Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8628 State: PUBLISHED Published: 2024-09-24T03:06:38.389Z Last Updated: 2024-09-24T13:39:54.093Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: collizo4sky Products: Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin Problem Types: CWE-79 Description: The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-meta' shortcode in all versions up to, and including, 1.2.70.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated
sufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d64253b-5803-470d-81ba-d5629406b019?source=cve - https://plugins.trac.wordpress.org/changeset/3152552/mailoptin/trunk/src/core/src/EmailCampaigns/Shortcodes.php
CVE ID: CVE-2024-8629 State: PUBLISHED Published: 2024-10-08T09:33:13.442Z Last Updated: 2024-10-08T13:21:30.567Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: amirhelzer Products: WooCommerce Multilingual & Multicurrency with WPML Problem Types: CWE-79 Description: The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.3.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perfor
icated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/494dc869-6f4d-428b-99a8-87212f3007be?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/tags/5.3.7/inc/class-wcml-comments.php#L257 - https://plugins.trac.wordpress.org/changeset/3164233/woocommerce-multilingual/trunk/inc/class-wcml-comments.php
CVE ID: CVE-2024-8630 State: PUBLISHED Published: 2024-09-27T16:26:02.481Z Last Updated: 2024-09-27T16:41:05.435Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Alisonic Products: Sibylla Problem Types: CWE-89 Description: Alisonic Sibylla devices are vulnerable to SQL injection attacks, which could allow complete access to the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-02
CVE ID: CVE-2024-8631 State: PUBLISHED Published: 2024-09-12T17:11:03.832Z Last Updated: 2024-09-13T14:17:39.020Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-267 Description: A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/462665 -
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/462665 - https://hackerone.com/reports/2478469
CVE ID: CVE-2024-8632 State: PUBLISHED Published: 2024-10-01T07:30:13.274Z Last Updated: 2024-10-01T13:44:02.056Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: cagdasdag Products: KB Support – WordPress Help Desk and Knowledge Base Problem Types: CWE-862 Description: The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'kbs_ajax_load_front_end_replies' and 'kbs_ajax_mark_reply_as_read' functions in all versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to read replies of any ticket, and mark
to, and including, 1.6.6. This makes it possible for unauthenticated attackers to read replies of any ticket, and mark any reply as read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/767b1234-5b4a-4baa-9048-7b2e413cdba5?source=cve - https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L342 - https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/ajax-functions.php#L439
CVE ID: CVE-2024-8633 State: PUBLISHED Published: 2024-09-26T11:32:38.668Z Last Updated: 2024-09-26T13:00:04.135Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: 10web Products: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Problem Types: CWE-79 Description: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages
ossible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b32cc12-c8d5-40b8-9510-42699beec581?source=cve - https://wordpress.org/plugins/form-maker/#developers - https://plugins.trac.wordpress.org/changeset/3156791/
CVE ID: CVE-2024-8635 State: PUBLISHED Published: 2024-09-12T17:01:51.084Z Last Updated: 2024-09-13T14:17:39.564Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-918 Description: A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/455273
CVE ID: CVE-2024-8636 State: PUBLISHED Published: 2024-09-11T13:47:54.631Z Last Updated: 2024-09-13T13:28:35.767Z Vendors: Google Products: Chrome Problem Types: CWE-122 Description: Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/361461526
CVE ID: CVE-2024-8637 State: PUBLISHED Published: 2024-09-11T13:47:55.055Z Last Updated: 2024-09-13T13:27:56.566Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Media Router in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/361784548
CVE ID: CVE-2024-8638 State: PUBLISHED Published: 2024-09-11T13:47:55.389Z Last Updated: 2024-09-13T13:27:25.179Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/362539773
CVE ID: CVE-2024-8639 State: PUBLISHED Published: 2024-09-11T13:47:55.767Z Last Updated: 2024-09-13T13:25:50.847Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/362658609
CVE ID: CVE-2024-8640 State: PUBLISHED Published: 2024-09-12T16:56:23.356Z Last Updated: 2024-09-13T14:13:28.966Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-77 Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/486213 - https://hackerone.com/reports/2687770
CVE ID: CVE-2024-8641 State: PUBLISHED Published: 2024-09-12T18:26:18.243Z Last Updated: 2024-09-13T14:10:32.415Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-270 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/471954 - https://
ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/471954 - https://hackerone.com/reports/2595495
CVE ID: CVE-2024-8642 State: PUBLISHED Published: 2024-09-11T13:34:28.463Z Last Updated: 2024-09-11T14:06:55.373Z Vendors: Eclipse Foundation Products: Eclipse EDC Connector Problem Types: CWE-303, CWE-305 Description: In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of D
include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234 - https://gitlab.eclipse.org/security/cve-assignement/-/issues/28 - https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6 - https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0
CVE ID: CVE-2024-8643 State: PUBLISHED Published: 2024-09-27T11:53:44.040Z Last Updated: 2024-09-27T14:09:07.499Z Vendors: Oceanic Software Products: ValeApp Problem Types: CWE-384 Description: Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking.This issue affects ValeApp: before v2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1562
CVE ID: CVE-2024-8644 State: PUBLISHED Published: 2024-09-27T11:48:53.187Z Last Updated: 2024-09-27T14:09:50.464Z Vendors: Oceanic Software Products: ValeApp Problem Types: CWE-315 Description: Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking).This issue affects ValeApp: before v2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1562
CVE ID: CVE-2024-8645 State: PUBLISHED Published: 2024-09-10T10:02:16.798Z Last Updated: 2025-11-03T22:32:58.816Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-824 Description: SPRT dissector crash in Wireshark 4.2.0 to 4.0.5 and 4.0.0 to 4.0.15 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2024-10.html - https://gitlab.com/wireshark/wireshark/-/issues/19559
CVE ID: CVE-2024-8646 State: PUBLISHED Published: 2024-09-11T13:26:47.468Z Last Updated: 2024-09-11T13:40:06.290Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Eclipse Foundation Products: Eclipse Glassfish Problem Types: CWE-601 Description: In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/'). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/vul
context ('/'). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/163 - https://gitlab.eclipse.org/security/cve-assignement/-/issues/34 - https://github.com/eclipse-ee4j/glassfish/pull/24655 - https://glassfish.org/download
CVE ID: CVE-2024-8647 State: PUBLISHED Published: 2024-12-12T12:02:54.888Z Last Updated: 2024-12-12T15:44:19.905Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-22 Description: An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/486051 - https://hackerone.com/reports/2666341
CVE ID: CVE-2024-8648 State: PUBLISHED Published: 2024-11-14T13:02:08.724Z Last Updated: 2024-11-14T19:29:00.227Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/486220 - https://hackerone.com/reports/2683863 - https://about.g
rences: - https://gitlab.com/gitlab-org/gitlab/-/issues/486220 - https://hackerone.com/reports/2683863 - https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#stored-xss-through-javascript-url-in-analytics-dashboards
CVE ID: CVE-2024-8650 State: PUBLISHED Published: 2024-12-16T04:30:58.662Z Last Updated: 2024-12-16T16:45:13.671Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-member users to view unresolved threads marked as internal notes in public projects merge requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/486300 - https://hackerone.com/reports/2705909
CVE ID: CVE-2024-8651 State: PUBLISHED Published: 2024-09-19T16:30:10.685Z Last Updated: 2024-09-19T18:28:53.419Z Vendors: NetCat Products: NetCat CMS Problem Types: CWE-204 Description: A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which could be a basis for further attacks. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others. Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and on have the patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/klsecservices/Advisories/blob/master/K-NetCat-2024-001.
Notes: - CISA ADP Vulnrichment: References: - https://github.com/klsecservices/Advisories/blob/master/K-NetCat-2024-001.md
CVE ID: CVE-2024-8652 State: PUBLISHED Published: 2024-09-19T16:35:55.844Z Last Updated: 2024-09-19T18:23:52.427Z Vendors: NetCat Products: NetCat CMS Problem Types: CWE-79 Description: A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific path on the site. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others. Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and on have the patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/klsecservices/Advisories/blob/master/K-NetCat-2024-002.md
CVE ID: CVE-2024-8653 State: PUBLISHED Published: 2024-09-19T16:39:23.108Z Last Updated: 2024-09-19T18:23:17.116Z Vendors: NetCat Products: NetCat CMS Problem Types: CWE-79 Description: A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific paths on the site. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others. Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and on have the patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/klsecservices/Advisories/blob/master/K-NetCat-2024-003.md
CVE ID: CVE-2024-8654 State: PUBLISHED Published: 2024-09-10T13:35:50.554Z Last Updated: 2025-05-16T23:03:01.427Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-908 Description: MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-71477
CVE ID: CVE-2024-8655 State: PUBLISHED Published: 2024-09-10T19:31:04.014Z Last Updated: 2024-09-12T13:43:51.121Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mercury Products: MNVR816 Problem Types: CWE-552 Description: A vulnerability was found in Mercury MNVR816 up to 2.0.1.0.5. It has been classified as problematic. This affects an unknown part of the file /web-static/. The manipulation leads to files or directories accessible. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA
d. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276963 - https://vuldb.com/?ctiid.276963 - https://vuldb.com/?submit.401301
CVE ID: CVE-2024-8656 State: PUBLISHED Published: 2024-09-13T03:27:08.399Z Last Updated: 2024-09-13T14:01:58.427Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: algoritmika Products: WPFactory Helper Problem Types: CWE-79 Description: The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes
ute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb62eefe-9993-43f7-b3ae-de47c0951bee?source=cve - https://plugins.trac.wordpress.org/browser/wpcodefactory-helper/tags/1.7.0/includes/class-alg-wpcodefactory-helper-site-key-manager.php#L350 - https://plugins.trac.wordpress.org/changeset/3150715/wpcodefactory-helper/tags/1.7.1/includes/class-alg-wpcodefactory-helper-site-key-manager.php
CVE ID: CVE-2024-8657 State: PUBLISHED Published: 2024-09-24T01:56:45.907Z Last Updated: 2024-09-24T13:51:46.507Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ggnomes Products: Garden Gnome Package Problem Types: CWE-79 Description: The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ggpkg shortcode in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2a295969-454a-47fb-bc35-4e84db38c887?source=cve - https://plugins.trac.wordpress.org/browser/garden-gnome-package/tags/2.2.9/include/ggpackage.php#L310 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3154566%40garden-gnome-package&new=3154566%40garden-gnome-package&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8658 State: PUBLISHED Published: 2024-09-25T05:32:09.806Z Last Updated: 2024-09-25T13:45:32.704Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpexpertsio Products: myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification Problem Types: CWE-862 Description: The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap
ce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20be9a37-9e9f-4791-a27c-e0db007be787?source=cve - https://plugins.trac.wordpress.org/changeset/3156989/mycred/trunk/includes/mycred-database-upgrade.php