Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8394 State: PUBLISHED Published: 2024-09-06T16:16:34.969Z Last Updated: 2025-03-19T17:45:27.550Z Vendors: Mozilla Products: Thunderbird Problem Types: Crash when aborting verification of OTR chat Description: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1895737 - https://www.mozilla.org/security/advisories/mfsa2024-43/
CVE ID: CVE-2024-8395 State: PUBLISHED Published: 2024-09-05T19:32:41.101Z Last Updated: 2024-09-05T20:28:18.500Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FlyCASS Products: Cockpit Access Security System (CASS), Known Crewmember (KCM) Problem Types: CWE-89 Description: FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside attackers with no authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ian.sh/tsa
CVE ID: CVE-2024-8397 State: PUBLISHED Published: 2025-05-15T20:07:15.179Z Last Updated: 2025-05-17T03:18:29.042Z Vendors: Unknown Products: webtoffee-gdpr-cookie-consent Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/847fbf5d-f7cf-49fd-88bc-d7fa2a8110
nalyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/847fbf5d-f7cf-49fd-88bc-d7fa2a8110bd/
CVE ID: CVE-2024-8398 State: PUBLISHED Published: 2025-05-15T20:07:15.365Z Last Updated: 2025-05-17T03:16:02.348Z Vendors: Unknown Products: Simple Nav Archives Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f432901f-31dd-433c-91bf-ec19fa61b6d8/
CVE ID: CVE-2024-8399 State: PUBLISHED Published: 2024-09-03T20:07:38.036Z Last Updated: 2025-03-19T15:24:15.482Z Vendors: Mozilla Products: Focus for iOS Problem Types: iOS Firefox Focus javascript URI address bar spoofing Description: Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1863838 - https://www.mozilla.org/security/advisories/mfsa2024-42/
CVE ID: CVE-2024-8400 State: PUBLISHED Published: 2025-03-20T10:11:12.193Z Last Updated: 2025-03-20T15:12:54.032Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability allows an attacker to upload a malicious HTML file containing JavaScript code, which is then executed when the file is accessed. This can lead to the execution of arbitrary JavaScript in the context of the user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
JavaScript in the context of the user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/405f16b8-848e-427d-a61a-ea7d3fd6f0e3 - https://github.com/gaizhenbiao/chuanhuchatgpt/commit/2cca68e34f029babbe4eaa5a77d220dad68fdd49
CVE ID: CVE-2024-8401 State: PUBLISHED Published: 2025-01-28T16:35:55.532Z Last Updated: 2025-01-28T18:58:12.602Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Schneider Electric Products: EcoStruxure Power Monitoring Expert (PME) 2021, EcoStruxure Power Monitoring Expert (PME) 2020, EcoStruxure Power Operation (EPO) 2022, EcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module, EcoStruxure Power Operation (EPO) 2021, EcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module, EcoStruxure Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module Problem Types: CWE-79 Description: CWE-79: Im
ower SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module Problem Types: CWE-79 Description: CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-254-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-254-02.pdf
CVE ID: CVE-2024-8402 State: PUBLISHED Published: 2025-03-13T05:56:29.590Z Last Updated: 2025-03-13T19:38:58.363Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-77 Description: An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. An input validation issue in the Google Cloud IAM integration feature could have enabled a Maintainer to introduce malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/482813 - https://h
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/482813 - https://hackerone.com/reports/2601569
CVE ID: CVE-2024-8403 State: PUBLISHED Published: 2024-11-19T05:57:17.693Z Last Updated: 2025-01-06T17:52:58.969Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Mitsubishi Electric Corporation Products: MELSEC iQ-F Series FX5-ENET, MELSEC iQ-F Series FX5-ENET/IP Problem Types: CWE-1287 Description: Improper Validation of Specified Type of Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET versions 1.100 and later and FX5-ENET/IP versions 1.100 to 1.104 allows a remote attacker to cause a Denial of Service condition in Ethernet communication of the products by sending specially crafted SLMP packets. Additional Analyst Notes: - C
ition in Ethernet communication of the products by sending specially crafted SLMP packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-009_en.pdf - https://jvn.jp/vu/JVNVU97790713/ - https://www.cisa.gov/news-events/ics-advisories/icsa-24-324-01
CVE ID: CVE-2024-8404 State: PUBLISHED Published: 2024-09-26T01:42:49.400Z Last Updated: 2025-05-13T01:39:33.742Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PaperCut Products: PaperCut NG, PaperCut MF Problem Types: CWE-59 Description: An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server via the web-print-hot-folder. Important: In most installations, this risk is mitigated by the default
tly on the server via the web-print-hot-folder. Important: In most installations, this risk is mitigated by the default Windows Server configuration, which restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server. Update: This CVE has been updated in May 2025 to update the fixed version and fix process. Please refer to the May 2025 Security Bulletin. Note: This CVE has been split from CVE-2024-3037. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/Securi
CVE-2024-3037. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/Security-Bulletin-May-2025/ - https://www.papercut.com/kb/Main/Security-Bulletin-May-2024/
CVE ID: CVE-2024-8405 State: PUBLISHED Published: 2024-09-26T01:36:26.364Z Last Updated: 2024-09-26T15:02:10.145Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: PaperCut Products: PaperCut NG, PaperCut MF Problem Types: CWE-77 Description: An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can be used to flood disk space and result in a Denial of Service (DoS) attack. Note: This CVE has been split from CVE-2024-4712. Additio
ood disk space and result in a Denial of Service (DoS) attack. Note: This CVE has been split from CVE-2024-4712. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/Security-Bulletin-May-2024/
CVE ID: CVE-2024-8407 State: PUBLISHED Published: 2024-09-04T14:00:04.716Z Last Updated: 2024-09-04T14:18:01.490Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: alwindoss Products: akademy Problem Types: CWE-79 Description: A vulnerability was found in alwindoss akademy up to 35caccea888ed63d5489e211c99edff1f62efdba. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file cmd/akademy/handler/handlers.go. The manipulation of the argument emailAddress leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why in
tely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276487 - https://vuldb.com/?ctiid.276487 - https://vuldb.com/?submit.397340 - https://github.com/alwindoss/akademy/issues/1
CVE ID: CVE-2024-8408 State: PUBLISHED Published: 2024-09-04T14:00:06.823Z Last Updated: 2024-09-04T14:13:56.158Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: WRT54G Problem Types: CWE-121 Description: A vulnerability was found in Linksys WRT54G 4.21.5. It has been rated as critical. Affected by this issue is the function validate_services_port of the file /apply.cgi of the component POST Parameter Handler. The manipulation of the argument services_array leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respo
has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276488 - https://vuldb.com/?ctiid.276488 - https://vuldb.com/?submit.398567 - https://github.com/BuaaIOTTeam/Iot_Linksys/blob/main/Linksys_WRT54G_validate_services_port.md - https://www.linksys.com/
CVE ID: CVE-2024-8409 State: PUBLISHED Published: 2024-09-04T14:31:04.314Z Last Updated: 2024-09-04T15:38:51.273Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ABCD Products: ABCD2 Problem Types: CWE-24 Description: A vulnerability classified as problematic has been found in ABCD ABCD2 up to 2.2.0-beta-1. This affects an unknown part of the file /common/show_image.php. The manipulation of the argument image leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst
nd may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276489 - https://vuldb.com/?ctiid.276489 - https://github.com/peritocibernetico/ABCD_Vulnerabilities
CVE ID: CVE-2024-8410 State: PUBLISHED Published: 2024-09-04T15:00:05.049Z Last Updated: 2024-09-04T18:21:13.898Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ABCD Products: ABCD2 Problem Types: CWE-22 Description: A vulnerability classified as problematic was found in ABCD ABCD2 up to 2.2.0-beta-1. This vulnerability affects unknown code of the file /abcd/opac/php/otros_sitios.php. The manipulation of the argument sitio leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276490 - https://vuldb.com/?ctiid.276490 - https://vuldb.com/?submit.398806 - https://github.com/peritocibernetico/ABCD_Vulnerabilities
CVE ID: CVE-2024-8411 State: PUBLISHED Published: 2024-09-04T15:00:06.194Z Last Updated: 2024-09-04T18:21:40.579Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ABCD Products: ABCD2 Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in ABCD ABCD2 up to 2.2.0-beta-1. This issue affects some unknown processing of the file /buscar_integrada.php. The manipulation of the argument Sub_Expresion leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
e used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276491 - https://vuldb.com/?ctiid.276491 - https://vuldb.com/?submit.398843 - https://github.com/peritocibernetico/ABCD_Vulnerabilities
CVE ID: CVE-2024-8412 State: PUBLISHED Published: 2024-09-04T15:31:04.200Z Last Updated: 2024-09-04T15:43:55.055Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: LinuxOSsk Products: Shakal-NG Problem Types: CWE-601 Description: A vulnerability, which was classified as problematic, was found in LinuxOSsk Shakal-NG up to 1.3.3. Affected is an unknown function of the file comments/views.py. The manipulation of the argument next leads to open redirect. It is possible to launch the attack remotely. The name of the patch is ebd1c2cba59cbac198bf2fd5a10565994d4f02cb. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichm
d5a10565994d4f02cb. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276492 - https://vuldb.com/?ctiid.276492 - https://vuldb.com/?submit.400792 - https://github.com/LinuxOSsk/Shakal-NG/issues/202 - https://github.com/LinuxOSsk/Shakal-NG/issues/202#issuecomment-2325187434 - https://github.com/LinuxOSsk/Shakal-NG/commit/ebd1c2cba59cbac198bf2fd5a10565994d4f02cb
CVE ID: CVE-2024-8413 State: PUBLISHED Published: 2024-09-04T10:31:08.500Z Last Updated: 2024-09-04T13:15:52.311Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: RaspControl Products: RaspControl Problem Types: CWE-79 Description: Cross Site Scripting (XSS) vulnerability through the action parameter in index.php. Affected product codebase https://github.com/Bioshox/Raspcontrol and forks such as https://github.com/harmon25/raspcontrol . An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially hijacking their session details. References list Additional Analyst Notes: - CISA ADP Vulnri
nticated user and partially hijacking their session details. References list Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-raspcontrol
CVE ID: CVE-2024-8414 State: PUBLISHED Published: 2024-09-04T16:31:05.409Z Last Updated: 2024-09-04T17:33:08.904Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Insurance Management System Problem Types: CWE-352 Description: A vulnerability has been found in SourceCodester Insurance Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276493 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276493 - https://vuldb.com/?ctiid.276493 - https://vuldb.com/?submit.402344 - https://drive.google.com/file/d/1LMkTt5gbVXnRB9m9o2MdgB1S0fsSAvGL/view - https://www.sourcecodester.com/
CVE ID: CVE-2024-8415 State: PUBLISHED Published: 2024-09-04T17:00:05.593Z Last Updated: 2024-09-04T17:32:13.162Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Food Ordering Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Food Ordering Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /routers/add-ticket.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276494 - https://vuldb.com/?ctiid.276494 - https://vuldb.com/?submit.402345 - https://github.com/Niu-zida/cve/blob/main/sql.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8416 State: PUBLISHED Published: 2024-09-04T17:31:04.382Z Last Updated: 2024-09-05T06:58:38.815Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Food Ordering Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Food Ordering Management System 1.0. It has been classified as critical. This affects an unknown part of the file /routers/ticket-status.php. The manipulation of the argument ticket_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276495 - https://vuldb.com/?ctiid.276495 - https://vuldb.com/?submit.402369 - https://github.com/SherlockMA0/cve/blob/main/sql2.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8417 State: PUBLISHED Published: 2024-09-04T17:31:08.235Z Last Updated: 2024-09-04T17:59:30.268Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: 云课网络科技有限公司 Products: Yunke Online School System Problem Types: CWE-540 Description: A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 1.5.5. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/educloud/videobind.html. The manipulation leads to inclusion of sensitive information in source code. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been
ed remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.6 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276496 - https://vuldb.com/?ctiid.276496 - https://vuldb.com/?submit.402376 - https://wiki.shikangsi.com/post/share/d31fefa1-ca08-48d7-a671-727d63bfaf65
CVE ID: CVE-2024-8418 State: PUBLISHED Published: 2024-09-04T14:24:03.276Z Last Updated: 2025-11-20T20:57:31.184Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 Problem Types: CWE-400 Description: A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legit
tely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:7094 - https://access.redhat.com/security/cve/CVE-2024-8418 - https://bugzilla.redhat.com/show_bug.cgi?id=2309683 - https://github.com/containers/aardvark-dns/issues/500 - https://github.com/containers/aardvark-dns/pull/503
CVE ID: CVE-2024-8419 State: PUBLISHED Published: 2025-06-30T09:39:50.792Z Last Updated: 2025-06-30T15:07:50.934Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ifm electronic GmbH Products: ifm Smart PLC AC4xxS Firmware Problem Types: CWE-306 Description: The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-061
CVE ID: CVE-2024-8420 State: PUBLISHED Published: 2025-02-28T08:23:19.298Z Last Updated: 2025-02-28T14:45:44.819Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SiteSao Products: DHVC Form Problem Types: CWE-266 Description: The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on sites. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d51a0c-c625-4
Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d51a0c-c625-4732-b345-df02971fbffa?source=cve - https://codecanyon.net/item/dhvc-form-wordpress-form-for-visual-composer/8326593
CVE ID: CVE-2024-8421 State: REJECTED Published: 2024-10-01T05:47:37.504Z Last Updated: 2024-10-30T21:32:31.426Z Description: No description available.