Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b616bb6c-0861-4920-a589-f2c5bb819164?source=cve - https://plugins.trac.wordpress.org/browser/easy-social-share-buttons/trunk/includes/class-easy-social-share-buttons-settings.php#L271
CVE ID: CVE-2024-8730 State: PUBLISHED Published: 2024-09-13T15:10:43.428Z Last Updated: 2024-09-13T15:31:45.328Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: cvscvstechcom Products: Exit Notifier Problem Types: CWE-79 Description: The Exit Notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: -
if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc1aedb-e64f-4b61-a247-c3cdc731f001?source=cve - https://plugins.trac.wordpress.org/browser/exit-notifier/trunk/includes/class-exit-notifier-settings.php#L707
CVE ID: CVE-2024-8731 State: PUBLISHED Published: 2024-09-13T15:10:39.437Z Last Updated: 2024-09-13T15:33:20.072Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: arielhr1987 Products: Cron Jobs Problem Types: CWE-79 Description: The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP V
n successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f6da693-4610-4875-aa14-102809309b8d?source=cve - https://plugins.trac.wordpress.org/browser/leira-cron-jobs/trunk/admin/class-leira-cron-jobs-admin.php#L147
CVE ID: CVE-2024-8732 State: PUBLISHED Published: 2024-09-13T15:10:37.796Z Last Updated: 2024-09-13T15:34:08.738Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: arielhr1987 Products: Roles & Capabilities Problem Types: CWE-79 Description: The Roles & Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analy
hat execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3956cd40-6b46-4013-9d71-a979de2c3687?source=cve - https://plugins.trac.wordpress.org/browser/leira-roles/trunk/admin/class-leira-roles-admin.php#L413 - https://plugins.trac.wordpress.org/browser/leira-roles/trunk/admin/class-leira-roles-admin.php#L541
CVE ID: CVE-2024-8733 State: PUBLISHED Published: 2024-10-02T19:12:41.452Z Last Updated: 2024-10-02T19:56:16.845Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: HP, Inc. Products: HP One Agent Software Problem Types: CWE-426 Description: A potential security vulnerability has been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege. HP is releasing software updates to mitigate this potential vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11270215-11270239-16
CVE ID: CVE-2024-8734 State: PUBLISHED Published: 2024-09-13T15:10:42.409Z Last Updated: 2024-09-13T15:32:23.701Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: lucasstad Products: Lucas String Replace Problem Types: CWE-79 Description: The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst
t execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf1e4b20-e7e5-4a3a-9895-02d51499d54e?source=cve - https://plugins.trac.wordpress.org/browser/lucas-string-replace/trunk/includes/class-lucas-string-replace-settings.php#L176
CVE ID: CVE-2024-8735 State: PUBLISHED Published: 2024-11-22T05:33:42.547Z Last Updated: 2024-11-22T11:34:08.543Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mailmunch Products: MailMunch – Grow your Email List Problem Types: CWE-79 Description: The MailMunch – Grow your Email List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a
web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e45860-16c4-4d13-aad9-c742a8eced37?source=cve - https://plugins.trac.wordpress.org/browser/mailmunch/tags/3.1.8/admin/partials/mailmunch-admin-display.php#L16 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193789%40mailmunch&new=3193789%40mailmunch&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8736 State: PUBLISHED Published: 2025-03-20T10:11:17.500Z Last Updated: 2025-04-04T08:45:37.979Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-352 Description: A Denial of Service (DoS) vulnerability exists in multiple file upload endpoints of parisneo/lollms-webui version V12 (Strawberry). The vulnerability can be exploited remotely via Cross-Site Request Forgery (CSRF). Despite CSRF protection preventing file uploads, the application still processes multipart boundaries, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can c
ndaries, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can cause the server to parse each byte of the boundary, ultimately leading to service unavailability. This vulnerability is present in the `/upload_avatar`, `/upload_app`, and `/upload_logo` endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/935dbc03-1b43-4dbb-b6cd-1aa95a789d4f
CVE ID: CVE-2024-8737 State: PUBLISHED Published: 2024-09-13T15:10:41.421Z Last Updated: 2024-09-13T15:33:01.878Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: kubiq Products: PDF Thumbnail Generator Problem Types: CWE-79 Description: The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst
t execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b183587b-95bd-4e82-bfc7-db5a8fbd58f9?source=cve - https://plugins.trac.wordpress.org/browser/pdf-thumbnail-generator/tags/1.3/pdf-thumbnail-generator.php#L184 - https://plugins.trac.wordpress.org/changeset/3151055/
CVE ID: CVE-2024-8738 State: PUBLISHED Published: 2024-09-24T01:56:48.112Z Last Updated: 2024-09-24T13:49:21.268Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: podcastmotor Products: Seriously Simple Stats Problem Types: CWE-79 Description: The Seriously Simple Stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional
ges that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7f810f6-b8dd-4065-8113-9842b33202ef?source=cve - https://plugins.trac.wordpress.org/browser/seriously-simple-stats/trunk/php/classes/class-ssp-stats.php#L1296 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153423%40seriously-simple-stats&new=3153423%40seriously-simple-stats&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8739 State: PUBLISHED Published: 2024-11-02T02:03:08.194Z Last Updated: 2024-11-02T16:43:56.937Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wedevs Products: ReCaptcha Integration for WordPress Problem Types: CWE-79 Description: The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on
ry web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77476bad-e9a4-4266-b07e-b402b33cc27a?source=cve - https://plugins.trac.wordpress.org/browser/wp-recaptcha-integration/tags/1.3.0/inc/class-wp_recaptcha_options.php#L405 - https://plugins.trac.wordpress.org/browser/wp-recaptcha-integration/tags/1.2.5/inc/class-wp_recaptcha_options.php#L362 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3176796%40wp-recaptcha-integration&new=3176796%40wp-recaptcha-integration&s
hangeset?sfp_email=&sfph_mail=&reponame=&old=3176796%40wp-recaptcha-integration&new=3176796%40wp-recaptcha-integration&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8740 State: PUBLISHED Published: 2024-10-18T04:32:53.202Z Last Updated: 2024-10-18T13:58:36.372Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: fatcatapps Products: GetResponse Forms by Optin Cat Problem Types: CWE-79 Description: The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a lin
scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51d14f45-4c30-4225-998d-f4f829e09bc0?source=cve - https://plugins.trac.wordpress.org/browser/getresponse/tags/2.4.1/includes/eoi-subscribers.php#L353
CVE ID: CVE-2024-8741 State: PUBLISHED Published: 2024-09-25T02:05:06.128Z Last Updated: 2024-09-25T13:41:08.157Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: outtheboxthemes Products: Beam me up Scotty – Back to Top Button Problem Types: CWE-79 Description: The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action suc
o inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3428bc71-64f9-4f8d-85c8-7dda81b2ac18?source=cve - https://plugins.trac.wordpress.org/browser/beam-me-up-scotty/tags/1.0.21/library/template-parts/tabs.php#L27 - https://plugins.trac.wordpress.org/changeset/3156146/beam-me-up-scotty/trunk/library/template-parts/tabs.php
CVE ID: CVE-2024-8742 State: PUBLISHED Published: 2024-09-13T06:47:28.798Z Last Updated: 2024-09-13T13:43:03.394Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Description: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes
sions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/76c292dc-e9da-4256-82df-58ac5def4771?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.0.3/includes/Elements/Filterable_Gallery.php#L566 - https://plugins.trac.wordpress.org/changeset/3148624/ - https://wordpres
includes/Elements/Filterable_Gallery.php#L566 - https://plugins.trac.wordpress.org/changeset/3148624/ - https://wordpress.org/plugins/essential-addons-for-elementor-lite/#developers
CVE ID: CVE-2024-8743 State: PUBLISHED Published: 2024-10-05T06:44:10.696Z Last Updated: 2024-10-07T15:57:49.035Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: bitpressadmin Products: Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress Problem Types: CWE-434 Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above,
ecks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/314520d5-bd9d-46c1-b903-5e5cb3bb3417?source=cve - https://plugins.trac.wordpress.org/changeset/3161219/
CVE ID: CVE-2024-8746 State: PUBLISHED Published: 2024-10-16T06:43:35.462Z Last Updated: 2024-10-16T18:03:56.333Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: File Manager Products: File Manager Pro Problem Types: CWE-434 Description: The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server wh
to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88f1eb9a-f3bb-4b62-975f-a6cb95850966?source=cve - https://filemanagerpro.io/
CVE ID: CVE-2024-8747 State: PUBLISHED Published: 2024-09-13T15:10:39.939Z Last Updated: 2024-09-13T18:44:27.466Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: khromov Products: Email Obfuscate Shortcode Problem Types: CWE-79 Description: The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wh
icated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77bed6ce-84e7-4b71-8acd-bb5b73e362d2?source=cve - https://wordpress.org/plugins/email-obfuscate-shortcode/
CVE ID: CVE-2024-8748 State: PUBLISHED Published: 2024-12-03T01:15:46.610Z Last Updated: 2024-12-03T16:31:58.508Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: VMG8825-T50K firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmware versions through V5.50(ABOM.8.4)C0 could allow an attacker to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP POST request to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/e
to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-and-post-authentication-command-injection-vulnerabilities-in-some-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wifi-extenders-12-03-2024
CVE ID: CVE-2024-8749 State: PUBLISHED Published: 2024-09-12T11:36:55.184Z Last Updated: 2024-09-12T12:57:48.913Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Synetics Products: Idoit pro Problem Types: CWE-89 Description: SQL injection vulnerability in idoit pro version 28. This vulnerability could allow an attacker to send a specially crafted query to the ID parameter in /var/www/html/src/classes/modules/api/model/cmdb/isys_api_model_cmdb_objects_by_relation.class.php and retrieve all the information stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerab
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-synetics-idoit-pro
CVE ID: CVE-2024-8750 State: PUBLISHED Published: 2024-09-12T11:38:24.912Z Last Updated: 2024-09-12T12:54:52.748Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Synetics Products: Idoit pro Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in idoit pro version 28. This vulnerability allows an attacker to retrieve session details of an authenticated user due to lack of proper sanitization of the following parameters (id,lang,mNavID,name,pID,treeNode,type,view). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-synetics-idoit-pro
CVE ID: CVE-2024-8751 State: PUBLISHED Published: 2024-09-12T21:38:37.516Z Last Updated: 2024-09-13T14:02:19.375Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SICK AG Products: SICK MSC800 Problem Types: CWE-306 Description: A vulnerability in the MSC800 allows an unauthenticated attacker to modify the product’s IP address over Sopas ET. This can lead to Denial of Service. Users are recommended to upgrade both MSC800 and MSC800 LFT to version V4.26 and S2.93.20 respectively which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURI
ichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2024/
CVE ID: CVE-2024-8752 State: PUBLISHED Published: 2024-09-16T15:42:20.153Z Last Updated: 2024-09-16T16:07:21.866Z Vendors: Smart HMI Products: WebIQ Problem Types: CWE-22 Description: The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2024-38
CVE ID: CVE-2024-8753 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:35.898Z Description: No description available.
CVE ID: CVE-2024-8754 State: PUBLISHED Published: 2024-09-12T17:02:00.988Z Last Updated: 2024-09-17T19:36:51.833Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-642 Description: An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/464062