Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8601 State: PUBLISHED Published: 2024-09-09T09:13:24.618Z Last Updated: 2024-09-09T13:11:07.617Z Vendors: TechExcel Software Solutions Products: Back Office Software Problem Types: CWE-639 Description: This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to unauthorized access to sensitive information belonging to other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLC
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0285
CVE ID: CVE-2024-8602 State: PUBLISHED Published: 2024-10-14T13:10:38.393Z Last Updated: 2024-12-18T16:07:57.491Z Vendors: Schweizerische Steuerkonferenz Products: Library taxstatement.jar Problem Types: CWE-611 Description: When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Open Worldwide Application Security Project (OWASP). An attacker could theoretically leverage this by delivering a manipulated PDF file to the target, and depending on the environment, various actions can be executed. These actions includ
ipulated PDF file to the target, and depending on the environment, various actions can be executed. These actions include: * Reading files from the operating system * Crashing the thread handling the parsing or causing it to enter an infinite loop * Executing HTTP requests * Loading additional DTDs or XML files * Under certain conditions, executing OS commands Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://esteuer.ewv-ete.ch/fileadmin/esta/2024-10-09-update/24_09_esta_newsletter_de.pdf - https://mkiesel.ch/posts/swiss-tax-adventures-1/
CVE ID: CVE-2024-8603 State: PUBLISHED Published: 2025-01-15T15:31:01.195Z Last Updated: 2025-01-15T15:56:30.409Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: B&R Industrial Automation Products: Automation Runtime, mapp View Problem Types: CWE-327 Description: A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp View versions before 6.1 may be abused by unauthenticated network-based attackers to masquerade as services on impacted devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA25P001-c478f
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA25P001-c478fad6.pdf
CVE ID: CVE-2024-8604 State: PUBLISHED Published: 2024-09-09T16:00:04.833Z Last Updated: 2024-09-09T20:01:05.475Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Food Ordering System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Online Food Ordering System 2.0. This affects an unknown part of the file index.php of the component Create an Account Page. The manipulation of the argument First Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276831 - https://vu
ack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276831 - https://vuldb.com/?ctiid.276831 - https://vuldb.com/?submit.404660 - https://www.sourcecodester.com/
CVE ID: CVE-2024-8605 State: PUBLISHED Published: 2024-09-09T16:00:06.744Z Last Updated: 2024-09-09T20:00:19.332Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: code-projects Products: Inventory Management Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affects unknown code of the file /view/registration.php of the component Registration Form. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276832 - https://vuldb.com/?ctiid.276832 - https://vuldb.com/?submit.404711 - https://github.com/ali0999109/Inventory-management - https://code-projects.org/
CVE ID: CVE-2024-8606 State: PUBLISHED Published: 2024-09-23T07:01:04.769Z Last Updated: 2024-09-23T15:33:22.875Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-863 Description: Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/16218
CVE ID: CVE-2024-8607 State: PUBLISHED Published: 2024-09-27T12:04:40.125Z Last Updated: 2024-09-27T14:05:54.855Z Vendors: Oceanic Software Products: ValeApp Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oceanic Software ValeApp allows SQL Injection.This issue affects ValeApp: before v2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1562
CVE ID: CVE-2024-8608 State: PUBLISHED Published: 2024-09-27T12:00:27.699Z Last Updated: 2024-09-27T14:06:52.657Z Vendors: Oceanic Software Products: ValeApp Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Oceanic Software ValeApp allows Stored XSS.This issue affects ValeApp: before v2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1562
CVE ID: CVE-2024-8609 State: PUBLISHED Published: 2024-09-27T11:55:52.550Z Last Updated: 2024-09-27T14:07:54.584Z Vendors: Oceanic Software Products: ValeApp Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information.This issue affects ValeApp: before v2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1562
CVE ID: CVE-2024-8610 State: PUBLISHED Published: 2024-09-09T20:31:05.859Z Last Updated: 2024-09-09T20:38:48.677Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file /index.php?page=tenants of the component New Tenant Page. The manipulation of the argument Last Name/First Name/Middle Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Addition
ng. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276840 - https://vuldb.com/?ctiid.276840 - https://vuldb.com/?submit.404867 - https://drive.google.com/file/d/1mB2ZNyWJDqJaZZro4qiMqovRO_qo4pss/view?usp=sharing - https://www.sourcecodester.com/
CVE ID: CVE-2024-8611 State: PUBLISHED Published: 2024-09-09T20:31:08.191Z Last Updated: 2024-09-09T20:37:49.158Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of the file ssms.php. The manipulation of the argument customer leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276841 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276841 - https://vuldb.com/?ctiid.276841 - https://vuldb.com/?submit.404875 - https://github.com/elegant228/cve/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2024-8612 State: PUBLISHED Published: 2024-09-20T17:50:21.635Z Last Updated: 2025-11-08T08:56:18.036Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9 Problem Types: CWE-200 Description: A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has b
te_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-8612 - https://bugzilla.redhat.com/show_bug.cgi?id=2313760 - https://gitlab.com/qemu-project/qemu/-/commit/637b0aa139565cb82a7b9269e62214f87082635c
CVE ID: CVE-2024-8613 State: PUBLISHED Published: 2025-03-20T10:11:38.821Z Last Updated: 2025-10-15T12:49:57.004Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-639 Description: A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and lack of access control mechanisms, enabling attackers to view and manipulate chat histories of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/76258774-b011-4044-9c
users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/76258774-b011-4044-9c3d-c2609b1cbd29 - https://github.com/gaizhenbiao/chuanhuchatgpt/commit/526c615c437377ee9c71f866fd0f19011910f705
CVE ID: CVE-2024-8614 State: PUBLISHED Published: 2024-11-06T08:29:56.913Z Last Updated: 2024-11-06T14:19:30.345Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856 Products: JobSearch WP Job Board Problem Types: CWE-434 Description: The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload() function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's s
for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7832f8fe-2b41-4cfb-a734-db4ec88d91a3?source=cve - https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856
CVE ID: CVE-2024-8615 State: PUBLISHED Published: 2024-11-06T08:29:57.642Z Last Updated: 2024-11-06T14:32:58.391Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856 Products: JobSearch WP Job Board Problem Types: CWE-434 Description: The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_excel_file_callback() function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make re
akes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd718d44-4921-4deb-af5a-43e5f3926914?source=cve - https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856
CVE ID: CVE-2024-8616 State: PUBLISHED Published: 2025-03-20T10:10:20.480Z Last Updated: 2025-03-20T18:23:06.601Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-73 Description: In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system. Additional Analyst Notes: - CISA ADP
ils. This can lead to overwriting files at arbitrary locations on the host system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/aebf69a5-b9b1-4d2f-a8ff-902c11a8c97a
CVE ID: CVE-2024-8617 State: PUBLISHED Published: 2025-05-15T20:07:16.444Z Last Updated: 2025-05-17T03:08:13.720Z Vendors: Unknown Products: Quiz Maker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ba6b6b82-6f21-45ff-bd64-685ea8ae1b82/
CVE ID: CVE-2024-8618 State: PUBLISHED Published: 2025-05-15T20:07:16.640Z Last Updated: 2025-05-20T18:45:53.100Z Vendors: Unknown Products: Page Builder: Pagelayer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/acddcf33-0a18-499e-b42d-c8b49f2c4de5/
CVE ID: CVE-2024-8619 State: PUBLISHED Published: 2025-05-15T20:07:16.841Z Last Updated: 2025-05-20T18:46:01.991Z Vendors: Unknown Products: Ajax Search Lite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/84f6733e-028a-4288-b01a-7578a4a89dbe/
CVE ID: CVE-2024-8620 State: PUBLISHED Published: 2025-05-15T20:07:17.028Z Last Updated: 2025-05-20T18:46:10.893Z Vendors: Unknown Products: MapPress Maps for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d8b0ddd8-0380-4185-aa00-8437e2b617ad/
CVE ID: CVE-2024-8621 State: PUBLISHED Published: 2024-09-25T02:05:17.822Z Last Updated: 2024-09-25T13:45:29.941Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: mmrs151 Products: Daily Prayer Time Problem Types: CWE-89 Description: The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'max_word' attribute of the 'quran_verse' shortcode in all versions up to, and including, 2024.08.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries
akes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/866e4bc3-080a-4498-b210-e692d72d3db0?source=cve - https://plugins.trac.wordpress.org/browser/daily-prayer-time-for-mosques/tags/2024.08.26/Models/QuranADay/QuranDB.php#L72 - https://plugins.trac.wordpress.org/changeset/3151906/
CVE ID: CVE-2024-8622 State: PUBLISHED Published: 2024-09-12T08:30:45.472Z Last Updated: 2024-09-12T13:08:52.641Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: martynasma Products: amCharts: Charts and Maps Problem Types: CWE-79 Description: The amCharts: Charts and Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'amcharts_javascript' parameter in all versions up to, and including, 1.4.4 due to the ability to supply arbitrary JavaScript a lack of nonce validation on the preview functionality. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully
t possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3593e8-3840-4db0-8269-61bbcb50d569?source=cve - https://plugins.trac.wordpress.org/browser/amcharts-charts-and-maps/tags/1.4.4/includes/preview.php - https://plugins.trac.wordpress.org/changeset/3150041/
CVE ID: CVE-2024-8623 State: PUBLISHED Published: 2024-09-24T02:31:02.434Z Last Updated: 2024-09-24T15:37:09.621Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: realmag777 Products: MDTF – Meta Data and Taxonomies Filter Problem Types: CWE-94 Description: The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CI
de. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba584e02-5242-4869-a452-21e6b8995bd8?source=cve - https://plugins.trac.wordpress.org/browser/wp-meta-data-filter-and-taxonomy-filter/trunk/classes/page.php#L248 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3150646%40wp-meta-data-filter-and-taxonomy-filter&new=3150646%40wp-meta-data-filter-and-taxonomy-filter&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8624 State: PUBLISHED Published: 2024-09-24T02:31:01.927Z Last Updated: 2024-09-24T13:49:16.255Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: realmag777 Products: MDTF – Meta Data and Taxonomies Filter Problem Types: CWE-89 Description: The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_select_title' shortcode in all versions up to, and including, 1.3.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level acce
t preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8f50812a-c6a7-4bb3-9833-e10acd0460c0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153150%40wp-meta-data-filter-and-taxonomy-filter&new=3153150%40wp-meta-data-filter-and-taxonomy-filter&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8625 State: PUBLISHED Published: 2024-10-21T06:00:04.800Z Last Updated: 2024-10-21T19:16:49.924Z Vendors: Unknown Products: TS Poll Problem Types: CWE-89 SQL Injection Description: The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ab4d7065-4ea2-4233-9593-0f540f91f45e/
CVE ID: CVE-2024-8626 State: PUBLISHED Published: 2024-10-08T16:35:04.513Z Last Updated: 2024-10-08T17:36:25.719Z Vendors: Rockwell Automation Products: CompactLogix 5380 controllers, Compact GuardLogix® 5380 controllers, CompactLogix 5480 controllers, GuardLogix 5580 controllers, 1756-EN4TR Problem Types: CWE-400 Description: Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain web pages of the product causing the affected products to become fully unavailable and require a power cycle to recover. Additional Analyst Notes: - CISA ADP Vulnrichmen
ducts to become fully unavailable and require a power cycle to recover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1706.html
CVE ID: CVE-2024-8627 State: PUBLISHED Published: 2024-10-30T02:32:18.834Z Last Updated: 2024-10-30T13:02:31.221Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: josh401 Products: Ultimate TinyMCE Problem Types: CWE-79 Description: The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes
ect arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ddd9cab-f381-4343-a2e6-ef8a1be2ed4e?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-tinymce/trunk/admin_functions.php#L81