Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-33517 State: PUBLISHED Published: 2024-05-01T16:33:15.277Z Last Updated: 2024-08-02T02:36:04.200Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service. Additional Analyst Notes: - CISA ADP Vulnric
s in the ability to interrupt the normal operation of the affected service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-004.txt
CVE ID: CVE-2024-33518 State: PUBLISHED Published: 2024-05-01T16:35:09.048Z Last Updated: 2024-08-02T02:36:03.419Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service. Additional Analyst Notes: - CISA ADP Vulnric
CVE ID: CVE-2024-33519 State: PUBLISHED Published: 2024-07-24T19:57:27.110Z Last Updated: 2024-08-02T02:36:04.211Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking EdgeConnect SD-WAN Description: A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. Additional Analyst Notes: - CISA
rary commands on the underlying operating system leading to complete system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt
CVE ID: CVE-2024-33522 State: PUBLISHED Published: 2024-04-29T22:19:06.908Z Last Updated: 2024-08-02T02:36:04.113Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tigera Products: Calico, Calico Enterprise , Calico Cloud Problem Types: CWE-269 Description: In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. The issue arises from an incorrect SUID (Set User ID) bit configuration in the binary, combined with the ab
tall binary. The issue arises from an incorrect SUID (Set User ID) bit configuration in the binary, combined with the ability to control the input binary, allowing an attacker to execute an arbitrary binary with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/projectcalico/calico/issues/7981 - https://github.com/projectcalico/calico/pull/8447 - https://github.com/projectcalico/calico/pull/8517 - https://www.tigera.io/security-bulletins-tta-2024-001/
CVE ID: CVE-2024-33525 State: PUBLISHED Published: 2024-05-21T18:50:39.892Z Last Updated: 2025-02-13T15:52:40.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-site Scripting (XSS) vulnerability in the "Import of organizational units and title of organizational unit" feature in ILIAS 7.20 to 7.29 and ILIAS 8.4 to 8.10 as well as ILIAS 9.0 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029 - https://do
ences: - https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029 - https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170040 - https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=159938 - https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1/
CVE ID: CVE-2024-33526 State: PUBLISHED Published: 2024-05-21T14:52:30.339Z Last Updated: 2025-02-13T15:52:41.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029 - https://insinuator.net/2024/05/security-advisory-
p?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029 - https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1/
CVE ID: CVE-2024-33527 State: PUBLISHED Published: 2024-05-21T15:01:37.611Z Last Updated: 2025-02-13T15:52:42.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029 - https://insinuator.net/2024/05/security-advisory-achi
seClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029 - https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1/
CVE ID: CVE-2024-33528 State: PUBLISHED Published: 2024-05-21T14:44:18.457Z Last Updated: 2025-02-13T15:52:42.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029 - https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-1
- https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1/
CVE ID: CVE-2024-33529 State: PUBLISHED Published: 2024-05-21T14:46:58.726Z Last Updated: 2025-03-28T18:34:57.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170040 - https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1/
CVE ID: CVE-2024-33530 State: PUBLISHED Published: 2024-05-02T00:00:00.000Z Last Updated: 2025-04-09T13:21:45.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeting password when a user is invited to a call after waiting in the lobby. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://insinuator.net/2024/05/vulnerability-in-jitsi-meet-meeting-password-disclosure-affecting-meetings-with-lobbies/
CVE ID: CVE-2024-33531 State: PUBLISHED Published: 2024-04-24T00:00:00 Last Updated: 2024-08-02T02:36:03.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://insinuator.net/2023/10/lua-resty-jwt-authentication-bypass/ - https://github.com/cdbattags/lua-resty-jwt/issues/61 - https://github.com/cdbattags/lua-resty-jwt/commit/d1558e2afefe868fea1e7e9a4b04ea94ab678a85
CVE ID: CVE-2024-33533 State: PUBLISHED Published: 2024-08-12T00:00:00.000Z Last Updated: 2025-03-13T20:12:37.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file and crafting a URL containing its location in the packages paramet
ser session. By uploading a malicious JavaScript file and crafting a URL containing its location in the packages parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.8#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P40#Security_Fixes
CVE ID: CVE-2024-33535 State: PUBLISHED Published: 2024-08-12T00:00:00.000Z Last Updated: 2025-03-19T15:58:06.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without authentication, potentially leading to unauthorized access to sensitive information. The vulnerability is limited to files within a specific directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.
ted to files within a specific directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.8#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P40#Security_Fixes
CVE ID: CVE-2024-33536 State: PUBLISHED Published: 2024-08-12T00:00:00.000Z Last Updated: 2025-03-25T16:10:43.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file, accessible externally, and crafting a URL containing its location in the res parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the mali
parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.8#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P40#Security_Fixes
CVE ID: CVE-2024-33537 State: PUBLISHED Published: 2024-04-29T05:26:29.201Z Last Updated: 2024-08-02T02:36:04.065Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Theme Horse Products: WP Portfolio Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Horse WP Portfolio allows Stored XSS.This issue affects WP Portfolio: from n/a through 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-portfolio/wordpress-wp-portfolio-theme-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-33538 State: PUBLISHED Published: 2024-04-29T07:50:05.808Z Last Updated: 2024-08-02T02:36:03.975Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Fastline Media LLC Products: Assistant – Every Day Productivity Apps Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fastline Media LLC Assistant – Every Day Productivity Apps.This issue affects Assistant – Every Day Productivity Apps: from n/a through 1.4.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/assistant/wordpress-assistant-every-day-p
Program Container: References: - https://patchstack.com/database/vulnerability/assistant/wordpress-assistant-every-day-productivity-apps-plugin-1-4-9-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-33539 State: PUBLISHED Published: 2024-04-29T05:23:30.661Z Last Updated: 2024-08-08T16:06:41.254Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPZOOM Products: WPZOOM Addons for Elementor (Templates, Widgets) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor (Templates, Widgets) allows Stored XSS.This issue affects WPZOOM Addons for Elementor (Templates, Widgets): from n/a through 1.1.35. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerabil
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpzoom-elementor-addons/wordpress-wpzoom-addons-for-elementor-plugin-1-1-35-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-33540 State: PUBLISHED Published: 2024-04-29T05:20:12.245Z Last Updated: 2024-08-02T02:36:03.611Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemeGrill Products: ColorNews Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill ColorNews allows Stored XSS.This issue affects ColorNews: from n/a through 1.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/colornews/wordpress-colornews-theme-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-33541 State: PUBLISHED Published: 2024-06-04T13:04:15.565Z Last Updated: 2024-08-02T02:36:04.323Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: BetterAddons Products: Better Elementor Addons Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BetterAddons Better Elementor Addons allows PHP Local File Inclusion.This issue affects Better Elementor Addons: from n/a through 1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/better-elementor-addons/wordpress-better-elementor-a
tainer: References: - https://patchstack.com/database/vulnerability/better-elementor-addons/wordpress-better-elementor-addons-plugin-1-4-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-33542 State: PUBLISHED Published: 2024-04-29T06:03:08.830Z Last Updated: 2025-08-27T21:12:59.776Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Fabio Rinaldi Products: Crelly Slider Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/crelly-slider/wordpress-crelly-slider-plugin-1-4-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2024-33543 State: PUBLISHED Published: 2024-06-09T12:11:16.334Z Last Updated: 2024-08-02T02:36:04.106Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: CodePeople Products: WP Time Slots Booking Form Problem Types: CWE-862 Description: Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.06. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-2-06-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-33544 State: PUBLISHED Published: 2024-04-29T06:14:32.419Z Last Updated: 2024-08-02T02:36:03.332Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: AA-Team Products: WZone Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZone: from n/a through 14.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-33545 State: PUBLISHED Published: 2024-06-09T12:10:04.719Z Last Updated: 2024-08-02T02:36:04.398Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: AA-Team Products: WZone Problem Types: CWE-862 Description: Missing Authorization vulnerability in AA-Team WZone.This issue affects WZone: from n/a through 14.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-33546 State: PUBLISHED Published: 2024-04-29T06:12:49.965Z Last Updated: 2024-08-02T02:36:04.234Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: AA-Team Products: WZone Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZone: from n/a through 14.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-arbitrary-sql-update-execution-vulnerability?_s_id=cve
CVE ID: CVE-2024-33547 State: PUBLISHED Published: 2024-06-09T12:08:46.731Z Last Updated: 2024-08-02T02:36:04.047Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: AA-Team Products: WZone Problem Types: CWE-862 Description: Missing Authorization vulnerability in AA-Team WZone.This issue affects WZone: from n/a through 14.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-site-wide-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-33548 State: PUBLISHED Published: 2024-04-29T05:17:53.118Z Last Updated: 2024-08-02T02:36:04.421Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: AA-Team Products: WZone Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team WZone allows Reflected XSS.This issue affects WZone: from n/a through 14.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-33549 State: PUBLISHED Published: 2024-05-17T08:18:11.504Z Last Updated: 2024-08-02T02:36:04.084Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AA-Team Products: WZone Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in AA-Team WZone allows Privilege Escalation.This issue affects WZone: from n/a through 14.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woozone/wordpress-wzone-plugin-14-0-10-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-33550 State: PUBLISHED Published: 2024-05-17T08:17:52.030Z Last Updated: 2024-08-02T02:36:03.397Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: JR King/Eran Schoellhorn Products: WP Masquerade Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in JR King/Eran Schoellhorn WP Masquerade allows Privilege Escalation.This issue affects WP Masquerade: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-masquerade/wordpress-wp-masquerade-plugin-1-1-0-authenticated-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2024-33551 State: PUBLISHED Published: 2024-04-29T06:08:35.200Z Last Updated: 2024-08-02T02:36:04.146Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: 8theme Products: XStore Core Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore Core allows SQL Injection.This issue affects XStore Core: from n/a through 5.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-33552 State: PUBLISHED Published: 2024-05-17T08:17:33.587Z Last Updated: 2024-08-02T02:36:03.793Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: 8theme Products: XStore Core Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in 8theme XStore Core allows Privilege Escalation.This issue affects XStore Core: from n/a through 5.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-unauthenticated-privilege-escalation-vulnerability?_s_id=cve