Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-40541 State: PUBLISHED Published: 2024-07-12T00:00:00 Last Updated: 2024-08-02T04:33:11.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept/build. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAH8A
CVE ID: CVE-2024-40542 State: PUBLISHED Published: 2024-07-12T00:00:00 Last Updated: 2024-08-02T04:33:11.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/role?offset. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAHCR
CVE ID: CVE-2024-40543 State: PUBLISHED Published: 2024-07-12T00:00:00 Last Updated: 2024-08-02T04:33:11.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAAITR
CVE ID: CVE-2024-40544 State: PUBLISHED Published: 2024-07-12T00:00:00.000Z Last Updated: 2025-03-26T15:46:06.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAAIX8
CVE ID: CVE-2024-40545 State: PUBLISHED Published: 2024-07-12T00:00:00 Last Updated: 2024-08-02T04:33:11.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAAIZD
CVE ID: CVE-2024-40546 State: PUBLISHED Published: 2024-07-12T00:00:00 Last Updated: 2024-08-02T04:33:11.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAAKYP
CVE ID: CVE-2024-40547 State: PUBLISHED Published: 2024-07-12T00:00:00.000Z Last Updated: 2025-03-13T12:31:07.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAAL70
CVE ID: CVE-2024-40548 State: PUBLISHED Published: 2024-07-12T00:00:00 Last Updated: 2024-08-02T04:33:11.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAALCK
CVE ID: CVE-2024-40549 State: PUBLISHED Published: 2024-07-12T00:00:00.000Z Last Updated: 2025-03-25T16:20:43.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAALNE
CVE ID: CVE-2024-40550 State: PUBLISHED Published: 2024-07-12T00:00:00 Last Updated: 2024-08-02T04:33:11.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAALWJ
CVE ID: CVE-2024-40551 State: PUBLISHED Published: 2024-07-12T00:00:00 Last Updated: 2024-08-02T04:33:11.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAAM5W
CVE ID: CVE-2024-40552 State: PUBLISHED Published: 2024-07-12T00:00:00.000Z Last Updated: 2025-03-26T20:04:39.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/sanluan/PublicCMS/issues/IAAMMU
CVE ID: CVE-2024-40553 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T04:33:11.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component uploadUserHeadImage. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/project_team/Tmall_demo/issues/IAANVC
CVE ID: CVE-2024-40554 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-16T18:38:05.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in Tmall_demo v2024.07.03 allows attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/project_team/Tmall_demo/issues/IAANYB
CVE ID: CVE-2024-40555 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-11-22T18:41:28.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/project_team/Tmall_demo/issues/IAAO1T
CVE ID: CVE-2024-40560 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T04:33:11.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tmall_demo before v2024.07.03 was discovered to contain a SQL injection vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/project_team/Tmall_demo/issues/IAAOT1
CVE ID: CVE-2024-40568 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-19T18:37:02.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in btstack mesh commit before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 allows a remote attacker to execute arbitrary code via the pb_adv_handle_tranaction_cont function in the src/mesh/pb_adv.c component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xiaobye-ctf/My-CVE/tree/main/BTstack/CVE-2024-40568
CVE ID: CVE-2024-40570 State: PUBLISHED Published: 2025-06-17T00:00:00.000Z Last Updated: 2025-06-18T14:10:12.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/seacms-net/CMS/issues/20 - https://gist.github.com/Tddddddddd/14cec7e85025fd566f877604ba3d2220
CVE ID: CVE-2024-40575 State: PUBLISHED Published: 2024-07-24T00:00:00.000Z Last Updated: 2025-03-18T13:30:37.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Huawei Technologies opengauss (openGauss 5.0.0 build) v.7.3.0 allows a local attacker to cause a denial of service via the modification of table attributes Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://opengauss.org - https://gist.github.com/RuiHuaLiu2023/92059b0fa6c625e3d39001c5a9b2dc71
CVE ID: CVE-2024-40576 State: PUBLISHED Published: 2024-07-29T00:00:00 Last Updated: 2024-08-02T04:33:11.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Best House Rental Management System 1.0 allows a remote attacker to execute arbitrary code via the "House No" and "Description" parameters in the houses page at the index.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html - https://github.com/jubilianite/CVEs/blob/main/CVE-2024-40576.md - https://github.com/jubilianite/CVEs/security/advisories/GHSA
//github.com/jubilianite/CVEs/blob/main/CVE-2024-40576.md - https://github.com/jubilianite/CVEs/security/advisories/GHSA-674x-j9wj-qvpp
CVE ID: CVE-2024-40579 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T18:18:59.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive information via modification of the hostname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vxcyber.com/cve-2024-40579.html
CVE ID: CVE-2024-40582 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T16:09:03.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://pentaminds.com - http://curovms.com - https://medium.com/@vishnuchttrj/exploiting-vms-vulnerabilities-to-access-confidential-data-cve-2024-40582-cve-2024-40583-60d957933b78
CVE ID: CVE-2024-40583 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T16:01:28.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://pentaminds.com - http://curovms.com - https://medium.com/@vishnuchttrj/exploiting-vms-vulnerabilities-to-access-confidential-data-cve-2024-40582-cve-2024-40583-60d957933b78
CVE ID: CVE-2024-40584 State: PUBLISHED Published: 2025-02-11T16:09:07.423Z Last Updated: 2025-02-12T15:53:33.827Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15 and 6.2.2 through 6.2.13, Fortinet FortiManager version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15 and 6.2.2 through 6.2.13, Fort
sion 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15 and 6.2.2 through 6.2.13, Fortinet FortiAnalyzer BigData version 7.4.0, 7.2.0 through 7.2.7, 7.0.1 through 7.0.6, 6.4.5 through 6.4.7 and 6.2.5, Fortinet FortiAnalyzer Cloud version 7.4.1 through 7.4.3, 7.2.1 through 7.2.5, 7.0.1 through 7.0.13 and 6.4.1 through 6.4.7 and Fortinet FortiManager Cloud version 7.4.1 through 7.4.3, 7.2.1 through 7.2.5, 7.0.1 through 7.0.13 and 6.4.1 through 6.4.7 GUI allows an authenticated privileged attacker to execute unauthorized code or commands via crafted HTTPS or HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.forti
rafted HTTPS or HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-220
CVE ID: CVE-2024-40585 State: PUBLISHED Published: 2025-03-14T15:45:46.084Z Last Updated: 2025-03-14T17:48:37.323Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-532 Description: An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and below, version 6.2.11 and below and FortiAnalyzer version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and below, version 6.2.11 and below eventlog may allow any low privileged user with access to even
below, version 6.4.12 and below, version 6.2.11 and below eventlog may allow any low privileged user with access to event log section to retrieve certificate private key and encrypted password logged as system log. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-311
CVE ID: CVE-2024-40586 State: PUBLISHED Published: 2025-02-11T16:09:06.665Z Last Updated: 2025-02-12T15:53:08.076Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-284 Description: An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below may allow a local user to escalate his privileges via FortiSSLVPNd service pipe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-279
CVE ID: CVE-2024-40587 State: PUBLISHED Published: 2025-01-14T14:09:40.739Z Last Updated: 2025-01-14T20:54:17.369Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiVoice Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiVoice version 7.0.0 through 7.0.4 and before 6.4.9 allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-304
CVE ID: CVE-2024-40588 State: PUBLISHED Published: 2025-08-12T18:59:11.807Z Last Updated: 2025-10-16T09:42:42.909Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiNDR, FortiCamera, FortiRecorder, FortiVoice, FortiMail Problem Types: CWE-23 Description: Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiMail version 7.6.0 through 7.6.1 and before 7.4.3, FortiVoice version 7.0.0 through 7.0.5 and before 7.4.9, FortiRecorder version 7.2.0 through 7.2.1 and before 7.0.4, FortiCamera & FortiNDR version 7.6.0 and before 7.4.6 may allow a privileged attacker to read files from the underlying filesystem v
& FortiNDR version 7.6.0 and before 7.4.6 may allow a privileged attacker to read files from the underlying filesystem via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-309
CVE ID: CVE-2024-40590 State: PUBLISHED Published: 2025-03-14T15:02:47.500Z Last Updated: 2025-03-14T18:02:38.328Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:R) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-295 Description: An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and below when connecting to a FortiManager device, a FortiAnalyzer device, or an SMTP server may allow an unauthenticated attacker in a Man-in-the-Middle position to intercept on and tamper with the encrypted communication channel established between the FortiPortal
Middle position to intercept on and tamper with the encrypted communication channel established between the FortiPortal and those endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-22-155
CVE ID: CVE-2024-40591 State: PUBLISHED Published: 2025-02-11T16:09:02.843Z Last Updated: 2025-02-14T04:55:21.558Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiOS Problem Types: CWE-266 Description: An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the targetted FortiGate to a malicious upstream FortiGate they control. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
FortiGate to a malicious upstream FortiGate they control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-302
CVE ID: CVE-2024-40592 State: PUBLISHED Published: 2024-11-12T18:53:49.686Z Last Updated: 2024-11-13T18:30:43.925Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiClientMac Problem Types: CWE-347 Description: An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a local authenticated attacker to swap the installer with a malicious package via a race condition during the installation process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.forti
ring the installation process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-022
CVE ID: CVE-2024-40594 State: PUBLISHED Published: 2024-07-06T00:00:00 Last Updated: 2024-11-04T20:55:16.585Z Severity: LOW (CVSS 2.3 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:N/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://arstechnica.com/ai/2024/07/chatgpts-much-heralded-mac-app-was-storing-conversations-as-plain-text/ - https://www.theverge.com/2024/7/3/24191636/openai-chatgpt-mac-app-conversations-plain-text
CVE ID: CVE-2024-40595 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T14:14:18.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise before 7.5.1 (and LTS before 7.0.5.1) allows man-in-the-middle attackers to obtain access to privileged sessions on target resources by intercepting cleartext RDP protocol information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.oneidentity.com/kb/4376565/cve-2024-40595-authentication-bypass-vulnerability
CVE ID: CVE-2024-40596 State: PUBLISHED Published: 2024-07-06T00:00:00.000Z Last Updated: 2025-03-18T15:21:17.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. (TimelineService does not support properly suppressing.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T326866
CVE ID: CVE-2024-40597 State: PUBLISHED Published: 2024-07-06T00:00:00 Last Updated: 2024-08-02T04:33:11.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribute is not respected.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T326865
CVE ID: CVE-2024-40598 State: PUBLISHED Published: 2024-07-06T00:00:00.000Z Last Updated: 2025-03-25T16:10:43.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted attribute is not applied to entries.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T326867
CVE ID: CVE-2024-40599 State: PUBLISHED Published: 2024-07-06T00:00:00.000Z Last Updated: 2025-03-20T20:36:12.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T361448
CVE ID: CVE-2024-40600 State: PUBLISHED Published: 2024-07-06T00:00:00 Last Updated: 2024-08-02T04:33:11.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T361449
CVE ID: CVE-2024-40601 State: PUBLISHED Published: 2024-07-06T00:00:00 Last Updated: 2024-10-27T01:00:28.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T362588
CVE ID: CVE-2024-40602 State: PUBLISHED Published: 2024-07-06T00:00:00.000Z Last Updated: 2025-03-14T17:44:05.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T361451
CVE ID: CVE-2024-40603 State: PUBLISHED Published: 2024-07-06T00:00:00.000Z Last Updated: 2025-03-17T21:38:52.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T363884
CVE ID: CVE-2024-40604 State: PUBLISHED Published: 2024-07-06T00:00:00.000Z Last Updated: 2025-03-18T18:54:13.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T361450