Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a692b869-1666-42d1-b56d-dfcccd68ab67/
CVE ID: CVE-2024-5448 State: PUBLISHED Published: 2024-06-21T06:00:06.690Z Last Updated: 2024-08-01T21:11:12.780Z Vendors: Unknown Products: PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wp
e Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/c482fe19-b643-41ea-8194-22776b388290/
CVE ID: CVE-2024-5449 State: PUBLISHED Published: 2024-06-06T03:32:54.926Z Last Updated: 2024-08-01T21:11:12.773Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wppool Products: WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing Problem Types: CWE-862 Missing Authorization Description: The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4. T
a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d20733-d61b-4b2f-8597-528644f0bc26?source=cve - https://plugins.trac.wordpress.org/browser/wp-dark-mode/trunk/includes/modules/social-share/class-social-share.php#L581 - https://plugins.trac.wordpress.org/changeset/3096290/wp-dark-mode/trunk?contextall=1&old=3073245&old_path=%2Fwp-dark-mode%2Ftrunk
CVE ID: CVE-2024-5450 State: PUBLISHED Published: 2024-07-13T06:00:11.772Z Last Updated: 2024-08-01T21:11:12.776Z Vendors: Unknown Products: Bug Library Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/d91217bc-9f8f-4971-885e-89edc45b2a4d/
CVE ID: CVE-2024-5451 State: PUBLISHED Published: 2024-06-25T13:53:22.074Z Last Updated: 2024-08-01T21:11:12.726Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Dream-Theme Products: The7 — Website and eCommerce Builder for WordPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Icon and Heading widgets in all versions up to, and including, 11.13.0 due to insufficient input sanitization and output escaping on user supplied
all versions up to, and including, 11.13.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4555cd1-5ae5-42b3-938f-ffce5ba4fe56?source=cve - https://themeforest.net/item/the7-responsive-multipurpose-wordpress-theme/5556590 - https://the7.io/changelog/
CVE ID: CVE-2024-5452 State: PUBLISHED Published: 2024-06-06T17:54:57.559Z Last Updated: 2025-10-15T12:50:27.239Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: lightning-ai Products: lightning-ai/pytorch-lightning Problem Types: CWE-915 Description: A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The library uses `deepdiff.Delta` objects to modify application state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attrib
state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attributes, allowing an attacker to construct a serialized delta that passes the deserializer whitelist and contains dunder attributes. When processed, this can be exploited to access other modules, classes, and instances, leading to arbitrary attribute write and total RCE on any self-hosted pytorch-lightning application in its default configuration, as the delta endpoint is enabled by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/486add92-275e-4a7b-92f9-42d84bc759da - https://github.com/lightning-ai/
chment: References: - https://huntr.com/bounties/486add92-275e-4a7b-92f9-42d84bc759da - https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a
CVE ID: CVE-2024-5453 State: PUBLISHED Published: 2024-06-05T07:34:55.724Z Last Updated: 2024-08-01T21:11:12.785Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: metagauss Products: ProfileGrid – User Profiles, Groups and Communities Problem Types: CWE-862 Missing Authorization Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_dismissible_notice and pm_wizard_update_group_icon functions in all versions up to, and including, 5.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to c
, and including, 5.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options to the value '1' or change group icons. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7a44d182-2a43-47c0-ab2e-36c0514c1d47?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php#L2006 - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php#L1378 - https://plugins.trac.wordpress.org
ser-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php#L1378 - https://plugins.trac.wordpress.org/changeset/3095503/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php?contextall=1
CVE ID: CVE-2024-5455 State: PUBLISHED Published: 2024-06-21T03:24:40.287Z Last Updated: 2024-08-01T21:11:12.785Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Unknown Products: The Plus Addons for Elementor Page Builder Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazine_style' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level access a
n the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8699142d-4ddd-4ca1-9886-9b2d905a36cd?source=cve - https://roadmap.theplusaddons.com/updates/
CVE ID: CVE-2024-5456 State: PUBLISHED Published: 2024-07-09T08:33:08.657Z Last Updated: 2024-08-01T21:11:12.796Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pandavideo Products: Panda Video Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Panda Video plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.0 via the 'selected_button' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. T
nd above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/94ab250a-387c-431e-9b75-16ede94bf0ef?source=cve - https://plugins.trac.wordpress.org/browser/pandavideo/trunk/includes/widgets/PandaButton.php#L237
CVE ID: CVE-2024-5457 State: PUBLISHED Published: 2024-07-09T08:33:08.189Z Last Updated: 2024-08-01T21:11:12.802Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pandavideo Products: Panda Video Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Panda Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that wil
for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/91a9dcf2-ba6b-4d03-9cdf-f50ea0d259d8?source=cve - https://plugins.trac.wordpress.org/browser/pandavideo/trunk/includes/assets/buttons/button-1.php#L6 - https://plugins.trac.wordpress.org/browser/pandavideo/trunk/includes/assets/buttons/button-2.php#L7 - https://plugins.trac.wordpress.org/browser/pandavideo/trunk/includes/assets/buttons/button-3.php#L8
CVE ID: CVE-2024-5458 State: PUBLISHED Published: 2024-06-09T18:26:28.804Z Last Updated: 2025-11-03T22:32:24.445Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PHP Group Products: PHP Description: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly. Additional Analyst Notes:
may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w - http://www.openwall.com/lists/oss-security/2024/06/07/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ - https://lists.debian.org/debian-lts-announce/2024/06/msg00009.html - https://security.netapp.com/advisory/ntap-20240726-000
ps://lists.debian.org/debian-lts-announce/2024/06/msg00009.html - https://security.netapp.com/advisory/ntap-20240726-0001/
CVE ID: CVE-2024-5459 State: PUBLISHED Published: 2024-06-05T12:45:38.670Z Last Updated: 2024-08-01T21:11:12.771Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: rustaurius Products: Five Star Restaurant Menu and Food Ordering Problem Types: CWE-862 Missing Authorization Description: The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on 'add_section', 'add_menu', 'add_menu_item', and 'add_menu_page' functions in all versions up to, and including, 2.4.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create menu sections, m
. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create menu sections, menus, food items, and new menu pages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03f9d9bb-6a87-4da9-bbb0-65203d7250e9?source=cve - https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L62 - https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L80 - https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrou
ugh.php#L80 - https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L111 - https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L144 - https://plugins.trac.wordpress.org/changeset/3097599/
CVE ID: CVE-2024-5460 State: PUBLISHED Published: 2024-06-25T23:58:10.683Z Last Updated: 2024-08-01T21:11:12.746Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Brocade Products: Fabric OS Problem Types: CWE-798 Description: A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow an authenticated, remote attacker to read data from an affected device via SNMP. The vulnerability is due to hard-coded, default community string in the configuration file for the SNMP daemon. An attacker could exploit this vulnerability by using the static community string in SNMP v
on file for the SNMP daemon. An attacker could exploit this vulnerability by using the static community string in SNMP version 1 queries to an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24409
CVE ID: CVE-2024-5461 State: PUBLISHED Published: 2025-02-15T00:06:56.950Z Last Updated: 2025-09-09T18:59:55.320Z Vendors: Brocade Products: Brocade Fabric OS Problem Types: CWE-78 Description: Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only enabled on the Brocade 6547 (FC5022) embedded switch. This injection could allow the authenticated attacker to issue commands as Root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
uthenticated attacker to issue commands as Root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24411
CVE ID: CVE-2024-5462 State: PUBLISHED Published: 2025-02-14T23:48:54.368Z Last Updated: 2025-02-18T16:26:54.617Z Vendors: Brocade Products: Brocade Fabric OS Problem Types: CWE-319 Description: If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be exposed in plaintext. The plaintext passwords can be exposed in a configupload capture or a supportsave capture if encryption of passwords is not enabled. An attacker can use these passwords to fetch values of the supported OIDs via SNMPv3 queries. There are also a limited number of MIB objects that can be modified. Additional Analyst Notes: - C
s via SNMPv3 queries. There are also a limited number of MIB objects that can be modified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24610
CVE ID: CVE-2024-5463 State: PUBLISHED Published: 2024-06-04T09:34:06.934Z Last Updated: 2025-08-01T03:40:52.248Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Synology Products: Camera Firmware Problem Types: CWE-120 Description: A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. This allows remote attackers to write specific files containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. This attack only affects the login service which will automatically restart. The following models with Synology Camera Firmware vers
only affects the login service which will automatically restart. The following models with Synology Camera Firmware versions before 1.1.1-0383 may be affected: BC500 and TC500. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_07
CVE ID: CVE-2024-5464 State: PUBLISHED Published: 2024-06-14T07:29:51.982Z Last Updated: 2024-08-01T21:11:12.788Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-200 Description: Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/6/
CVE ID: CVE-2024-5465 State: PUBLISHED Published: 2024-06-14T07:30:57.462Z Last Updated: 2024-08-01T21:11:12.714Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-264 Description: Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/6/
CVE ID: CVE-2024-5466 State: PUBLISHED Published: 2024-08-23T13:23:22.144Z Last Updated: 2024-08-23T15:37:32.493Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ManageEngine Products: OpManager, Remote Monitoring and Management Problem Types: CWE-94 Description: Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/itom/advisory/cve-2024-5466.html
CVE ID: CVE-2024-5467 State: PUBLISHED Published: 2024-08-23T13:28:28.419Z Last Updated: 2024-08-23T15:22:32.247Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/cve-2024-5467.html
CVE ID: CVE-2024-5468 State: PUBLISHED Published: 2024-06-12T08:33:19.554Z Last Updated: 2024-08-01T21:11:12.871Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: stylemix Products: WordPress Header Builder Plugin – Pearl Problem Types: CWE-862 Missing Authorization Description: The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stm_hb_delete() function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to delete arbitrary options that can be used to perform a denial of service attack on a sit
or unauthenticated attackers to delete arbitrary options that can be used to perform a denial of service attack on a site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e770e0-1a39-4946-838b-4fd1f1dea1c8?source=cve - https://plugins.trac.wordpress.org/browser/pearl-header-builder/tags/1.3.7/includes/helpers.php#L304
CVE ID: CVE-2024-5469 State: PUBLISHED Published: 2024-06-14T04:04:49.726Z Last Updated: 2025-01-09T21:40:26.611Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-754 Description: DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/464143
CVE ID: CVE-2024-5470 State: PUBLISHED Published: 2024-07-11T06:57:04.361Z Last Updated: 2024-08-29T15:04:59.607Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-284 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_push_rules` permission may have been able to create project-level deploy tokens. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/464312 - https://hackerone.com/reports/2521480
CVE ID: CVE-2024-5471 State: PUBLISHED Published: 2024-07-17T10:56:53.675Z Last Updated: 2024-08-01T21:11:12.767Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ManageEngine Products: DDI Central Problem Types: CWE-798 Description: Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2024-5471.html