Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11964 State: PUBLISHED Published: 2024-11-28T17:00:11.627Z Last Updated: 2024-11-29T16:35:09.415Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Complaint Management system Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management system 1.0. This affects an unknown part of the file /user/index.php. The manipulation of the argument emailid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2863
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286347 - https://vuldb.com/?ctiid.286347 - https://vuldb.com/?submit.452471 - https://github.com/Aurora0x1/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2024-11965 State: PUBLISHED Published: 2024-11-28T17:00:15.264Z Last Updated: 2024-11-29T16:32:31.199Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Complaint Management system Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Complaint Management system 1.0 and classified as critical. This vulnerability affects unknown code of the file /user/reset-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
ed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286348 - https://vuldb.com/?ctiid.286348 - https://vuldb.com/?submit.452472 - https://github.com/Aurora0x1/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2024-11966 State: PUBLISHED Published: 2024-11-28T17:31:06.291Z Last Updated: 2024-11-29T16:10:17.318Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Complaint Management system Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Complaint Management system 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286349
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286349 - https://vuldb.com/?ctiid.286349 - https://vuldb.com/?submit.452476 - https://github.com/Aurora0x1/CVE/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2024-11967 State: PUBLISHED Published: 2024-11-28T18:00:14.034Z Last Updated: 2024-11-29T16:07:10.052Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Complaint Management system Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Complaint Management system 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/reset-password.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286350 - https://vuldb.com/?ctiid.286350 - https://vuldb.com/?submit.452477 - https://github.com/Aurora0x1/CVE/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2024-11968 State: PUBLISHED Published: 2024-11-28T18:00:17.415Z Last Updated: 2024-11-29T15:08:29.281Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Farmacia Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Farmacia up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file pagamento.php. The manipulation of the argument notaFiscal leads to sql injection. The attack can be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286351 - https://vuldb.com/?ctiid.286351 - https://vuldb.com/?submit.4528
nrichment: References: - https://vuldb.com/?id.286351 - https://vuldb.com/?ctiid.286351 - https://vuldb.com/?submit.452877 - https://github.com/xiaobai19198/cve/blob/main/sql-cve.md - https://code-projects.org/
CVE ID: CVE-2024-11969 State: PUBLISHED Published: 2024-11-28T15:41:18.730Z Last Updated: 2024-11-29T17:12:06.797Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Cradlepoint Products: NetCloud Exchange Client Problem Types: CWE-276 Description: The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal (non-admin) user could exploit the weakness in file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control permissions exist on the ‘Everyone’ group (i.e. any user who has local ac
hine. It has been identified that full control permissions exist on the ‘Everyone’ group (i.e. any user who has local access to the operating system regardless of their privileges). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-default-permissions-cradlepoint-netcloud-exchange
CVE ID: CVE-2024-11970 State: PUBLISHED Published: 2024-11-28T22:00:16.258Z Last Updated: 2024-11-29T17:10:18.428Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Concert Ticket Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Concert Ticket Ordering System 1.0. Affected is an unknown function of the file /tour(cor).php. The manipulation of the argument mai leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286380 - https://vuldb.com/?ctiid.286380 - https://vuldb.com/?submit.453376 - https://github.com/halhalz/1/issues/1 - https://code-projects.org/
CVE ID: CVE-2024-11971 State: PUBLISHED Published: 2024-11-28T22:00:18.421Z Last Updated: 2024-11-29T17:08:36.529Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Guizhou Xiaoma Technology Products: jpress Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrich
ed remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286381 - https://vuldb.com/?ctiid.286381 - https://vuldb.com/?submit.453637 - https://github.com/dycccccccc/jpress/blob/main/JPRESS%20file%20upload%20leads%20to%20code%20execution.docx
CVE ID: CVE-2024-11972 State: PUBLISHED Published: 2024-12-31T06:00:01.751Z Last Updated: 2024-12-31T18:14:10.608Z Vendors: Unknown Products: Hunk Companion Problem Types: CWE-862 Missing Authorization Description: The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/
CVE ID: CVE-2024-11973 State: PUBLISHED Published: 2024-12-10T09:24:25.651Z Last Updated: 2024-12-10T15:09:18.561Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: karim42 Products: Quran multilanguage Text & Audio Problem Types: CWE-79 Description: The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sourate' and 'lang' parameter in all versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an act
ckers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/09afbbd2-52c6-48a6-a2f0-b1509d864e7e?source=cve - https://wordpress.org/plugins/quran-text-multilanguage/#developers - https://plugins.trac.wordpress.org/changeset/3203456/
CVE ID: CVE-2024-11974 State: PUBLISHED Published: 2025-01-04T07:24:23.587Z Last Updated: 2025-01-06T16:30:23.934Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dglingren Products: Media Library Assistant Problem Types: CWE-79 Description: The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a
ble for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65f4e5e1-4c2e-4943-aa84-4caa61e14bc2?source=cve - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/examples/plugins/mla-unattached-fixit.php#L177 - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/examples/plugins/woofixit.php#L1391 - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/examples/plugins/smart-media-categories/a
391 - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/examples/plugins/smart-media-categories/admin/includes/class-smc-settings-support.php#L459 - https://wordpress.org/plugins/media-library-assistant/#developers - https://plugins.trac.wordpress.org/changeset/3215759/
CVE ID: CVE-2024-11975 State: PUBLISHED Published: 2024-12-21T07:03:03.025Z Last Updated: 2024-12-28T00:49:57.169Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: reactflow Products: Reactflow Visitor Recording and Heatmaps Problem Types: CWE-352 Description: The Reactflow Visitor Recording and Heatmaps plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.10. This is due to missing or incorrect nonce validation affecting the _wpnonce parameter. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performi
attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb360c56-e144-4dc5-8bfb-715a014cb8e6?source=cve - https://plugins.trac.wordpress.org/browser/reactflow-session-replay-heatmap/tags/1.0.10/reactflow.php#L882 - https://wordpress.org/plugins/reactflow-session-replay-heatmap/#developers
CVE ID: CVE-2024-11977 State: PUBLISHED Published: 2024-12-21T05:31:02.179Z Last Updated: 2024-12-28T00:51:15.868Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: collizo4sky Products: kk Star Ratings – Rate Post & Collect User Feedbacks Problem Types: CWE-94 Description: The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. A
lue before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5dea49fb-2703-4754-9abd-5f4e526d5570?source=cve - https://plugins.trac.wordpress.org/browser/kk-star-ratings/tags/5.4.9/src/core/wp/actions/wp_ajax_kk-star-ratings.php#L84
CVE ID: CVE-2024-11978 State: PUBLISHED Published: 2024-11-29T02:03:22.307Z Last Updated: 2024-12-03T06:06:38.751Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Interinfo Products: DreamMaker Problem Types: CWE-36 Description: DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8269-22a8f-1.html - https://www.twcert.org.tw/en/cp-139-8270-a56e6-2.html
CVE ID: CVE-2024-11979 State: PUBLISHED Published: 2024-11-29T02:12:14.052Z Last Updated: 2024-12-03T06:05:57.385Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Interinfo Products: DreamMaker Problem Types: CAPEC-139 Relative Path Traversal, CWE-434 Description: DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8271-29871-1.html - https://www.twcer
Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8271-29871-1.html - https://www.twcert.org.tw/en/cp-139-8272-13a13-2.html
CVE ID: CVE-2024-11980 State: PUBLISHED Published: 2024-11-29T06:03:04.983Z Last Updated: 2024-11-29T14:40:54.541Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Billion Electric Products: M100, M150, M120N, M500 Problem Types: CWE-306 Description: Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8273-95a07-1.html - https://www.twcert.org.tw/en/cp-1
DP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8273-95a07-1.html - https://www.twcert.org.tw/en/cp-139-8274-01e55-2.html
CVE ID: CVE-2024-11981 State: PUBLISHED Published: 2024-11-29T06:21:31.476Z Last Updated: 2024-11-29T14:31:52.528Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Billion Electric Products: M100, M150, M120N, M500 Problem Types: CWE-288 Description: Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8275-50f42-1.html - https://www.twcert.org.tw/en/cp-139-8276-1defb-2.html
CVE ID: CVE-2024-11982 State: PUBLISHED Published: 2024-11-29T06:45:33.819Z Last Updated: 2024-11-29T14:22:56.724Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Billion Electric Products: M100, M150, M120N, M500 Problem Types: CWE-256 Description: Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8277-88b20-1.html - https://www.twcert.org.tw/en/cp-139-8278-cb581-2.html
CVE ID: CVE-2024-11983 State: PUBLISHED Published: 2024-11-29T06:57:24.047Z Last Updated: 2024-11-29T14:10:39.561Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Billion Electric Products: M100, M150, M120N, M500 Problem Types: CWE-78 Description: Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8279-bf67e-1.html - https://www.twcert.org.tw/en/cp-139-8280-ae6e1-2.html
CVE ID: CVE-2024-11984 State: PUBLISHED Published: 2024-12-19T04:01:05.989Z Last Updated: 2024-12-20T18:01:19.504Z Vendors: SUNNET Technology Co., Ltd. Products: Corporate Training Management System Problem Types: CWE-434 Description: A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2024-10
CVE ID: CVE-2024-11985 State: PUBLISHED Published: 2024-12-04T01:20:10.965Z Last Updated: 2024-12-04T14:09:12.075Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: RT-AX55, RT-AX55 V2, RT-AX56U, RT-AX56U_V2, RT-AX57, RT-AX58U, RT-AX58U V2 Problem Types: CWE-20 Description: An improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2024 ASUS Router Improper Input Validation' section on the ASUS Security Advisory for more information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asus.com/content/asus-product-security-advisory/
CVE ID: CVE-2024-11986 State: PUBLISHED Published: 2024-12-13T13:46:54.204Z Last Updated: 2024-12-13T20:41:28.545Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: CrushFTP, LLC Products: CrushFTP Problem Types: CWE-79 Description: Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://crushftp.com/crush11wiki/Wiki.jsp?page=Update
CVE ID: CVE-2024-11990 State: PUBLISHED Published: 2024-11-29T13:00:57.502Z Last Updated: 2024-11-29T13:25:05.049Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: NetWin Products: SurgeMail Problem Types: CWE-79 Description: A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected into vulnerable parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-netwin-surgemail
CVE ID: CVE-2024-11991 State: PUBLISHED Published: 2024-12-09T14:38:07.288Z Last Updated: 2024-12-09T15:07:37.640Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Internet Computer Products: Motoko Problem Types: CWE-908 Description: Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the Canister to enable the incremental garbage collector or enhanced orthogonal persistence, which are non-default features in Motoko. Additi
e the incremental garbage collector or enhanced orthogonal persistence, which are non-default features in Motoko. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dfinity/motoko/pull/4677 - https://github.com/dfinity/motoko/security/advisories/GHSA-9rhg-3qf8-hrv3
CVE ID: CVE-2024-11992 State: PUBLISHED Published: 2024-11-29T13:06:30.404Z Last Updated: 2024-11-29T13:24:05.020Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Quick.CMS Products: Quick.CMS Problem Types: CWE-22 Description: Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended restrictions and download any file if it has the appropriate permissions outside of documentroot configured on the server via the aDirFiles%5B0%5D parameter in the admin.php page. This vulnerability allows an attacker to delete files stored on the server due to a lack of proper verification of us
e. This vulnerability allows an attacker to delete files stored on the server due to a lack of proper verification of user-supplied input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-quickcms
CVE ID: CVE-2024-11993 State: PUBLISHED Published: 2024-12-17T20:24:42.600Z Last Updated: 2025-03-28T20:04:56.591Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993
CVE ID: CVE-2024-11994 State: PUBLISHED Published: 2025-05-01T13:06:54.194Z Last Updated: 2025-05-01T15:32:54.220Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Elastic Products: APM Server Problem Types: CWE-200 Description: APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclose sensitive information in APM Server error logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/apm-server-8-16-1-security-update-esa-2024-41/377710