Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
, with subscriber access and higher, to invoke their corresponding functions. This may lead to post creation and duplication, post content retrieval, post taxonomy manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/683131a0-eec3-4251-b322-5c2088855687?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085134%40ithemeland-bulk-posts-editing-lite%2Ftrunk&old=2946926%40ithemeland-bulk-posts-editing-lite%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4200 State: PUBLISHED Published: 2024-05-15T16:56:25.177Z Last Updated: 2024-08-01T20:33:53.025Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: Telerik Reporting Problem Types: CWE-502 Description: In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.telerik.com/reporting/knowledge-base/deserialization-vulnerability-cve-2024-4200
CVE ID: CVE-2024-4201 State: PUBLISHED Published: 2024-06-12T23:01:56.967Z Last Updated: 2024-08-29T15:04:57.749Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.
circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458229 - https://hackerone.com/reports/2473886 - https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#xss-and-content-injection-when-viewing-raw-xhtml-files-on-ios-devices
CVE ID: CVE-2024-4202 State: PUBLISHED Published: 2024-05-15T16:53:30.262Z Last Updated: 2024-08-01T20:33:52.951Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: Telerik Reporting Problem Types: CWE-94 Description: In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.telerik.com/reporting/knowledge-base/instantiation-vulnerability-cve-2024-4202
CVE ID: CVE-2024-4203 State: PUBLISHED Published: 2024-05-02T16:52:05.267Z Last Updated: 2024-08-01T20:33:52.945Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions up to, and including, 4.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access
escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only affects sites running the premium version of the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51fab95e-336d-4544-8b8e-c4e9002321ec?source=cve - https://plugins.trac.wordpress.org/changeset/3078006/premium-addons-for-elementor/trunk/widgets/premium-maps.php
CVE ID: CVE-2024-4204 State: PUBLISHED Published: 2024-05-16T20:31:03.725Z Last Updated: 2024-08-01T20:33:52.947Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ithemelandco Products: Bulk Posts Editing For WordPress Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to missing or incorrect nonce validation on the plugin's AJAX actions.. This makes it possible for unauthenticated attackers to create and duplicate posts, retrieve post content, and modify post taxonomy among other thi
unauthenticated attackers to create and duplicate posts, retrieve post content, and modify post taxonomy among other things via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/34b39462-32c5-4f7d-b54f-d95f40b6ed92?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085134%40ithemeland-bulk-posts-editing-lite%2Ftrunk&old=2946926%40ithemeland-bulk-posts-editing-lite%2Ftrunk&sfp_email=&sfph_mail=#file51
CVE ID: CVE-2024-4205 State: PUBLISHED Published: 2024-05-31T05:31:57.359Z Last Updated: 2024-08-01T20:33:52.902Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-862 Missing Authorization Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_template_content() function in all versions up to, and including, 4.10.31. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve Elementor template data. Additional Analyst Notes: - CISA ADP Vulnrichment: -
criber-level access and above, to retrieve Elementor template data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/175cb977-dcba-429f-814c-6de078e23472?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.10.28/includes/addons-integration.php#L1408 - https://plugins.trac.wordpress.org/changeset/3090037/premium-addons-for-elementor/trunk/includes/addons-integration.php
CVE ID: CVE-2024-4206 State: REJECTED Published: N/A Last Updated: 2024-06-11T09:45:44.534Z Description: No description available.
CVE ID: CVE-2024-4207 State: PUBLISHED Published: 2024-08-08T10:31:12.873Z Last Updated: 2024-08-29T15:04:57.844Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458236 - https://
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458236 - https://hackerone.com/reports/2473917
CVE ID: CVE-2024-4208 State: PUBLISHED Published: 2024-05-15T02:32:44.089Z Last Updated: 2024-08-01T20:33:52.960Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: britner Products: Gutenberg Blocks with AI by Kadence WP – Page Builder Features Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typer effect in the advanced heading widget in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user suppli
t in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea2bb8c-cc8b-49de-9c8e-2c8c0569f4ac?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084683%40kadence-blocks&new=3084683%40kadence-blocks&sfp_email=&sfph_mail=#file2
CVE ID: CVE-2024-4209 State: PUBLISHED Published: 2024-05-11T01:56:00.078Z Last Updated: 2024-08-01T20:33:53.025Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: britner Products: Gutenberg Blocks with AI by Kadence WP – Page Builder Features Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown timer in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it
including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cff2e5be-0de0-4e62-a881-6156760b7d99?source=cve - https://plugins.trac.wordpress.org/browser/kadence-blocks/trunk/includes/blocks/class-kadence-blocks-countdown-block.php - https://plugins.trac.wordpress.org/changeset/3083616/kadence-blocks/trunk/dis
class-kadence-blocks-countdown-block.php - https://plugins.trac.wordpress.org/changeset/3083616/kadence-blocks/trunk/dist/blocks-countdown.js
CVE ID: CVE-2024-4210 State: PUBLISHED Published: 2024-08-08T10:02:29.806Z Last Updated: 2024-08-29T15:04:57.922Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-400 Description: A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause a denial of service using crafted adoc files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458245 - https://hackerone.com/reports/2431562
CVE ID: CVE-2024-4211 State: PUBLISHED Published: 2024-10-16T16:41:20.927Z Last Updated: 2024-10-16T18:54:06.989Z Vendors: OpenText Products: OpenText Application Automation Tools Problem Types: CWE-280 Description: Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate ALM server names, usernames and client IDs configured to be used with ALM servers. This issue affects Op
on to enumerate ALM server names, usernames and client IDs configured to be used with ALM servers. This issue affects OpenText Application Automation Tools: 24.1.0 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000033543?language=en_US
CVE ID: CVE-2024-4212 State: PUBLISHED Published: 2024-06-06T03:32:55.411Z Last Updated: 2025-02-13T20:26:47.214Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themesflat Products: Themesflat Addons For Elementor Problem Types: CWE-79 Description: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TF Group Image, TF Nav Menu, TF Posts, TF Woo Product Grid, TF Accordion, and TF Image Box widgets in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribut
tion and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc686a35-4ce3-4359-a7d3-e6459e2f5dfe?source=cve - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-tfgroupimage.php#L423 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-clipping-mask.php#L619 - https://plug
ns.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-clipping-mask.php#L619 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-navmenu.php#L1843 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-posts.php#L3350 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-woo-product-grid.php#L3646 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-accordion.php#L1158 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-imagebox.php#L1313 - ht
https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-imagebox.php#L1313 - https://wordpress.org/plugins/themesflat-addons-for-elementor/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3099056%40themesflat-addons-for-elementor&old=3097003%40themesflat-addons-for-elementor&sfp_email=&sfph_mail=#file25
CVE ID: CVE-2024-4213 State: PUBLISHED Published: 2024-05-10T21:32:41.868Z Last Updated: 2024-08-01T20:33:52.895Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-922 Insecure Storage of Sensitive Information Description: The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.4 via the order report functionality. This makes it possible for unauthenticated attackers to extract sensitive data including order details such as payment details, addresses and other PII. Additional Analyst Notes:
ract sensitive data including order details such as payment details, addresses and other PII. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93daab72-1243-4a05-91d3-9254a1aac727?source=cve - https://plugins.trac.wordpress.org/changeset/3084202/wp-easycart/trunk/admin/inc/wp_easycart_admin.php?old=3068711&old_path=wp-easycart%2Ftrunk%2Fadmin%2Finc%2Fwp_easycart_admin.php
CVE ID: CVE-2024-4214 State: PUBLISHED Published: 2024-05-17T08:45:24.427Z Last Updated: 2024-08-01T20:33:52.965Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Bill Minozzi Products: Car Dealer Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Bill Minozzi Car Dealer allows Code Injection.This issue affects Car Dealer: from n/a through 4.15. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cardealer/wordpress-cardealer-plugin-4-15-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-4215 State: PUBLISHED Published: 2024-05-02T17:42:34.880Z Last Updated: 2025-02-13T17:53:30.480Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: pgadmin.org Products: pgAdmin 4 Description: pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
account’s MFA enrollment status. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pgadmin-org/pgadmin4/issues/7425 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/
CVE ID: CVE-2024-4216 State: PUBLISHED Published: 2024-05-02T17:42:59.679Z Last Updated: 2025-02-13T17:53:31.153Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: pgadmin.org Products: pgAdmin 4 Description: pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pgadmin-org/pgadmin4/issues/7282 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/
CVE ID: CVE-2024-4217 State: PUBLISHED Published: 2024-07-13T06:00:05.734Z Last Updated: 2024-08-01T20:33:53.001Z Vendors: Unknown Products: shortcodes-ultimate-pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for attackers with a Contributor account to conduct Stored XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/55cb43bf-7c8f-4df7-b4de-bf2bb1c2766d/
CVE ID: CVE-2024-4218 State: PUBLISHED Published: 2024-05-30T04:31:54.404Z Last Updated: 2024-08-01T20:33:53.009Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: perrinalexandre05 Products: AffiEasy Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.7. This is due to plugin improperly releasing the tagged and patched version of the plugin - the vulnerable version is used as the core files, while the patched version was included in a 'trunk' folder. This makes it possible for unauthenticated attackers to perform a variety
hed version was included in a 'trunk' folder. This makes it possible for unauthenticated attackers to perform a variety of actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/095a2262-1da2-4f79-896c-6d48eb079a7b?source=cve - https://plugins.trac.wordpress.org/browser/affieasy/tags/1.1.6
CVE ID: CVE-2024-4219 State: PUBLISHED Published: 2024-06-04T20:08:29.514Z Last Updated: 2024-08-01T20:33:52.999Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: BeyondTrust Products: BeyondInsight Problem Types: CWE-918 Description: Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a server-side request forgery vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.beyondtrust.com/trust-center/security-advisories/BT24-05
CVE ID: CVE-2024-4220 State: PUBLISHED Published: 2024-06-04T20:13:11.522Z Last Updated: 2024-08-01T20:33:53.024Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: BeyondTrust Products: BeyondInsight Problem Types: CWE-200 Description: Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.beyondtrust.com/trust-center/security-advisories/BT24-06
CVE ID: CVE-2024-4222 State: PUBLISHED Published: 2024-05-16T09:32:11.833Z Last Updated: 2024-08-01T20:33:53.068Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: themium Products: Tutor LMS Pro Problem Types: CWE-862 Missing Authorization Description: The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References
ete user meta and plugin options. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/942fffb6-2719-4b70-9759-21b2d50002c5?source=cve - https://www.themeum.com/product/tutor-lms/
CVE ID: CVE-2024-4223 State: PUBLISHED Published: 2024-05-16T08:32:50.538Z Last Updated: 2024-08-01T20:33:52.989Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-862 Missing Authorization Description: The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
ed attackers to add, modify, or delete data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=cve - https://plugins.trac.wordpress.org/changeset/3086489/
CVE ID: CVE-2024-4224 State: PUBLISHED Published: 2024-07-15T20:34:53.699Z Last Updated: 2024-08-01T20:33:53.018Z Vendors: TP-Link Products: TL-SG1016DE Problem Types: CWE-79 Description: An authenticated stored cross-site scripting (XSS) exists in the TP-Link TL-SG1016DE affecting version TL-SG1016DE(UN) V7.6_1.0.0 Build 20230616, which could allow an adversary to run JavaScript in an administrator's browser. This issue was fixed in TL-SG1016DE(UN) V7_1.0.1 Build 20240628. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://takeonme.org/cves/CVE-2024-4224.html - https://www.tp-link.com/en/support/download/tl-sg1016de/v7/#Firmware