Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279363 - https://vuldb.com/?ctiid.279363 - https://vuldb.com/?submit.413915 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetEnableWizard.md - https://www.dlink.com/
CVE ID: CVE-2024-9557 State: PUBLISHED Published: 2024-10-06T16:31:04.928Z Last Updated: 2024-10-07T13:49:13.141Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formSetWanPPPoE of the file /goform/formSetWanPPPoE. The manipulation of the argument webpage leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279364 - https://vuldb.com/
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279364 - https://vuldb.com/?ctiid.279364 - https://vuldb.com/?submit.413916 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetWanPPPoE.md - https://www.dlink.com/
CVE ID: CVE-2024-9558 State: PUBLISHED Published: 2024-10-06T18:00:07.916Z Last Updated: 2024-10-07T13:49:05.009Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formSetWanPPTP of the file /goform/formSetWanPPTP. The manipulation of the argument webpage leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279365 - https://vuldb.com/?ctiid.279365 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279365 - https://vuldb.com/?ctiid.279365 - https://vuldb.com/?submit.413917 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetWanPPTP.md - https://www.dlink.com/
CVE ID: CVE-2024-9559 State: PUBLISHED Published: 2024-10-06T18:31:05.056Z Last Updated: 2024-10-07T13:48:57.970Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formWlanSetup of the file /goform/formWlanSetup. The manipulation of the argument webpage leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279366 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279366 - https://vuldb.com/?ctiid.279366 - https://vuldb.com/?submit.413919 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formWlanSetup.md - https://www.dlink.com/
CVE ID: CVE-2024-9560 State: PUBLISHED Published: 2024-10-06T22:00:09.138Z Last Updated: 2024-10-07T17:00:45.093Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is the function delCatelogs of the file /CDGServer3/document/Catelogs;logindojojs?command=DelCatelogs. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279368 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279368 - https://vuldb.com/?ctiid.279368 - https://vuldb.com/?submit.414475 - https://flowus.cn/share/38f64855-27ec-4170-ac78-f29ca595901e?code=G8A6P3
CVE ID: CVE-2024-9561 State: PUBLISHED Published: 2024-10-06T22:31:05.077Z Last Updated: 2024-10-07T13:48:51.140Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetWAN_Wizard51/formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279369 - https://vuldb.com/?ctiid.279369 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279369 - https://vuldb.com/?ctiid.279369 - https://vuldb.com/?submit.413920 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetWAN_Wizard.md - https://www.dlink.com/
CVE ID: CVE-2024-9562 State: PUBLISHED Published: 2024-10-06T23:00:08.085Z Last Updated: 2024-10-07T13:48:44.119Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability classified as critical was found in D-Link DIR-605L 2.13B01 BETA. This vulnerability affects the function formSetWizard1/formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279370 - https://vuldb.com/?ctiid.279370 - https://vuldb.c
- CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279370 - https://vuldb.com/?ctiid.279370 - https://vuldb.com/?submit.413921 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetWizard.md - https://www.dlink.com/
CVE ID: CVE-2024-9563 State: PUBLISHED Published: 2024-10-06T23:31:05.178Z Last Updated: 2024-10-07T13:46:31.187Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. This issue affects the function formWlanSetup_Wizard of the file /goform/formWlanSetup_Wizard. The manipulation of the argument webpage leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279371 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279371 - https://vuldb.com/?ctiid.279371 - https://vuldb.com/?submit.413922 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formWlanSetup_Wizard.md - https://www.dlink.com/
CVE ID: CVE-2024-9564 State: PUBLISHED Published: 2024-10-07T00:00:07.351Z Last Updated: 2024-10-07T13:39:02.091Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. Affected is the function formWlanWizardSetup of the file /goform/formWlanWizardSetup. The manipulation of the argument webpage leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279372 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279372 - https://vuldb.com/?ctiid.279372 - https://vuldb.com/?submit.413923 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formWlanWizardSetup.md - https://www.dlink.com/
CVE ID: CVE-2024-9565 State: PUBLISHED Published: 2024-10-07T00:31:04.727Z Last Updated: 2024-10-07T13:34:16.177Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. Affected by this vulnerability is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279373 - https://vuld
ay be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279373 - https://vuldb.com/?ctiid.279373 - https://vuldb.com/?submit.413924 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetPassword.md - https://www.dlink.com/
CVE ID: CVE-2024-9566 State: PUBLISHED Published: 2024-10-07T13:00:07.587Z Last Updated: 2024-10-07T13:25:20.194Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. This vulnerability affects the function formDeviceReboot of the file /goform/formDeviceReboot. The manipulation of the argument next_page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279460 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279460 - https://vuldb.com/?ctiid.279460 - https://vuldb.com/?submit.414541 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formDeviceReboot.md - https://www.dlink.com/
CVE ID: CVE-2024-9567 State: PUBLISHED Published: 2024-10-07T13:31:05.598Z Last Updated: 2024-10-07T14:02:12.770Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. This issue affects the function formAdvFirewall of the file /goform/formAdvFirewall. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279461 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279461 - https://vuldb.com/?ctiid.279461 - https://vuldb.com/?submit.414544 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formAdvFirewall.md - https://www.dlink.com/
CVE ID: CVE-2024-9568 State: PUBLISHED Published: 2024-10-07T14:31:05.723Z Last Updated: 2024-10-07T20:33:46.888Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formAdvNetwork of the file /goform/formAdvNetwork. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279462 - https://vuldb.com/?ctiid.2
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279462 - https://vuldb.com/?ctiid.279462 - https://vuldb.com/?submit.414545 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formAdvNetwork.md - https://www.dlink.com/
CVE ID: CVE-2024-9569 State: PUBLISHED Published: 2024-10-07T15:00:08.131Z Last Updated: 2024-10-07T19:14:48.704Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formEasySetPassword of the file /goform/formEasySetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279463 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279463 - https://vuldb.com/?ctiid.279463 - https://vuldb.com/?submit.414547 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formEasySetPassword.md - https://www.dlink.com/
CVE ID: CVE-2024-9570 State: PUBLISHED Published: 2024-10-07T15:31:05.012Z Last Updated: 2024-10-07T18:51:36.291Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279464 - https://vuldb.com/?
sed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279464 - https://vuldb.com/?ctiid.279464 - https://vuldb.com/?submit.414548 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formEasySetTimezone.md - https://www.dlink.com/
CVE ID: CVE-2024-9571 State: PUBLISHED Published: 2024-10-07T14:44:40.575Z Last Updated: 2025-03-27T10:48:47.566Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affecting multiple parameters. This could allow a remote user to send a specially crafted query to an authenticated user and partially take control of their browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notice
er session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-soplanning
CVE ID: CVE-2024-9572 State: PUBLISHED Published: 2024-10-07T14:46:03.718Z Last Updated: 2025-03-27T10:49:17.391Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in the groupe_id parameter. This could allow a remote user to send a specially crafted query to an authenticated user and steal their session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnera
nalyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-soplanning
CVE ID: CVE-2024-9573 State: PUBLISHED Published: 2024-10-07T14:47:25.472Z Last Updated: 2025-03-27T10:49:30.718Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-89 Description: SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-soplanning
CVE ID: CVE-2024-9574 State: PUBLISHED Published: 2024-10-07T14:48:41.344Z Last Updated: 2025-03-27T10:49:47.044Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-89 Description: SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-soplanning
CVE ID: CVE-2024-9575 State: PUBLISHED Published: 2024-10-09T09:40:44.656Z Last Updated: 2025-01-09T17:31:07.612Z Vendors: rami.io GmbH Products: pretix Widget WordPress plugin Problem Types: CWE-22, CWE-73 Description: Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pretix.eu/about/en/blog/20241009-wordpress-plugin-1-0-6/ - https://patchstack.com/database/vulnerability/pretix-widget/wordpress-pretix-widget-plugin-1-0-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-9576 State: PUBLISHED Published: 2024-10-07T14:28:12.780Z Last Updated: 2024-10-07T18:11:41.787Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Workbooth Products: Linux Workbooth Problem Types: CWE-284 Description: Vulnerability in Distro Linux Workbooth v2.5 that allows to escalate privileges to the root user by manipulating the network configuration script. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/improper-access-control-linux-workbooth-distro
CVE ID: CVE-2024-9578 State: PUBLISHED Published: 2024-11-13T02:02:29.677Z Last Updated: 2024-11-13T15:51:09.459Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: egolacrima Products: Hide Links Problem Types: CWE-862 Description: The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_text filter in all versions up to and including 1.4.2. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4198
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4198bbb2-3aff-492e-a781-b0c9477baf6c?source=cve - https://plugins.trac.wordpress.org/browser/hide-links/trunk/class.hidelinks.php#L21
CVE ID: CVE-2024-9579 State: PUBLISHED Published: 2024-11-05T16:22:01.465Z Last Updated: 2024-11-05T19:32:25.537Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HP, Inc. Products: Certain Poly Video Conference Devices Problem Types: CWE-77 Description: A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11536495-11536533-16/hpsbpy03900
CVE ID: CVE-2024-9580 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:04:58.704Z Description: No description available.
CVE ID: CVE-2024-9581 State: PUBLISHED Published: 2024-10-10T02:06:09.396Z Last Updated: 2024-10-10T16:18:14.848Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: happyplugins Products: Shortcodes AnyWhere Problem Types: CWE-94 Description: The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
ated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e289b06-66c8-4d50-a8f7-e07c5ae8f7c8?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-anywhere/trunk/core/shortcodeEverywhere.class.php#L15
CVE ID: CVE-2024-9582 State: PUBLISHED Published: 2024-10-16T06:43:37.406Z Last Updated: 2024-10-16T14:09:41.287Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bqworks Products: Accordion Slider Problem Types: CWE-79 Description: The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in all versions up to, and including, 1.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Successful exploitation by Contributor-level users requires an Administrator-level user to provide access to the plugin's admin area via the `Access` plugin setting, which is restricted to administrators by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/94f19f56-0667-443e-8545-a17fbe9c3ddb?source=cve - https://plugins.trac.wordpress.org/changeset/3166480/accordion-slider
CVE ID: CVE-2024-9583 State: PUBLISHED Published: 2024-10-23T06:45:05.657Z Last Updated: 2024-10-23T13:31:48.353Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: jeangalea Products: RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Problem Types: CWE-862 Description: The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the wprss_ajax_send_premium_support function in all versions up to, and including, 4.23.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send
including, 4.23.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send premium support requests with an attacker-controlled subject line and email address to support allowing them to impersonate the site owner. License information may also be leaked. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/126c77fa-11c5-431f-8fc9-0375ed6c8a91?source=cve - https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/admin-help.php#L274 - https://plugins.trac.wordpress.org/changeset/3168468/wp-rss-aggregator/trunk/includes/admin-help.php