updated: 2025-11-20T07:08:59.547Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6 Problem Types: CWE-158 Description: A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use
y) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0320 - https://access.redhat.com/errata/RHSA-2024:2169 - https://access.redhat.com/errata/RHSA-2024:2170 - https://access.redhat.com/errata/RHSA-2024:2995 - https://access.redhat.com/errata/RHSA-2024:2996 - https://access.redhat.com/security/cve/CVE-2024-0408 - https://bugzilla.redhat.com/show_bug.cgi?id=2257689
CVE ID: CVE-2024-0409 State: PUBLISHED Published: 2024-01-18T15:40:22.071Z Last Updated: 2025-11-20T07:09:01.279Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6 Problem Types: CWE-787 Description: A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
verwrites the XSELINUX context. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0320 - https://access.redhat.com/errata/RHSA-2024:2169 - https://access.redhat.com/errata/RHSA-2024:2170 - https://access.redhat.com/errata/RHSA-2024:2995 - https://access.redhat.com/errata/RHSA-2024:2996 - https://access.redhat.com/security/cve/CVE-2024-0409 - https://bugzilla.redhat.com/show_bug.cgi?id=2257690
CVE ID: CVE-2024-0410 State: PUBLISHED Published: 2024-02-21T23:30:59.792Z Last Updated: 2025-11-20T04:11:49.579Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-841 Description: An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/437988 - https://hackerone.com/reports/2296778
CVE ID: CVE-2024-0411 State: PUBLISHED Published: 2024-01-11T16:31:04.526Z Last Updated: 2025-06-03T14:07:54.332Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: DeShang Products: DSMall Problem Types: CWE-284 Description: A vulnerability was found in DeShang DSMall up to 6.1.0. It has been classified as problematic. This affects an unknown part of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250431. Additional Analyst
closed to the public and may be used. The associated identifier of this vulnerability is VDB-250431. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250431 - https://vuldb.com/?ctiid.250431 - https://note.zhaoj.in/share/9G6K6RBjS4M4
CVE ID: CVE-2024-0412 State: PUBLISHED Published: 2024-01-11T16:31:05.773Z Last Updated: 2025-06-03T14:07:49.295Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: DeShang Products: DSShop Problem Types: CWE-284 Description: A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250432. Additional Analyst Notes: - CVE
losed to the public and may be used. The identifier of this vulnerability is VDB-250432. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250432 - https://vuldb.com/?ctiid.250432 - https://note.zhaoj.in/share/Q56cf5nN9RzF
CVE ID: CVE-2024-0413 State: PUBLISHED Published: 2024-01-11T17:00:06.351Z Last Updated: 2024-10-25T20:36:12.013Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: DeShang Products: DSKMS Problem Types: CWE-284 Description: A vulnerability was found in DeShang DSKMS up to 3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file public/install.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250433 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
ntifier VDB-250433 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250433 - https://vuldb.com/?ctiid.250433 - https://note.zhaoj.in/share/MarH4fY66BgO
CVE ID: CVE-2024-0414 State: PUBLISHED Published: 2024-01-11T17:00:07.564Z Last Updated: 2025-06-03T14:07:41.981Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: DeShang Products: DSCMS Problem Types: CWE-284 Description: A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file public/install.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250434 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
4 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250434 - https://vuldb.com/?ctiid.250434 - https://note.zhaoj.in/share/xYQMsARg83ui
CVE ID: CVE-2024-0415 State: PUBLISHED Published: 2024-01-11T17:31:04.331Z Last Updated: 2024-08-26T18:13:21.816Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: DeShang Products: DSMall Problem Types: CWE-284 Description: A vulnerability classified as critical was found in DeShang DSMall up to 6.1.0. Affected by this vulnerability is an unknown functionality of the file application/home/controller/TaobaoExport.php of the component Image URL Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250435. Additional Analyst
sclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250435. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250435 - https://vuldb.com/?ctiid.250435 - https://note.zhaoj.in/share/63LhFitJmKGR
CVE ID: CVE-2024-0416 State: PUBLISHED Published: 2024-01-11T17:31:05.537Z Last Updated: 2025-05-14T18:30:49.702Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: DeShang Products: DSMall Problem Types: CWE-24 Description: A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the file application/home/controller/MemberAuth.php. The manipulation of the argument file_name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250436. Additional Analyst Notes:
disclosed to the public and may be used. The identifier of this vulnerability is VDB-250436. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250436 - https://vuldb.com/?ctiid.250436 - https://note.zhaoj.in/share/DxR7FZsCKJQ1
CVE ID: CVE-2024-0417 State: PUBLISHED Published: 2024-01-11T18:00:05.362Z Last Updated: 2025-06-03T14:07:35.808Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: DeShang Products: DSShop Problem Types: CWE-24 Description: A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controller/MemberAuth.php. The manipulation of the argument member_info leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250437 was assigned to this vulnerability. Additional Analyst Notes: - CVE
e public and may be used. The identifier VDB-250437 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250437 - https://vuldb.com/?ctiid.250437 - https://note.zhaoj.in/share/ZpRTCLblKd7N
CVE ID: CVE-2024-0418 State: PUBLISHED Published: 2024-01-11T18:00:06.864Z Last Updated: 2025-06-17T13:51:11.982Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: iSharer and upRedSun Products: File Sharing Wizard Problem Types: CWE-404 Description: A vulnerability has been found in iSharer and upRedSun File Sharing Wizard up to 1.5.0 and classified as problematic. This vulnerability affects unknown code of the component GET Request Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250438 is the identifier assigned to this vulnerability. Additional Anal
en disclosed to the public and may be used. VDB-250438 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250438 - https://vuldb.com/?ctiid.250438 - https://www.youtube.com/watch?v=WK7xK9KHiMU - https://cxsecurity.com/issue/WLB-2024010023
CVE ID: CVE-2024-0419 State: PUBLISHED Published: 2024-01-11T18:31:04.097Z Last Updated: 2024-10-25T20:34:35.559Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Jasper Products: httpdx Problem Types: CWE-404 Description: A vulnerability was found in Jasper httpdx up to 1.5.4 and classified as problematic. This issue affects some unknown processing of the component HTTP POST Request Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250439. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
sociated identifier of this vulnerability is VDB-250439. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250439 - https://vuldb.com/?ctiid.250439 - https://www.youtube.com/watch?v=6dAWGH0-6TY - https://cxsecurity.com/issue/WLB-2024010027
CVE ID: CVE-2024-0420 State: PUBLISHED Published: 2024-02-12T16:05:58.767Z Last Updated: 2024-10-27T22:09:18.545Z Vendors: Unknown Products: MapPress Maps for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/b6187ef8-70f4-4911-abd7-42bf6b7e54b7/
CVE ID: CVE-2024-0421 State: PUBLISHED Published: 2024-02-12T16:05:57.729Z Last Updated: 2025-05-07T20:53:05.377Z Vendors: Unknown Products: MapPress Maps for WordPress Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/587acc47-1966-4baf-a380-6aa479a97c82/
CVE ID: CVE-2024-0422 State: PUBLISHED Published: 2024-01-11T19:00:07.178Z Last Updated: 2025-06-03T14:07:30.208Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: POS and Inventory Management System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /new_item of the component New Item Creation Page. The manipulation of the argument new_item leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250441
attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250441 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250441 - https://vuldb.com/?ctiid.250441 - https://drive.google.com/file/d/1_CoeXcCC8fXzKJO-Xvjuq1qYtf8QKHaM/view?usp=sharing
CVE ID: CVE-2024-0423 State: PUBLISHED Published: 2024-01-11T19:31:03.841Z Last Updated: 2025-05-14T18:11:16.140Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Online Food Ordering System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file dishes.php. The manipulation of the argument res_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250442 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CV
the public and may be used. VDB-250442 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250442 - https://vuldb.com/?ctiid.250442 - https://drive.google.com/file/d/1SaHrOPMV6yrBaS5pA7MOX8nsiVGxvlOa/view?usp=sharing
CVE ID: CVE-2024-0424 State: PUBLISHED Published: 2024-01-11T19:31:05.125Z Last Updated: 2025-06-03T14:07:24.711Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Simple Banking System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in CodeAstro Simple Banking System 1.0. This affects an unknown part of the file createuser.php of the component Create a User Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250443. Additional Analyst Notes: - CVE Program
and may be used. The associated identifier of this vulnerability is VDB-250443. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250443 - https://vuldb.com/?ctiid.250443 - https://drive.google.com/file/d/1jr5YRrESDjcNmhpQRK5yHvvxNlYJp2oK/view?usp=sharing
CVE ID: CVE-2024-0425 State: PUBLISHED Published: 2024-01-11T20:00:05.796Z Last Updated: 2025-06-09T18:38:40.050Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ForU Products: CMS Problem Types: CWE-640 Description: A vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250444. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
fier of this vulnerability is VDB-250444. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250444 - https://vuldb.com/?ctiid.250444 - https://github.com/mi2acle/forucmsvuln/blob/master/passwordreset.md
CVE ID: CVE-2024-0426 State: PUBLISHED Published: 2024-01-11T21:00:04.664Z Last Updated: 2025-06-17T21:09:15.635Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ForU Products: CMS Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. This issue affects some unknown processing of the file admin/cms_template.php. The manipulation of the argument t_name/t_path leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250445 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
dentifier VDB-250445 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250445 - https://vuldb.com/?ctiid.250445 - https://github.com/mi2acle/forucmsvuln/blob/master/sqli.md
CVE ID: CVE-2024-0427 State: PUBLISHED Published: 2024-06-12T06:00:02.026Z Last Updated: 2024-08-01T18:04:49.774Z Vendors: Unknown Products: ARForms - Premium WordPress Form Builder Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1806fef3-d774-46e0-aa48-7a101495f4eb/
CVE ID: CVE-2024-0428 State: PUBLISHED Published: 2024-02-05T21:22:01.840Z Last Updated: 2024-08-01T18:04:49.626Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: mihdan Products: Index Now Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Index Now plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.3. This is due to missing or incorrect nonce validation on the 'reset_form' function. This makes it possible for unauthenticated attackers to delete arbitrary site options via a forged request granted they can trick a site administrator into performing an action such as clicking on a lin
ons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7641d52-e930-4143-9180-2903d018da91?source=cve - https://plugins.trac.wordpress.org/changeset/3020958/mihdan-index-now/tags/2.6.4/src/Views/WPOSA.php
CVE ID: CVE-2024-0429 State: PUBLISHED Published: 2024-01-11T16:04:27.918Z Last Updated: 2024-10-25T20:42:40.852Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Hex Workshop Products: Hex Workshop Problem Types: CWE-119 Description: A denial service vulnerability has been found on Hex Workshop affecting version 6.7, an attacker could send a command line file arguments and control the Structured Exception Handler (SEH) records resulting in a service shutdown. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.incibe.es/en/incibe-cert/notices/aviso/buffer-overflow-vulnerability-hex-workshop