Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and enable or disable monetization and change map provider. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa26e958-4850-451b-88eb-d48fc0c7feb7?source=cve - https://plugins.trac.wordpress.org/browser/directorist/tags/7.8.4/includes/classes/class-setup-wizard.php#L300 - https://plugins.trac.wordpress.org/changeset?old_path=%2Fdirectorist%2Ftags%2F7.8.4&old=3034765&new_path=%2Fdirectorist%2Ftags%2F7.8.5&new=3034765&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1323 State: PUBLISHED Published: 2024-02-27T04:32:17.160Z Last Updated: 2025-04-22T16:13:54.572Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Orbit Fox by ThemeIsle Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Type Grid Widget Title in all versions up to, and including, 2.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-l
n and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0241a9fc-ce42-4a97-9f33-f07cf53c0f52?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038451%40themeisle-companion&new=3038451%40themeisle-companion&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=304
e-companion&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040304%40themeisle-companion&new=3040304%40themeisle-companion&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3040304/themeisle-companion/tags/2.10.32/vendor/codeinwp/elementor-extra-widgets/class-elementor-extra-widgets.php
CVE ID: CVE-2024-1324 State: PUBLISHED Published: 2024-06-01T06:51:52.577Z Last Updated: 2024-08-15T15:01:49.502Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: qqworld Products: QQWorld Auto Save Images Problem Types: CWE-862 Missing Authorization Description: The QQWorld Auto Save Images plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the save_remote_images_get_auto_saved_results() function hooked via a norpriv AJAX in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to retrieve the contents of arbitrary posts that may not be public. Additional Analyst Not
for unauthenticated attackers to retrieve the contents of arbitrary posts that may not be public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed82f527-b7af-4466-a977-855f109ed997?source=cve - https://plugins.trac.wordpress.org/browser/qqworld-auto-save-images/trunk/qqworld-auto-save-images.php#L417
CVE ID: CVE-2024-1325 State: PUBLISHED Published: 2024-03-20T06:48:28.425Z Last Updated: 2024-08-01T19:07:57.283Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: delabon Products: Live Sales Notification for Woocommerce – Woomotiv Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.3. This is due to missing or incorrect nonce validation on the 'ajax_cancel_review' function. This makes it possible for unauthenticated attackers to reset the site's review count via a forged request gr
function. This makes it possible for unauthenticated attackers to reset the site's review count via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1c1b43-def2-4f9f-b5c7-075ca188f6e7?source=cve - https://plugins.trac.wordpress.org/browser/woomotiv/tags/3.4.1/lib/class-backend.php#L495 - https://wordpress.org/plugins/woomotiv/
CVE ID: CVE-2024-1326 State: PUBLISHED Published: 2024-03-12T23:33:52.349Z Last Updated: 2024-08-02T20:16:06.990Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jegtheme Products: Jeg Elementor Kit Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in
it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d108cb36-c072-483e-9746-15b8e7a880c3?source=cve - https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/trunk/class/elements/views/class-post-block-view.php#L375 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038362%40jeg-elementor-kit&new=3038362%40jeg-elementor-kit&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1327 State: PUBLISHED Published: 2024-04-03T02:32:45.991Z Last Updated: 2024-08-01T18:33:25.578Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jegtheme Products: Jeg Elementor Kit Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image box widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web s
his makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/34a42180-9d08-4049-8da8-27ee1f64600a?source=cve - https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.2/class/elements/views/class-view-abstract.php#L123
CVE ID: CVE-2024-1328 State: PUBLISHED Published: 2024-03-12T08:34:16.896Z Last Updated: 2024-08-01T18:33:25.445Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: newsletter2go Products: Newsletter2Go Problem Types: CWE-862 Missing Authorization Description: The Newsletter2Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 4.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addit
s and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/766ac399-7280-4186-8972-94da813da85e?source=cve - https://plugins.trac.wordpress.org/browser/newsletter2go/tags/4.0.13/gui/N2Go_Gui.php#L296
CVE ID: CVE-2024-1329 State: PUBLISHED Published: 2024-02-08T19:20:10.831Z Last Updated: 2024-09-26T17:05:43.601Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-59 Description: HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitra
chment: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitrary-write-through-symlink-attack
CVE ID: CVE-2024-1330 State: PUBLISHED Published: 2024-06-27T06:00:02.163Z Last Updated: 2025-09-15T20:03:27.677Z Vendors: Unknown Products: kadence-blocks-pro Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1988815b-7a53-4657-9b1c-1f83c9f9ccfd/
CVE ID: CVE-2024-1331 State: PUBLISHED Published: 2024-03-18T15:15:25.820Z Last Updated: 2024-08-28T15:25:07.477Z Vendors: Unknown Products: Team Members Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b2bac900-3d8f-406c-b03d-c8db156acc59/
CVE ID: CVE-2024-1332 State: PUBLISHED Published: 2024-05-24T06:42:17.541Z Last Updated: 2024-08-01T18:33:25.379Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Custom Fonts – Host Your Fonts Locally Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author level or higher, to inject arbitrary web scripts in pages
is makes it possible for authenticated attackers, with author level or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98536242-64c7-4e02-aa00-a3efbf5c90d8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3074871%40custom-fonts%2Ftrunk&old=3062686%40custom-fonts%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2024-1333 State: PUBLISHED Published: 2024-03-18T15:15:26.018Z Last Updated: 2024-08-27T20:59:34.456Z Vendors: Unknown Products: Responsive Pricing Table Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/30546402-03b8-4e18-ad7e-04a6b556ffd7/
CVE ID: CVE-2024-1334 State: PUBLISHED Published: 2024-02-20T18:56:18.425Z Last Updated: 2024-08-01T18:33:25.488Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the enableOptimization function. This makes it possible for unauthenticated attackers to enable image optimization via a forged request granted they can trick a site
possible for unauthenticated attackers to enable image optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0318ec4a-185a-405d-90f8-008ba373114b?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-1335 State: PUBLISHED Published: 2024-02-20T18:56:42.366Z Last Updated: 2024-08-01T18:33:25.580Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the disableOptimization function. This makes it possible for unauthenticated attackers to disable the image optimization setting via a forged request granted they can
t possible for unauthenticated attackers to disable the image optimization setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3900e4f-4ae4-4026-89df-b63bd869a763?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-1336 State: PUBLISHED Published: 2024-02-20T18:56:45.163Z Last Updated: 2024-08-01T18:33:25.490Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the optimizeAllOn function. This makes it possible for unauthenticated attackers to modify image optimization settings via a forged request granted they can trick a s
ible for unauthenticated attackers to modify image optimization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca4cf299-9dee-4ebf-83f3-4c3471bd9fb0?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-1337 State: PUBLISHED Published: 2024-02-20T18:56:25.369Z Last Updated: 2024-08-01T18:33:25.612Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: sonalsinha21 Products: SKT Page Builder Problem Types: CWE-862 Missing Authorization Description: The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveSktbuilderPageData' function in all versions up to, and including, 4.1. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary content into pages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Cont
and above, to inject arbitrary content into pages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3164b96f-d876-4cbc-bddf-51e9d9becee6?source=cve - https://plugins.trac.wordpress.org/changeset/3034383/
CVE ID: CVE-2024-1338 State: PUBLISHED Published: 2024-02-20T18:56:31.925Z Last Updated: 2024-08-01T18:33:25.380Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the stopOptimizeAll function. This makes it possible for unauthenticated attackers to modify image optimization settings via a forged request granted they can trick a
ssible for unauthenticated attackers to modify image optimization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3dd131-dbd8-431c-96f4-4ab2c3be4dbd?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-1339 State: PUBLISHED Published: 2024-02-20T18:56:24.094Z Last Updated: 2024-08-01T18:33:25.380Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the reinitialize function. This makes it possible for unauthenticated attackers to remove all plugin data via a forged request granted they can trick a site administr
ble for unauthenticated attackers to remove all plugin data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d08e462-8297-477e-89da-47f26bd6beae?source=cve - https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression
CVE ID: CVE-2024-1340 State: PUBLISHED Published: 2024-02-20T18:56:25.837Z Last Updated: 2024-08-01T18:33:25.429Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: webfactory Products: Login Lockdown – Protect Login Form Problem Types: CWE-862 Missing Authorization Description: The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as
rs, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/34021007-b5d3-479b-a0d4-50e301f22c9c?source=cve - https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php#L492 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3033542%40login-lockdown%2Ftrunk&old=3027788%40login-lockdown%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1341 State: PUBLISHED Published: 2024-02-29T04:31:18.797Z Last Updated: 2024-08-01T18:33:25.397Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mdempfle Products: Advanced iFrame Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all versions up to, and including, 2024.1 due to the plugin allowing users to include JS files from external sources through the additional_js attribute. This makes it possible for authenticated attackers with contrib
om external sources through the additional_js attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/699e5c80-8a11-4f67-8b17-41170d9c6411?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042304%40advanced-iframe&new=3042304%40advanced-iframe&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1342 State: REJECTED Published: 2024-02-16T15:20:53.354Z Last Updated: 2024-10-14T22:00:07.768Z Description: No description available.
CVE ID: CVE-2024-1343 State: PUBLISHED Published: 2024-02-19T11:17:33.220Z Last Updated: 2024-08-13T13:21:55.583Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: LaborOfficeFree Products: LaborOfficeFree Problem Types: CWE-284 Description: A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfiles(x86)% LaborOfficeFree BackUp'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree
CVE ID: CVE-2024-1344 State: PUBLISHED Published: 2024-02-19T11:19:39.311Z Last Updated: 2024-08-19T14:21:03.997Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: LaborOfficeFree Products: LaborOfficeFree Problem Types: CWE-798 Description: Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the '%programfiles(x86)%\LaborOfficeFree\' directory. This user can log in remotely and has root-like privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
in remotely and has root-like privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree