Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37387 State: PUBLISHED Published: 2024-06-19T06:40:58.899Z Last Updated: 2024-08-02T03:50:56.267Z Vendors: RICOH COMPANY, LTD. Products: Ricoh Streamline NX PC Client Problem Types: Use of potentially dangerous function Description: Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited, files in the PC where the product is installed may be altered. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000007 - https://jvn.jp/en/jp/JVN00442488/
CVE ID: CVE-2024-37388 State: PUBLISHED Published: 2024-06-07T00:00:00 Last Updated: 2024-10-30T19:08:31.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335
CVE ID: CVE-2024-37389 State: PUBLISHED Published: 2024-07-08T07:29:00.146Z Last Updated: 2024-09-13T17:04:52.641Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: CWE-79 Description: Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is
owser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/yso9fr0wtff53nk046h1o83hdyb1lrxh
CVE ID: CVE-2024-37391 State: PUBLISHED Published: 2024-07-22T00:00:00.000Z Last Updated: 2025-03-13T14:19:45.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"' in Setup/setup.iss. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ProtonVPN/win-app/commit/2e4e25036842aaf48838c6a59f14671b86c20aa7 - https://github.com/ProtonVPN/win-app/compare/3.2.9...3.2.10
CVE ID: CVE-2024-37392 State: PUBLISHED Published: 2024-08-23T00:00:00.000Z Last Updated: 2025-03-20T13:42:50.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SMS message, which gets executed when the SMS is viewed and specially interacted in web-GUI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.smseagle.eu/security-advisory/resolved-xss-in-smseagle-so
lyst Notes: - CISA ADP Vulnrichment: References: - https://www.smseagle.eu/security-advisory/resolved-xss-in-smseagle-software-cve-2024-37392/
CVE ID: CVE-2024-37393 State: PUBLISHED Published: 2024-06-10T00:00:00 Last Updated: 2024-08-02T03:50:56.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
word Solution (LAPS) feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securenvoy.com/support/ - https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393 - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22
CVE ID: CVE-2024-37394 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-11T15:07:28.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious scripts when the dashboard is viewed. Users are recommended to update to version 14.2.1 or later to mitigate this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/reso
this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/multiple-cross-site-scripting-xss-vulnerabilities-in-redcap-cve-2024-37394-cve-2024-37395-and-cve-2024-37396/ - https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-003_XSS_REDCap_1.txt
CVE ID: CVE-2024-37395 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-11T15:08:36.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Survey Title' and 'Survey Instructions' fields. This vulnerability could be exploited by attackers to execute malicious scripts when the survey is accessed through its public link. It is advised to update to version 14.2.1 or later to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
ate to version 14.2.1 or later to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/multiple-cross-site-scripting-xss-vulnerabilities-in-redcap-cve-2024-37394-cve-2024-37395-and-cve-2024-37396/ - https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-003_XSS_REDCap_1.txt
CVE ID: CVE-2024-37396 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-11T15:08:06.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the event is viewed. Updating to version 14.2.1 or later is recommended to remediate this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/multiple-cross-site-scripting-xss-vulnerabilities-in-redcap-cve-2024-37394-cve-2024-37395-and-cve-2024-37396/ - https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-003_XSS_REDCap_1.txt
CVE ID: CVE-2024-37397 State: PUBLISHED Published: 2024-09-12T01:09:56.254Z Last Updated: 2024-09-13T15:48:43.529Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Ivanti Products: EPM Description: An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-37398 State: PUBLISHED Published: 2024-11-13T01:54:45.406Z Last Updated: 2025-03-13T17:50:08.929Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Secure Access Client Description: Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-37399 State: PUBLISHED Published: 2024-08-14T02:38:00.168Z Last Updated: 2024-08-14T13:46:39.793Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Avalanche Description: A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373
CVE ID: CVE-2024-37400 State: PUBLISHED Published: 2024-11-13T01:54:45.506Z Last Updated: 2024-11-13T16:57:19.557Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure Description: An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-37401 State: PUBLISHED Published: 2024-12-11T18:52:27.527Z Last Updated: 2024-12-12T14:39:24.747Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure Description: An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs
CVE ID: CVE-2024-37403 State: PUBLISHED Published: 2024-08-07T03:54:46.861Z Last Updated: 2025-03-25T16:55:12.345Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Docs@Work Description: Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-CVE-2024-37403-Dirty-Stream-
CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-CVE-2024-37403-Dirty-Stream-for-Ivanti-Docs-Work-for-Android
CVE ID: CVE-2024-37404 State: PUBLISHED Published: 2024-10-18T23:06:49.502Z Last Updated: 2024-10-21T17:22:47.072Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Description: Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-and-Policy-Secure-CVE-2024-37404
CVE ID: CVE-2024-37405 State: PUBLISHED Published: 2024-07-12T15:41:03.461Z Last Updated: 2024-08-02T03:50:56.177Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Rocket.Chat Products: Rocket.Chat Description: Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2580062
CVE ID: CVE-2024-37406 State: PUBLISHED Published: 2024-09-18T21:54:09.120Z Last Updated: 2024-09-19T13:45:15.401Z Vendors: Brave Products: Android Browser Description: In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2501378
CVE ID: CVE-2024-37407 State: PUBLISHED Published: 2024-06-08T00:00:00.000Z Last Updated: 2025-03-14T16:00:17.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/libarchive/libarchive/pull/2145 - https://github.com/libarchive/libarchive/commit/b6a979481b7d77c12fa17bbed94576b63bbcb0c0 - https://github.com/libarchive/libarchive/releases/tag/v3.7.4
CVE ID: CVE-2024-37408 State: PUBLISHED Published: 2024-06-08T00:00:00 Last Updated: 2024-09-06T18:33:28.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintd.so" for Sudo. NOTE: the supplier disputes this because they believe issue resolution would involve modifying the PAM configuration to restrict pam_fprintd.so to front-ends that implement a proper attention mechanism, not modifying pam_fprintd.so or fprintd. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-securit
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2024/05/30/3 - https://lists.freedesktop.org/archives/fprint/2024-May/001231.html - https://gitlab.freedesktop.org/libfprint/fprintd/-/releases - https://www.openwall.com/lists/oss-security/2024/06/13/2 - http://www.openwall.com/lists/oss-security/2024/06/13/3 - http://www.openwall.com/lists/oss-security/2024/06/14/1 - http://www.openwall.com/lists/oss-security/2024/06/14/2 - http://www.openwall.com/lists/oss-security/2024/06/14/3
CVE ID: CVE-2024-37409 State: PUBLISHED Published: 2024-07-22T08:40:40.127Z Last Updated: 2024-08-02T03:50:56.265Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Beaver Addons Products: PowerPack Lite for Beaver Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Beaver Addons PowerPack Lite for Beaver Builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/powerpack-addon-for
P Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/powerpack-addon-for-beaver-builder/wordpress-powerpack-lite-for-beaver-builder-plugin-1-3-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37410 State: PUBLISHED Published: 2024-07-09T10:13:44.999Z Last Updated: 2024-08-02T03:50:56.274Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Beaver Addons Products: PowerPack Lite for Beaver Builder Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beaver Addons PowerPack Lite for Beaver Builder allows Path Traversal.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/powerpack-addon-for-beaver-b
hment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/powerpack-addon-for-beaver-builder/wordpress-powerpack-lite-for-beaver-builder-plugin-1-3-0-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-37411 State: PUBLISHED Published: 2024-11-01T14:18:26.141Z Last Updated: 2024-11-01T18:02:16.039Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Team Emilia Projects Products: Progress Planner Problem Types: CWE-862 Description: Missing Authorization vulnerability in Team Emilia Projects Progress Planner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Progress Planner: from n/a through 0.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/progress-planner/wordpress-progress-planner-plugin-0-9-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-37412 State: PUBLISHED Published: 2025-01-02T12:00:47.258Z Last Updated: 2025-01-02T14:52:06.447Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Blossom Themes Products: Blossom Shop Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Blossom Themes Blossom Shop allows Cross Site Request Forgery.This issue affects Blossom Shop: from n/a through 1.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/blossom-shop/vulnerability/wordpress-blossom-shop-theme-1-1-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37413 State: PUBLISHED Published: 2025-01-02T12:00:47.916Z Last Updated: 2025-01-02T14:52:06.320Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Rara Theme Products: Preschool and Kindergarten Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Preschool and Kindergarten allows Cross Site Request Forgery.This issue affects Preschool and Kindergarten: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/preschool-and-kindergarten/vulnerability/wordpress-preschool-and-kindergarten-theme-1-2-1-cross-site-request-for
s/theme/preschool-and-kindergarten/vulnerability/wordpress-preschool-and-kindergarten-theme-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37414 State: PUBLISHED Published: 2024-07-22T08:38:56.346Z Last Updated: 2024-08-02T03:50:56.266Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Averta Products: Depicter Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/depicter/wordpress-depicter-slider-plugin-3-0-2-cross-site-s
References: - https://patchstack.com/database/vulnerability/depicter/wordpress-depicter-slider-plugin-3-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37415 State: PUBLISHED Published: 2024-11-01T14:18:25.515Z Last Updated: 2024-11-01T16:04:52.627Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: E2Pdf.com Products: e2pdf Problem Types: CWE-862 Description: Missing Authorization vulnerability in E2Pdf.Com allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through 1.20.27. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/e2pdf/wordpress-e2pdf-plugin-1-20-27-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-37416 State: PUBLISHED Published: 2024-07-22T08:31:53.130Z Last Updated: 2024-08-02T03:57:39.082Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: J.N. Breetvelt a.k.a. OpaJaap Products: WP Photo Album Plus Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.00.002. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordp
richment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-8-00-002-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37417 State: PUBLISHED Published: 2025-01-02T12:00:48.533Z Last Updated: 2025-01-02T14:52:06.091Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Coachify Products: Coachify Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Coachify Coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/coachify/vulnerability/wordpress-coachify-theme-1-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37418 State: PUBLISHED Published: 2024-07-09T10:15:29.392Z Last Updated: 2024-08-02T03:57:39.408Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Andy Moyle Products: Church Admin Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Andy Moyle Church Admin allows Upload a Web Shell to a Web Server.This issue affects Church Admin: from n/a through 4.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-4-4-6-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-37419 State: PUBLISHED Published: 2024-07-09T10:17:04.133Z Last Updated: 2024-08-02T03:57:39.431Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Codeless Products: Cowidgets – Elementor Addons Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Codeless Cowidgets – Elementor Addons allows Path Traversal.This issue affects Cowidgets – Elementor Addons: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cowidgets-elementor-addons/wordpress-cowidgets-elementor-
r: References: - https://patchstack.com/database/vulnerability/cowidgets-elementor-addons/wordpress-cowidgets-elementor-addons-plugin-1-1-1-local-file-inclusion-vulnerability?_s_id=cve