Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-49563 State: PUBLISHED Published: 2025-03-28T01:35:58.166Z Last Updated: 2025-03-29T03:55:38.281Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges and elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/suppo
and elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-49564 State: PUBLISHED Published: 2025-03-28T01:31:59.287Z Last Updated: 2025-03-29T03:55:37.062Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges and elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/suppo
CVE ID: CVE-2024-49565 State: PUBLISHED Published: 2025-03-28T01:28:11.627Z Last Updated: 2025-03-29T03:55:34.404Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-updat
s: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-49568 State: PUBLISHED Published: 2025-01-11T12:35:36.190Z Last Updated: 2025-05-04T09:39:23.222Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field v2_ext_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using them. References: - https://git
may happen. This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using them. References: - https://git.kernel.org/stable/c/295a92e3df32e72aff0f4bc25c310e349d07ffbf - https://git.kernel.org/stable/c/42f6beb2d5779429417b5f8115a4e3fa695d2a6c - https://git.kernel.org/stable/c/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf
CVE ID: CVE-2024-49569 State: PUBLISHED Published: 2025-01-11T12:25:19.455Z Last Updated: 2025-05-04T12:59:06.659Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: unquiesce admin_q before destroy it Kernel will hang on destroy admin_q while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15 #1 [ff61d23de260fc08] schedule at ffffffff8323c014 #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1 #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a #4 [ff61d23de260fc90] blk_cleanup_queue at ff
fffffff82a3dba1 #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006 #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362 #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25 RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574 RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004 RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90
0000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004 RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004 R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500 ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b This due to we have quiesced admi_q before cancel requests, but forgot to unquiesce before destroy it, as a result we fail to drain the pending requests, and hang on blk_mq_freeze_queue_wait() forever. Here try to reuse nvme_rdma_teardown_admin_queue() to fix this issue and simplify the code. References: - https://git.kernel.org/stable/c/427036030f4d796533dcadba9b845896cb6c10a7 - https://git.kernel.o
the code. References: - https://git.kernel.org/stable/c/427036030f4d796533dcadba9b845896cb6c10a7 - https://git.kernel.org/stable/c/05b436f3cf65c957eff86c5ea5ddfa2604b32c63 - https://git.kernel.org/stable/c/5858b687559809f05393af745cbadf06dee61295
CVE ID: CVE-2024-49570 State: PUBLISHED Published: 2025-02-27T02:18:06.123Z Last Updated: 2025-05-04T09:39:26.379Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe/tracing: Fix a potential TP_printk UAF The commit afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format") exposes potential UAFs in the xe_bo_move trace event. Fix those by avoiding dereferencing the xe_mem_type_to_name[] array at TP_printk time. Since some code refactoring has taken place, explicit backporting may be needed for kernels older than 6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://g
ng may be needed for kernels older than 6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/62cd174616ae3bf8a6cf468718f1ae74e5a07727 - https://git.kernel.org/stable/c/c9402da34611e1039ecccba3c1481c4866f7ca64 - https://git.kernel.org/stable/c/07089083a526ea19daa72a1edf9d6e209615b77c
CVE ID: CVE-2024-49571 State: PUBLISHED Published: 2025-01-11T12:35:36.957Z Last Updated: 2025-11-03T20:41:09.035Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg When receiving proposal msg in server, the field iparea_offset and the field ipv6_prefixes_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field iparea_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks iparea_offset and ipv6_prefixes_cnt before using them. Additional Analyst Not
s, and crash may happen. This patch checks iparea_offset and ipv6_prefixes_cnt before using them. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/846bada23bfcdeb83621b045ed85dc06c7833ff0 - https://git.kernel.org/stable/c/f10635268a0a49ee902a3b63b5dbb76f4fed498e - https://git.kernel.org/stable/c/62056d1592e63d85e82357ee2ae6a6a294f440b0 - https://git.kernel.org/stable/c/91a7c27c1444ed4677b83fd5308d2cf03f5f0851 - https://git.kernel.org/stable/c/47ce46349672a7e0c361bfe39ed0b22e824ef4fb - https://git.kernel.org/stable/c/a29e220d3c8edbf0e1beb0f028878a4a85966556
CVE ID: CVE-2024-49573 State: PUBLISHED Published: 2025-01-11T12:35:37.625Z Last Updated: 2025-05-04T09:39:29.429Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXT_BUDDY Adam reports that enabling NEXT_BUDDY insta triggers a WARN in pick_next_entity(). Moving clear_buddies() up before the delayed dequeue bits ensures no ->next buddy becomes delayed. Further ensure no new ->next buddy ever starts as delayed. References: - https://git.kernel.org/stable/c/5dbe6816c49197677a5ecce749bd99929da147da - https://git.kernel.org/stable/c/493afbd187c4c9cc1642792c0d9ba400c3d6d90d
CVE ID: CVE-2024-49574 State: PUBLISHED Published: 2024-11-18T07:55:13.332Z Last Updated: 2024-11-26T14:45:29.910Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/cve-2024-49574.html
CVE ID: CVE-2024-49576 State: PUBLISHED Published: 2024-12-18T15:57:33.904Z Last Updated: 2024-12-18T18:03:41.559Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a s
e user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2093
CVE ID: CVE-2024-49579 State: PUBLISHED Published: 2024-10-17T13:00:15.587Z Last Updated: 2024-10-17T14:00:40.770Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-940 Description: In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-49580 State: PUBLISHED Published: 2024-10-17T13:00:16.342Z Last Updated: 2024-12-06T14:02:44.754Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: Ktor Problem Types: CWE-524 Description: In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-49581 State: PUBLISHED Published: 2024-12-02T20:26:15.350Z Last Updated: 2024-12-02T20:46:18.532Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Palantir Products: com.palantir.gotham:external-artifacts Problem Types: CWE-862 Description: Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available across organizational boundaries nor did it allow for data to be viewed or accessed by unauthenticated users. The
ilable across organizational boundaries nor did it allow for data to be viewed or accessed by unauthenticated users. The affected service have been patched and automatically deployed to all Apollo-managed Foundry instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://palantir.safebase.us/?tcuUid=b60db1ee-4b1a-475d-848e-c5a670a0da16
CVE ID: CVE-2024-49588 State: PUBLISHED Published: 2024-11-21T19:59:45.456Z Last Updated: 2024-11-27T16:13:10.426Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/MAV:A/MAC:L/MPR:H/MUI:R/MS:U) Vendors: Palantir Products: com.palantir.srx.prometheus.sls-oracle-sidecar:sls-oracle-sidecar Problem Types: CWE-89 Description: Multiple endpoints in `oracle-sidecar` in versions 0.347.0 to 0.543.0 were found to be vulnerable to SQL injections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://palantir.safebase.us/?tcuUid=b5724367-8b86-436a-8ef2-4480ec41cc2c - https://cwe.mitre.org/data/definitions/89.html
CVE ID: CVE-2024-49589 State: PUBLISHED Published: 2025-02-18T17:18:41.883Z Last Updated: 2025-02-18T18:11:28.932Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Palantir Products: com.palantir.artifacts:artifacts Problem Types: CWE-770 Description: Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://palantir.safebase.us/?tcuUid=ad6b08b1-2f79-4e32-b125-406dd2b9b1c3
CVE ID: CVE-2024-49592 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-27T16:57:18.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trial installer for McAfee Total Protection (legacy trial installer software) 16.0.53 allows local privilege escalation because of an Uncontrolled Search Path Element. The attacker could be "an adversary or knowledgeable user" and the type of attack could be called "DLL-squatting." The issue only affects execution of this installer, and does not leave McAfee Total Protection in a vulnerable state after installation is completed. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Add
llation is completed. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mcafee.com/support/s/article/000002516?language=en_US
CVE ID: CVE-2024-49593 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-11-18T19:03:06.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/
eferences section below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/advanced-custom-fields/#developers - https://www.advancedcustomfields.com/changelog/ - https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/ - https://x.com/wp_acf/status/1845190372764401908
CVE ID: CVE-2024-49595 State: PUBLISHED Published: 2024-11-26T02:46:18.221Z Last Updated: 2024-11-26T15:08:52.404Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Dell Products: Wyse Management Suite Problem Types: CWE-294 Description: Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000244453/dsa-2024-440
CVE ID: CVE-2024-49596 State: PUBLISHED Published: 2024-11-26T02:56:14.374Z Last Updated: 2024-11-26T15:01:30.503Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: Wyse Management Suite, Wyse Management Suite Repository Problem Types: CWE-862 Description: Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service and arbitrary file deletion Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000244453/dsa-2024-440
CVE ID: CVE-2024-49597 State: PUBLISHED Published: 2024-11-26T02:50:47.797Z Last Updated: 2024-11-26T15:08:19.094Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Dell Products: Wyse Management Suite Problem Types: CWE-307 Description: Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000244453/dsa-2024-440
CVE ID: CVE-2024-49600 State: PUBLISHED Published: 2024-12-09T14:56:34.237Z Last Updated: 2024-12-10T16:47:12.869Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Power Manager (DPM) Problem Types: CWE-284 Description: Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000244438/dsa-2024-439
CVE ID: CVE-2024-49601 State: PUBLISHED Published: 2025-03-28T01:52:23.226Z Last Updated: 2025-03-29T03:55:42.823Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-uni
t: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-49602 State: PUBLISHED Published: 2024-12-09T14:22:58.153Z Last Updated: 2024-12-09T14:56:32.732Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-765 Description: Dell PowerScale OneFS Versions 8.2.2.x through 9.8.0.x contain an improper resource unlocking vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-in/000256645/dsa-2024-453-security-update-for-dell-powerscale-onefs-multiple-security-vulnerabilities
CVE ID: CVE-2024-49603 State: PUBLISHED Published: 2024-12-09T14:29:49.906Z Last Updated: 2024-12-09T15:08:22.547Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-687 Description: Dell PowerScale OneFS Versions 8.2.2.x through 9.9.0.x contain an incorrect specified argument vulnerability. A remote low privileged legitimate user could potentially exploit this vulnerability, leading to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-in/000256645/dsa-2024-453-security-update-for-dell-powerscale-onefs-multiple-security-vulnerabilities
CVE ID: CVE-2024-49604 State: PUBLISHED Published: 2024-10-20T07:56:32.685Z Last Updated: 2024-10-21T16:11:38.694Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Najeeb Ahmad Products: Simple User Registration Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Najeeb Ahmad Simple User Registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through 5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-registration/wordpress-simple-user-registration-plugin-5-5-account-takeover-vulnerability?_s_id
atabase/vulnerability/wp-registration/wordpress-simple-user-registration-plugin-5-5-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2024-49605 State: PUBLISHED Published: 2024-10-20T10:06:47.987Z Last Updated: 2024-10-20T13:50:29.333Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Avchat.net Products: AVChat Video Chat Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Avchat.Net AVChat Video Chat allows Stored XSS.This issue affects AVChat Video Chat: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/avchat-3/wordpress-community-lite-video-chat-plugin-2-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49606 State: PUBLISHED Published: 2024-10-20T07:50:44.809Z Last Updated: 2024-10-20T13:34:58.964Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Dotsquares Products: Google Map Locations Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dotsquares Google Map Locations allows Reflected XSS.This issue affects Google Map Locations: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/google-map-locations/wordpress-google-map-locations-plugin-1-0-reflected-cross-site-scriptin
.com/database/vulnerability/google-map-locations/wordpress-google-map-locations-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49607 State: PUBLISHED Published: 2024-10-20T08:40:29.097Z Last Updated: 2024-10-21T19:24:38.649Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Redwan Hilali Products: WP Dropbox Dropins Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Redwan Hilali WP Dropbox Dropins allows Upload a Web Shell to a Web Server.This issue affects WP Dropbox Dropins: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-dropbox-dropins/wordpress-wp-dropbox-dropins-plugin-1-0-arbitrary-file-upload-vulnerability?_s_id=cve