Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2404 State: PUBLISHED Published: 2024-04-24T05:00:02.735Z Last Updated: 2024-08-09T18:46:43.786Z Vendors: Unknown Products: Better Comments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a2cb7167-9edc-4640-87eb-4c511639e5b7/
CVE ID: CVE-2024-2405 State: PUBLISHED Published: 2024-05-02T06:00:02.127Z Last Updated: 2024-08-01T19:11:53.477Z Vendors: Unknown Products: Float menu Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/c42ffa15-6ebe-4c70-9e51-b95bd05ea04d/
CVE ID: CVE-2024-2406 State: PUBLISHED Published: 2024-03-12T20:31:06.188Z Last Updated: 2024-08-01T19:11:53.483Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: Gacjie Products: Server Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Upload.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256503. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
The associated identifier of this vulnerability is VDB-256503. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.256503 - https://vuldb.com/?ctiid.256503 - https://note.zhaoj.in/share/7kZiVRqSuiMx
CVE ID: CVE-2024-2408 State: PUBLISHED Published: 2024-06-09T19:55:51.625Z Last Updated: 2025-03-21T18:03:45.831Z Vendors: PHP Group Products: PHP Description: The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and
Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-hh26-4ppw-5864 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap
message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
CVE ID: CVE-2024-2409 State: PUBLISHED Published: 2024-03-29T08:31:29.816Z Last Updated: 2024-08-08T18:34:51.364Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: stylemix Products: MasterStudy LMS WordPress Plugin – for Online Courses and Education Problem Types: CWE-266 Incorrect Privilege Assignment Description: The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with adm
x_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve - https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2 - https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system
CVE ID: CVE-2024-2410 State: PUBLISHED Published: 2024-05-03T12:58:39.449Z Last Updated: 2024-08-01T19:11:53.511Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: protocolbuffers Products: protobuf Problem Types: CWE-416 Description: The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already been freed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/protocolbuffers/protobuf/releases/tag/v25.0
CVE ID: CVE-2024-2411 State: PUBLISHED Published: 2024-03-29T08:31:30.436Z Last Updated: 2024-08-11T14:03:48.838Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: stylemix Products: MasterStudy LMS WordPress Plugin – for Online Courses and Education Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execut
akes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d68a2b60-ee89-4231-b256-214eba418244?source=cve - https://plugins.trac.wordpress.org/changeset/3055398/masterstudy-lms-learning-management-system#file10 - https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-versi
masterstudy-lms-learning-management-system#file10 - https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.1
CVE ID: CVE-2024-2412 State: PUBLISHED Published: 2024-03-13T02:31:52.906Z Last Updated: 2024-10-14T06:12:23.993Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Heimavista Products: Rpage, Epage Problem Types: CWE-1220 Description: The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user registration on sites where user registration is supposed to be disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7696-0951f-1.html
CVE ID: CVE-2024-2413 State: PUBLISHED Published: 2024-03-13T02:51:10.886Z Last Updated: 2025-04-15T15:24:41.891Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Intumit Products: SmartRobot Problem Types: CWE-321 Description: Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timestamp to generate an authentication code. With this authentication code, they can obtain administrator privileges and subsequently execute arbitrary code on the remote server using built-in system functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
remote server using built-in system functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7697-ecf10-1.html
CVE ID: CVE-2024-2414 State: PUBLISHED Published: 2024-03-13T11:15:01.835Z Last Updated: 2024-08-01T20:26:29.205Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Movistar Products: Router Movistar 4G Problem Types: CWE-419 Description: The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open on port 5555 and provides access to a shell with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-movistar-4g-router
CVE ID: CVE-2024-2415 State: PUBLISHED Published: 2024-03-13T11:18:38.232Z Last Updated: 2024-08-05T15:13:31.574Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Movistar Products: Router Movistar 4G Problem Types: CWE-78 Description: Command injection vulnerability in Movistar 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an authenticated user to execute commands inside the router by making a POST request to the URL '/cgi-bin/gui.cgi'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-movistar-4g-router
CVE ID: CVE-2024-2416 State: PUBLISHED Published: 2024-03-13T11:17:42.518Z Last Updated: 2024-08-05T16:22:07.692Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Movistar Products: Router Movistar 4G Problem Types: CWE-352 Description: Cross-Site Request Forgery vulnerability in Movistar's 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application in which they are currently authenticated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-movis
- CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-movistar-4g-router
CVE ID: CVE-2024-2417 State: PUBLISHED Published: 2024-05-02T16:52:41.534Z Last Updated: 2024-08-12T20:25:56.027Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpeverest Products: User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin Problem Types: CWE-862 Missing Authorization Description: The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the form_save_action() function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber
unction in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the registration form and make the default registration role administrator. This subsequently allows the attacker to register an account as an administrator on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d03459d8-b1f2-4270-a294-403754db1f2f?source=cve - https://github.com/wpeverest/user-registration/commit/d265273aa4dddb24ade929be78c6bf1766f1cf00 - https://plugins.trac.wordpress.org/changeset/3070439/user-registration/trunk/inc
5273aa4dddb24ade929be78c6bf1766f1cf00 - https://plugins.trac.wordpress.org/changeset/3070439/user-registration/trunk/includes/class-ur-ajax.php
CVE ID: CVE-2024-2418 State: PUBLISHED Published: 2024-03-13T18:00:07.179Z Last Updated: 2024-08-01T19:11:53.578Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best POS Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view_order.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256705 was assigned to this vulnerability. Additional Analyst
sclosed to the public and may be used. The identifier VDB-256705 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.256705 - https://vuldb.com/?ctiid.256705 - https://github.com/ycxdzj/CVE_Hunter/blob/main/SQLi-6.md
CVE ID: CVE-2024-2419 State: PUBLISHED Published: 2024-04-17T13:23:34.652Z Last Updated: 2025-11-11T15:15:55.748Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat build of Keycloak 22 Problem Types: CWE-601 Description: A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1867 - https://access.redhat.com/security/cve/CVE-2024-2419 - https://bugzilla.redhat.com/show_bug.cgi?id=2269371
CVE ID: CVE-2024-2420 State: PUBLISHED Published: 2024-05-30T17:22:06.344Z Last Updated: 2024-08-01T19:11:53.496Z Vendors: LenelS2 Products: NetBox Problem Types: CWE-259 Description: LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
CVE ID: CVE-2024-2421 State: PUBLISHED Published: 2024-05-30T17:24:33.231Z Last Updated: 2024-08-01T19:11:53.525Z Vendors: LenelS2 Products: NetBox Problem Types: CWE-78 Description: LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
CVE ID: CVE-2024-2422 State: PUBLISHED Published: 2024-05-30T17:26:12.543Z Last Updated: 2024-08-01T19:11:53.469Z Vendors: LenelS2 Products: NetBox Problem Types: CWE-88 Description: LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
CVE ID: CVE-2024-2423 State: PUBLISHED Published: 2024-04-09T18:58:41.957Z Last Updated: 2025-08-27T21:02:57.188Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: stiofansisland Products: UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insuf
le to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef53c2c-01fb-41b6-b329-d952ce3424e8?source=cve - https://plugins.trac.wordpress.org/browser/userswp/trunk/widgets/user-title.php - https://plugins.trac.wordp
ource=cve - https://plugins.trac.wordpress.org/browser/userswp/trunk/widgets/user-title.php - https://plugins.trac.wordpress.org/changeset?old_path=/userswp/tags/1.2.6&old=3051240&new_path=/userswp/tags/1.2.7&new=3051240&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2424 State: PUBLISHED Published: 2024-04-15T21:26:20.115Z Last Updated: 2024-08-01T19:11:53.521Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Rockwell Automation Products: 5015-AENFTXT Problem Types: CWE-20 Description: An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to result in a major nonrecoverable fault (MNRF) when malicious input is entered. If exploited, the availability of the device will be impacted, and a manual restart is required. Additionally, a malformed PTP packet is needed to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
a malformed PTP packet is needed to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD1667.html
CVE ID: CVE-2024-2425 State: PUBLISHED Published: 2024-03-25T20:14:01.767Z Last Updated: 2024-08-01T19:11:53.614Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Rockwell Automation Products: PowerFlex® 527 Problem Types: CWE-20 Description: A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, the web server will crash and need a manual restart to recover it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://https://www.rockwellautomation.com/en-us/support/advisory.SD1664.html
CVE ID: CVE-2024-2426 State: PUBLISHED Published: 2024-03-25T20:17:22.315Z Last Updated: 2024-08-12T20:34:49.585Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Rockwell Automation Products: PowerFlex® 527 Problem Types: CWE-20 Description: A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption in the CIP communication will occur and a manual restart will be required by the user to recover it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD1664.html
CVE ID: CVE-2024-2427 State: PUBLISHED Published: 2024-03-25T20:20:41.295Z Last Updated: 2024-08-21T14:57:19.700Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Rockwell Automation Products: PowerFlex® 527 Problem Types: CWE-20 Description: A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper traffic throttling in the device. If multiple data packets are sent to the device repeatedly the device will crash and require a manual restart to recover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD1664.html
CVE ID: CVE-2024-2428 State: PUBLISHED Published: 2024-04-10T05:00:02.711Z Last Updated: 2024-10-30T13:58:22.162Z Vendors: Unknown Products: The Ultimate Video Player For WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4832e223-45
lyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4832e223-4571-4b45-97db-2fd403797c49/
CVE ID: CVE-2024-2429 State: PUBLISHED Published: 2024-04-26T05:00:02.847Z Last Updated: 2024-08-09T20:00:15.839Z Vendors: Unknown Products: Salon booking system Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1c6812d8-a218-4c15-9e2d-d43f3f3b0e78/
CVE ID: CVE-2024-2430 State: PUBLISHED Published: 2024-07-12T06:00:04.866Z Last Updated: 2024-08-01T19:11:53.499Z Vendors: Unknown Products: Website Content in Page or Post Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/990b7d7a-3d7a-46d5-9aeb-740de
ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/990b7d7a-3d7a-46d5-9aeb-740de817e2d9/
CVE ID: CVE-2024-2431 State: PUBLISHED Published: 2024-03-13T17:51:17.735Z Last Updated: 2024-08-05T13:31:26.517Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: GlobalProtect App Problem Types: CWE-269 Description: An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-2431