Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the public and may be used. The identifier of this vulnerability is VDB-269280. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269280 - https://vuldb.com/?ctiid.269280 - https://vuldb.com/?submit.359634 - https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_add_users_Sqli.md
CVE ID: CVE-2024-6217 State: PUBLISHED Published: 2024-06-21T02:00:04.826Z Last Updated: 2024-08-01T21:33:05.032Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Food Ordering Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Food Ordering Management System 1.0. Affected by this vulnerability is an unknown functionality of the file user-router.php. The manipulation of the argument 1_verified leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269281 was assigned to this vulnerability. Additional A
been disclosed to the public and may be used. The identifier VDB-269281 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269281 - https://vuldb.com/?ctiid.269281 - https://vuldb.com/?submit.359644 - https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_user_router_Sqli.md
CVE ID: CVE-2024-6218 State: PUBLISHED Published: 2024-06-21T02:00:06.482Z Last Updated: 2024-08-01T21:33:05.211Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Vehicle Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. Affected by this issue is some unknown functionality of the file busprofile.php. The manipulation of the argument busid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-269282 is the identifier assigned to this vulnerability. Additional Analyst Notes
sed to the public and may be used. VDB-269282 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269282 - https://vuldb.com/?ctiid.269282 - https://vuldb.com/?submit.360697 - https://github.com/HryspaHodor/CVE/issues/7
CVE ID: CVE-2024-6219 State: PUBLISHED Published: 2024-12-05T23:13:19.635Z Last Updated: 2025-08-28T13:29:18.834Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Canonical Ltd. Products: LXD Description: Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-jpmc-7p9c-4rxf - https://www.cve.org/CVERecord?id=CVE-2024-6219
CVE ID: CVE-2024-6220 State: PUBLISHED Published: 2024-07-17T07:32:19.236Z Last Updated: 2024-08-01T21:33:05.424Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: zhengdon Products: 简数采集器 Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The 简数采集器 (Keydatas) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the keydatas_downloadImages function in all versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA A
ry files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49ae7971-7bdf-4369-b04b-fb48ea5b9518?source=cve - https://plugins.trac.wordpress.org/browser/keydatas/trunk/keydatas.php
CVE ID: CVE-2024-6221 State: PUBLISHED Published: 2024-08-18T18:58:20.551Z Last Updated: 2025-04-07T15:03:37.262Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: corydolphin Products: corydolphin/flask-cors Problem Types: CWE-284 Description: A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions. Additional Analyst Notes: - CISA ADP Vulnrichment:
ed access to sensitive information, and potential network intrusions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d - https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf
CVE ID: CVE-2024-6222 State: PUBLISHED Published: 2024-07-09T17:16:05.646Z Last Updated: 2024-08-01T21:33:05.292Z Vendors: Docker Inc. Products: Docker Desktop Problem Types: CWE-923 Description: In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages. Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend. As exploitation requires "Allow only extensions distributed through the Docker Marketplace" to be disabled, Docker Desktop v4.31.0 https://docs.docker.c
only extensions distributed through the Docker Marketplace" to be disabled, Docker Desktop v4.31.0 https://docs.docker.com/desktop/release-notes/#4310 additionally changes the default configuration to enable this setting by default. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.docker.com/desktop/release-notes/#4290
CVE ID: CVE-2024-6223 State: PUBLISHED Published: 2024-07-30T06:00:09.898Z Last Updated: 2024-08-01T21:33:05.217Z Vendors: Unknown Products: Send email only on Reply to My Comment Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/cf7d1cea-0bf4-4b9e-bab4-71d5719a7c30/
CVE ID: CVE-2024-6224 State: PUBLISHED Published: 2024-07-30T06:00:10.109Z Last Updated: 2024-10-28T19:52:00.698Z Vendors: Unknown Products: Send email only on Reply to My Comment Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/54457f1b-6572-4de0-9100-3433c715c5
Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/54457f1b-6572-4de0-9100-3433c715c5ce/
CVE ID: CVE-2024-6225 State: PUBLISHED Published: 2024-06-21T07:39:57.465Z Last Updated: 2024-08-01T21:33:05.312Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: ameliabooking Products: Booking for Appointments and Events Calendar – Amelia Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.5 (and 7.5.1 for the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for
(and 7.5.1 for the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/04597908-7086-4158-ae2b-8aa634a217c6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3092932%40ameliabooking&
6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3092932%40ameliabooking&new=3092932%40ameliabooking&sfp_email=&sfph_mail=
CVE ID: CVE-2024-6226 State: PUBLISHED Published: 2024-07-30T06:00:10.319Z Last Updated: 2024-08-01T21:33:05.329Z Vendors: Unknown Products: WpStickyBar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WpStickyBar WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/e42ce8dc-51d4-471d-b3bb-ad2a6b735d02/
CVE ID: CVE-2024-6227 State: PUBLISHED Published: 2024-07-08T19:06:31.579Z Last Updated: 2024-08-30T15:25:02.656Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-835 Description: A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/abcea7c6-bb3b-45e9-aa15-9eb6b224451a
CVE ID: CVE-2024-6229 State: PUBLISHED Published: 2024-07-07T15:22:38.743Z Last Updated: 2024-08-01T21:33:05.163Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: stangirard Products: stangirard/quivr Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. Users can upload files via URL, which allows the insertion of malicious JavaScript payloads. These payloads are stored on the server and executed whenever any user clicks on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage. Additiona
s on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/2ee71e9e-2cf5-41a4-8440-d75758018786
CVE ID: CVE-2024-6230 State: PUBLISHED Published: 2024-07-30T06:00:10.533Z Last Updated: 2025-03-14T15:54:35.228Z Vendors: Unknown Products: پلاگین پرداخت دلخواه Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/311e3c15-0f58-4f3b-91f8-0c62c0eea55e/
CVE ID: CVE-2024-6231 State: PUBLISHED Published: 2024-07-23T06:00:02.805Z Last Updated: 2024-08-01T21:33:05.375Z Vendors: Unknown Products: Request a Quote Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/75ad1d8f-edc3-4eb3-b4c0-73832c0a4ca0/
CVE ID: CVE-2024-6232 State: PUBLISHED Published: 2024-09-03T12:29:00.102Z Last Updated: 2025-11-03T22:32:42.630Z Vendors: Python Software Foundation Products: CPython Problem Types: CWE-1333 Description: There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/pull/121286 - https://github.com/python/cpython/issues/121285 - https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLW
ython/cpython/issues/121285 - https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/ - https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06 - https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4 - https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf - https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373 - https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d - https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877 - https://github.com/python/cpython/commit/34ddb64d088dd7c
ython/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877 - https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4
CVE ID: CVE-2024-6233 State: PUBLISHED Published: 2024-11-22T20:05:39.766Z Last Updated: 2024-11-22T20:55:29.976Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Check Point Products: ZoneAlarm Extreme Security Problem Types: CWE-59 Description: Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Forensic Recorder serv
on the target system in order to exploit this vulnerability. The specific flaw exists within the Forensic Recorder service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21677. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1036/
CVE ID: CVE-2024-6235 State: PUBLISHED Published: 2024-07-10T19:07:58.885Z Last Updated: 2025-04-23T03:56:02.147Z Vendors: NetScaler Products: NetScaler Console Description: Sensitive information disclosure in NetScaler Console Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX677998
CVE ID: CVE-2024-6236 State: PUBLISHED Published: 2024-07-10T20:18:04.274Z Last Updated: 2025-08-27T20:42:59.832Z Vendors: NetSclaer, NetScaler Products: NetScaler Console, Agent, SDX Description: Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX677998
CVE ID: CVE-2024-6237 State: PUBLISHED Published: 2024-07-09T16:39:58.810Z Last Updated: 2025-11-20T19:54:11.313Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Directory Server 12.4 for RHEL 9, Red Hat Enterprise Linux 9, Red Hat Directory Server 11, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-230 Description: A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service. Additional Analyst Notes: - CISA AD
sh while sending a specific extended search request, leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4997 - https://access.redhat.com/errata/RHSA-2024:5192 - https://access.redhat.com/security/cve/CVE-2024-6237 - https://bugzilla.redhat.com/show_bug.cgi?id=2293579 - https://github.com/389ds/389-ds-base/issues/5989
CVE ID: CVE-2024-6238 State: PUBLISHED Published: 2024-06-25T16:12:12.960Z Last Updated: 2024-10-30T15:35:29.424Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: pgadmin.org Products: pgAdmin 4 Description: pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on the Debian or RHEL 8 platforms. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pgadmin-org/pgadmin4/issues/7605
CVE ID: CVE-2024-6239 State: PUBLISHED Published: 2024-06-21T13:28:23.857Z Last Updated: 2025-11-20T19:54:19.834Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-20 Description: A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
y to crash, leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:5305 - https://access.redhat.com/errata/RHSA-2024:9167 - https://access.redhat.com/security/cve/CVE-2024-6239 - https://bugzilla.redhat.com/show_bug.cgi?id=2293594
CVE ID: CVE-2024-6240 State: PUBLISHED Published: 2024-06-21T13:33:53.197Z Last Updated: 2024-08-01T21:33:05.241Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Parallels Products: Parallels Desktop Problem Types: CWE-269 Description: Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASH_ENV environment variable with the path to the malicious script, executing on application startup. An attacker could exploit this vulnerability to escalate privileges on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Prog
t this vulnerability to escalate privileges on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/improper-privilege-management-vulnerability-parallels-desktop
CVE ID: CVE-2024-6241 State: PUBLISHED Published: 2024-06-21T17:00:15.647Z Last Updated: 2024-08-01T21:33:05.100Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Pear Admin Boot Problem Types: CWE-89 Description: A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical. This issue affects the function getDictItems of the file /system/dictData/getDictItems/. The manipulation with the input ,user(),1,1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269375. Additional Analyst Notes: - CISA ADP Vulnrichment: - CV
. The associated identifier of this vulnerability is VDB-269375. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269375 - https://vuldb.com/?ctiid.269375 - https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5IPQ - https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5KBS
CVE ID: CVE-2024-6242 State: PUBLISHED Published: 2024-08-01T15:15:32.220Z Last Updated: 2025-09-25T13:34:40.444Z Vendors: Rockwell Automation Products: ControlLogix® 5580 (1756-L8z), GuardLogix® 5580 (1756-L8zS), 1756-EN4TR, 1756-EN2T, 1756-EN2F, 1756-EN2TR, 1756-EN3TR, 1756-EN2TP Problem Types: CWE-420 Description: A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis. Additional Analyst Not
mands that modify user projects and/or device configuration on a Logix controller in the chassis. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1682.html
CVE ID: CVE-2024-6243 State: PUBLISHED Published: 2024-07-22T06:00:06.064Z Last Updated: 2024-08-01T21:33:05.323Z Vendors: Unknown Products: HTML Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/f4097877-ba19-4738-a994-9593b9a5a635/
CVE ID: CVE-2024-6244 State: PUBLISHED Published: 2024-07-22T06:00:06.341Z Last Updated: 2025-03-19T19:30:02.061Z Vendors: Unknown Products: PZ Frontend Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732/
CVE ID: CVE-2024-6245 State: PUBLISHED Published: 2024-10-28T16:42:52.194Z Last Updated: 2024-11-07T15:16:26.982Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Faurecia Clarion Electronics Co., Ltd. Products: SmartPlay Problem Types: CWE-1392 Description: Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market. This issue affects SmartPlay: 66T0.05.50. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.marutisuzuki.com/corporate/technology/smartplay-sys
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.marutisuzuki.com/corporate/technology/smartplay-systems - https://www.global-infotainment-system.com/en/top.html