Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to trigger this condition will result in PAN-OS entering maintenance mode. Palo Alto Networks VM-Series, Cloud NGFW, and Prisma Access are not affected. This issue only affects PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series running these specific versions of PAN-OS: * 10.2.7-h12 * 10.2.8-h10 * 10.2.9-h9 * 10.2.9-h11 * 10.2.10-h2 * 10.2.10-h3 * 10.2.11 * 10.2.11-h1 * 10.2.11-h2 * 10.2.11-h3 * 11.1.2-h9 * 11.1.2-h12 * 11.1.3-h2 * 11.1.3-h4 * 11.1.3-h6 * 11.2.2 * 11.2.2-h1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-9472
CVE ID: CVE-2024-9473 State: PUBLISHED Published: 2024-10-09T17:07:00.981Z Last Updated: 2024-10-18T11:59:17.267Z Vendors: Palo Alto Networks Products: GlobalProtect App Problem Types: CWE-250 Description: A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of the repair functionality offered by the .msi file used to install GlobalProtect. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2024-9473 - https://sec-consult.com/vulnerability-lab/a
ntainer: References: - https://security.paloaltonetworks.com/CVE-2024-9473 - https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-palo-alto-networks-globalprotect/
CVE ID: CVE-2024-9474 State: PUBLISHED Published: 2024-11-18T15:48:23.405Z Last Updated: 2025-10-21T22:55:36.080Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS, Prisma Access Problem Types: CWE-78 Description: A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2024-9474
CVE ID: CVE-2024-9475 State: PUBLISHED Published: 2024-10-26T01:58:36.542Z Last Updated: 2024-10-28T19:14:03.620Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ays-pro Products: Poll Maker – Versus Polls, Anonymous Polls, Image Polls Problem Types: CWE-89 Description: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level permi
reparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8798e16d-84dd-40bb-b4ff-db800e850b0e?source=cve - https://plugins.trac.wordpress.org/browser/poll-maker/tags/5.4.5/includes/lists/class-poll-maker-each-results-poll-list-table.php#L56
CVE ID: CVE-2024-9476 State: PUBLISHED Published: 2024-11-13T16:30:54.581Z Last Updated: 2025-11-23T15:33:38.284Z Vendors: Grafana Labs Products: Grafana OSS and Enterprise Problem Types: CWE-266 Description: A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2024-9476/ - http
yst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2024-9476/ - https://grafana.com/blog/2024/11/12/grafana-security-release-medium-severity-security-fix-for-cve-2024-9476/
CVE ID: CVE-2024-9477 State: PUBLISHED Published: 2024-11-13T14:29:40.588Z Last Updated: 2024-11-13T18:34:37.614Z Vendors: AirTies Products: Air4443 Firmware Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting (XSS).This issue affects Air4443 Firmware: through 14102024. NOTE: The vendor was contacted and it was learned that the product classified as End-of-Life and End-of-Support. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1851
CVE ID: CVE-2024-9478 State: PUBLISHED Published: 2024-11-20T13:31:33.806Z Last Updated: 2025-10-07T13:22:01.196Z Vendors: upKeeper Solutions Products: upKeeper Instant Privilege Access Problem Types: CWE-266 Description: Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/17007638130716-CVE-2024-9478-Improper-Privilege-Management-Process
CVE ID: CVE-2024-9479 State: PUBLISHED Published: 2024-11-20T13:34:36.349Z Last Updated: 2025-10-07T13:22:36.931Z Vendors: upKeeper Solutions Products: upKeeper Instant Privilege Access Problem Types: CWE-266 Description: Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/17007729905436-CVE-2024-9479-Improper-Privilege-Management-Subprocess
CVE ID: CVE-2024-9481 State: PUBLISHED Published: 2024-10-04T12:15:14.709Z Last Updated: 2024-10-07T11:26:43.561Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AVG/Avast Products: Antivirus Problem Types: CWE-787 Description: An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed eml file to crash the application during file processing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2024-9482 State: PUBLISHED Published: 2024-10-04T12:22:47.087Z Last Updated: 2024-10-07T11:27:03.261Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AVG/Avast Products: Antivirus Problem Types: CWE-787 Description: An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed Mach-O file to crash the application during file processing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2024-9483 State: PUBLISHED Published: 2024-10-04T12:29:16.430Z Last Updated: 2024-10-07T11:27:19.528Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AVG/Avast Products: Antivirus Problem Types: CWE-476 Description: A null-pointer-dereference in the signature verification module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS may allow a malformed xar file to crash the application during processing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2024-9484 State: PUBLISHED Published: 2024-10-04T12:44:25.057Z Last Updated: 2024-10-07T11:27:37.651Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AVG/Avast Products: Antivirus Problem Types: CWE-476 Description: An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed xar file to crash the application during file processing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2024-9486 State: PUBLISHED Published: 2024-10-15T20:33:43.138Z Last Updated: 2024-10-16T18:56:40.632Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kubernetes Products: Image Builder Problem Types: CWE-798 Description: A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if the
these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubernetes/kubernetes/issues/128006 - https://github.com/kubernetes-sigs/image-builder/pull/1595 - https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ
CVE ID: CVE-2024-9487 State: PUBLISHED Published: 2024-10-10T21:08:48.720Z Last Updated: 2024-10-11T15:34:07.811Z Vendors: GitHub Products: Enterprise Server Problem Types: CWE-347 Description: An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was
esponse or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.16 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.10 - https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.5 - https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.2
CVE ID: CVE-2024-9488 State: PUBLISHED Published: 2024-10-25T05:35:29.077Z Last Updated: 2025-02-19T17:43:22.948Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: advancedcoding Products: Comments – wpDiscuz Problem Types: CWE-288 Description: The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-ex
ng user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b71706a7-e101-4d50-a2da-1aeeaf07cf4b?source=cve - https://plugins.trac.wordpress.org/browser/wpdiscuz/trunk/forms/wpdFormAttr/Login/SocialLogin.php - https://plugins.trac.wordpress.org/changeset/3164486/
CVE ID: CVE-2024-9489 State: PUBLISHED Published: 2024-10-29T21:44:39.027Z Last Updated: 2025-08-26T18:38:42.629Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, DWG TrueView, RealDWG Problem Types: CWE-119 Description: A maliciously crafted DWG file when parsed in ACAD.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current pro
e this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE ID: CVE-2024-9490 State: PUBLISHED Published: 2025-01-24T14:26:05.128Z Last Updated: 2025-02-12T20:01:20.648Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: Silicon Labs IDE (8-bit) Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9491 State: PUBLISHED Published: 2025-01-24T14:26:55.677Z Last Updated: 2025-02-12T20:01:20.529Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: Configuration Wizard 2 Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9492 State: PUBLISHED Published: 2025-01-24T14:27:44.846Z Last Updated: 2025-01-27T18:08:04.918Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: Flash Programming Utility Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9493 State: PUBLISHED Published: 2025-01-24T14:28:33.430Z Last Updated: 2025-01-27T18:09:32.354Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: ToolStick Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9494 State: PUBLISHED Published: 2025-01-24T14:37:15.436Z Last Updated: 2025-01-27T18:10:40.147Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: CP210 VCP Win 2k Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210 VCP Win 2k installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9495 State: PUBLISHED Published: 2025-01-24T14:37:44.424Z Last Updated: 2025-01-27T18:11:41.774Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: CP210x VCP Windows Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9496 State: PUBLISHED Published: 2025-01-24T14:38:14.189Z Last Updated: 2025-02-18T19:31:22.242Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: USBXpress Dev Kit Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9497 State: PUBLISHED Published: 2025-01-24T14:38:57.451Z Last Updated: 2025-08-27T21:36:25.932Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: USBXpress 4 SDK Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9498 State: PUBLISHED Published: 2025-01-24T14:39:25.290Z Last Updated: 2025-02-18T19:30:21.609Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: USBXpress SDK Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9499 State: PUBLISHED Published: 2025-01-24T14:39:51.065Z Last Updated: 2025-02-18T20:15:25.682Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: silabs.com Products: USBXpress Win 98SE Dev Kit Problem Types: CWE-427 Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000JUQwd
CVE ID: CVE-2024-9500 State: PUBLISHED Published: 2024-11-15T21:24:22.732Z Last Updated: 2025-10-06T16:45:09.078Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Installer Problem Types: CWE-379 Description: A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0023
CVE ID: CVE-2024-9501 State: PUBLISHED Published: 2024-10-26T12:32:47.703Z Last Updated: 2025-02-19T17:42:58.130Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: xpeedstudio Products: Wp Social Login and Register Social Counter Problem Types: CWE-288 Description: The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the em
henticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4294f5f-d989-4b97-88ee-4e94f4f7845a?source=cve - https://plugins.trac.wordpress.org/browser/wp-social/tags/3.0.6/inc/admin-create-user.php#L205 - https://plugins.trac.wordpress.org/changeset/3173675/
CVE ID: CVE-2024-9502 State: PUBLISHED Published: 2025-01-07T06:40:57.174Z Last Updated: 2025-01-07T17:15:18.247Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: litonice13 Products: Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Problem Types: CWE-79 Description: The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Tooltip module in all versions up to, and including, 2.0.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. Th
up to, and including, 2.0.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/485c9ee6-9cb5-45ca-86af-ee5d10ee6734?source=cve - https://wordpress.org/plugins/master-addons/#developers - https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-tooltip/ma-tooltip.php#L250 - https://master-addons.com/changelogs/ - https://plugi
rowser/master-addons/trunk/addons/ma-tooltip/ma-tooltip.php#L250 - https://master-addons.com/changelogs/ - https://plugins.trac.wordpress.org/changeset/3211489/
CVE ID: CVE-2024-9503 State: PUBLISHED Published: 2024-12-20T06:59:04.625Z Last Updated: 2024-12-20T19:52:19.382Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: yasinedr Products: Maintenance & Coming Soon Redirect Animation Problem Types: CWE-284 Description: The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wploti_add_whitelisted_roles_option', 'wploti_remove_whitelisted_roles_option', 'wploti_add_whitelisted_users_option', 'wploti_remove_whitelisted_users_option', and 'wploti_uploaded_animation_save_option' functions in all versions up to, and
ploti_remove_whitelisted_users_option', and 'wploti_uploaded_animation_save_option' functions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify certain plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1e716cf9-198c-4a32-883d-3f90dd399aee?source=cve - https://plugins.trac.wordpress.org/browser/maintenance-coming-soon-redirect-animation/trunk/wploti_maintenance_redirect.php