Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1300 State: PUBLISHED Published: 2024-04-02T07:33:05.215Z Last Updated: 2025-11-07T10:49:15.550Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: Red Hat Products: CEQ 3.2, Cryostat 2 on RHEL 8, Migration Toolkit for Runtimes 1 on RHEL 8, MTA-6.2-RHEL-9, Red Hat AMQ Streams 2.7.0, Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2, Red Hat build of Quarkus 3.2.11.Final, RHINT Service Registry 2.5.11 GA, A-MQ Clients 2, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat build of Apache Camel for Spring Boot 3, Red Hat Build of Keycloak, Red Hat build of OptaPlanner 8, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat
uild of Keycloak, Red Hat build of OptaPlanner 8, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Integration Camel K 1, Red Hat Integration Camel Quarkus 2, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Process Automation 7 Problem Types: CWE-401 Description: A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached i
NI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1662 - https://access.redhat.com/errata/RHSA-2024:1706 - https://access.redhat.com/errata/RHSA-2024:1923 - https://access.redhat.com/errata/RHSA-2024:2088 - https://access.redhat.com/errata/RHSA-2024:2833 - https://access.redhat.com/errata/RHSA-2024:3527 - https://access
088 - https://access.redhat.com/errata/RHSA-2024:2833 - https://access.redhat.com/errata/RHSA-2024:3527 - https://access.redhat.com/errata/RHSA-2024:3989 - https://access.redhat.com/errata/RHSA-2024:4884 - https://access.redhat.com/security/cve/CVE-2024-1300 - https://bugzilla.redhat.com/show_bug.cgi?id=2263139 - https://vertx.io/docs/vertx-core/java/#_server_name_indication_sni.
CVE ID: CVE-2024-1301 State: PUBLISHED Published: 2024-03-12T15:24:43.061Z Last Updated: 2024-08-12T14:48:20.912Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Badger Meter Products: Monitool Problem Types: CWE-89 Description: SQL injection vulnerability in Badger Meter Monitool affecting versions 4.6.3 and earlier. A remote attacker could send a specially crafted SQL query to the server via the j_username parameter and retrieve the information stored in the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monit
hment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool
CVE ID: CVE-2024-1302 State: PUBLISHED Published: 2024-03-12T15:26:52.926Z Last Updated: 2024-08-12T14:51:12.959Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Badger Meter Products: Monitool Problem Types: CWE-200 Description: Information exposure vulnerability in Badger Meter Monitool affecting versions up to 4.6.3 and earlier. A local attacker could change the application's file parameter to a log file obtaining all sensitive information such as database credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitoo
ner: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool
CVE ID: CVE-2024-1303 State: PUBLISHED Published: 2024-03-12T15:28:31.586Z Last Updated: 2024-08-02T19:52:01.818Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Badger Meter Products: Monitool Problem Types: CWE-22 Description: Incorrectly limiting the path to a restricted directory vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows an authenticated attacker to retrieve any file from the device using the download-file functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabiliti
er: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool
CVE ID: CVE-2024-1304 State: PUBLISHED Published: 2024-03-12T15:31:02.187Z Last Updated: 2024-08-22T20:45:53.513Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Badger Meter Products: Monitool Problem Types: CWE-79 Description: Cross-site scripting vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows a remote attacker to send a specially crafted javascript payload to an authenticated user and partially hijack their browser session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-
- CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool
CVE ID: CVE-2024-1305 State: PUBLISHED Published: 2024-07-08T17:27:44.097Z Last Updated: 2024-08-23T03:55:36.778Z Vendors: OpenVPN Products: tap-windows6, OpenVPN-GUI Problem Types: CWE-190 Description: tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting in a bug check and potentially arbitrary code execution in kernel space Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.openvpn.net/openvpn/wiki/CVE-2024-1305 - https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html
CVE ID: CVE-2024-1306 State: PUBLISHED Published: 2024-04-15T05:00:03.284Z Last Updated: 2024-08-09T20:00:43.921Z Vendors: Unknown Products: Smart Forms Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c7ce2649-b2b0-43f4-994d-07b1023405e9/
CVE ID: CVE-2024-1307 State: PUBLISHED Published: 2024-04-15T05:00:03.590Z Last Updated: 2024-08-09T19:06:05.756Z Vendors: Unknown Products: Smart Forms Problem Types: CWE-862 Missing Authorization Description: The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bbc6cebd-e9bf-4b08-a474-f9312b3c0947/
CVE ID: CVE-2024-1308 State: PUBLISHED Published: 2024-04-09T18:58:44.343Z Last Updated: 2024-08-08T18:33:25.220Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: datafeedrcom Products: WooCommerce Cloak Affiliate Links Problem Types: CWE-284 Improper Access Control Description: The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate li
cated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate links. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c731e39-998e-44d2-8cf9-4d9c39731c5d?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-cloak-affiliate-links/tags/1.0.33/woocommerce-cloak-affiliate-links.php#L396 - https://plugins.trac.wordpress.org/changeset?old_path=/woocommerce-cloak-affiliate-links/tags/1.0.33&old=3055367&new_path=/woocommerce-cloak-affiliate-links/tags/1.0.34&new=3055367&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1309 State: PUBLISHED Published: 2024-02-13T13:41:51.478Z Last Updated: 2024-08-01T18:33:25.383Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Honeywell Products: Niagara Framework Problem Types: CWE-400 Description: Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com - https://www.honeywell.com/us/en/product-security - https://www.kb.cert.org/vuls/id/417980
CVE ID: CVE-2024-1310 State: PUBLISHED Published: 2024-04-15T05:00:03.811Z Last Updated: 2024-10-31T15:14:55.332Z Vendors: Unknown Products: WooCommerce Problem Types: CWE-284 Improper Access Control Description: The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a7735feb-876e-461c-9a56-ea6067faf277/
CVE ID: CVE-2024-1311 State: PUBLISHED Published: 2024-03-13T15:27:18.889Z Last Updated: 2024-08-05T13:32:47.282Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themefusecom Products: Brizy – Page Builder Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all versions up to, and including, 2.4.40. This makes it possible for authenticated attackers, with contributor access or above, to upload arbitrary files on the affected site's server which may make remote code execution pos
ibutor access or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc023c1b-7ec6-45b6-b50a-f0d823065843?source=cve - https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/zip/archiver.php#L254 - https://plugins.trac.wordpress.org/changeset/3034945/brizy/tags/2.4.41/editor/zip/archiver.php
CVE ID: CVE-2024-1312 State: PUBLISHED Published: 2024-02-08T12:38:03.062Z Last Updated: 2024-08-01T18:33:25.383Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot function. This issue could allow a local user to crash the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
w a local user to crash the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-1312 - https://bugzilla.redhat.com/show_bug.cgi?id=2225569 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/mm/memory.c?h=v6.8-rc3&id=657b5146955eba331e01b9a6ae89ce2e716ba306
CVE ID: CVE-2024-1313 State: PUBLISHED Published: 2024-03-26T17:24:25.956Z Last Updated: 2025-02-13T17:27:36.664Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Grafana Products: Grafana Problem Types: CWE-639 Description: It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different or
uestion, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability. This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://grafana.com/security/security-advisories/cve-2024-1313/ - https://security.netapp.com/advisory/ntap-20240524-0008/
CVE ID: CVE-2024-1315 State: PUBLISHED Published: 2024-04-09T18:58:48.332Z Last Updated: 2024-08-01T18:33:25.419Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: techlabpro1 Products: Classified Listing – Classified ads & Business Directory Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing or incorrect nonce validation on the 'rtcl_update_user_account' function. This makes it possible for unauthenticated attackers to change the administ
on the 'rtcl_update_user_account' function. This makes it possible for unauthenticated attackers to change the administrator user's password and email address via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This locks the administrator out of the site and prevents them from resetting their password, while granting the attacker access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5439651e-5557-4b13-813a-4fc0ad876104?source=cve - https://plugins.trac.wordpress.org/browser/classified-listing/tags/3.0.1/app
1e-5557-4b13-813a-4fc0ad876104?source=cve - https://plugins.trac.wordpress.org/browser/classified-listing/tags/3.0.1/app/Controllers/Ajax/PublicUser.php#L445 - https://plugins.trac.wordpress.org/browser/classified-listing/tags/3.0.5/app/Controllers/Ajax/PublicUser.php#L445
CVE ID: CVE-2024-1316 State: PUBLISHED Published: 2024-03-04T21:00:09.876Z Last Updated: 2024-08-28T15:21:35.718Z Vendors: Unknown Products: Event Tickets and Registration, Events Tickets Plus Problem Types: CWE-284 Improper Access Control Description: The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d80dfe2f-207d-4cdf-8c71-27936c6318e5/
CVE ID: CVE-2024-1317 State: PUBLISHED Published: 2024-02-20T18:56:46.572Z Last Updated: 2024-08-01T18:33:25.603Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themeisle Products: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to SQL Injection via the ‘search_key’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied
the ‘search_key’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf57aeaa-e37e-4b22-aeaa-f0a9f4877484?source=cve - https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/4.4.2/includes/admin/feed
eaa-f0a9f4877484?source=cve - https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/4.4.2/includes/admin/feedzy-rss-feeds-import.php#L2623 - https://plugins.trac.wordpress.org/changeset/3033749/feedzy-rss-feeds/tags/4.4.3/includes/admin/feedzy-rss-feeds-admin.php?old=3030538&old_path=feedzy-rss-feeds%2Ftags%2F4.4.2%2Fincludes%2Fadmin%2Ffeedzy-rss-feeds-admin.php
CVE ID: CVE-2024-1318 State: PUBLISHED Published: 2024-02-20T18:56:21.078Z Last Updated: 2025-04-22T16:25:08.275Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: themeisle Products: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Problem Types: CWE-862 Missing Authorization Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions in all versions up to, and including, 4.4.2. This makes it possi
edzy_wizard_step_process' and 'import_status' functions in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with Contributor access and above, who are normally restricted to only being able to create posts rather than pages, to draft and publish posts with arbitrary content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/181edcec-a57d-4516-935d-6777d2de77ae?source=cve - https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/4.4.2/includes/admin/feedzy-rss-feeds-import.php#L1022 - https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds
ags/4.4.2/includes/admin/feedzy-rss-feeds-import.php#L1022 - https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/4.4.2/includes/admin/feedzy-rss-feeds-admin.php#L1053 - https://plugins.trac.wordpress.org/changeset/3033749/feedzy-rss-feeds/tags/4.4.3/includes/admin/feedzy-rss-feeds-admin.php?old=3030538&old_path=feedzy-rss-feeds%2Ftags%2F4.4.2%2Fincludes%2Fadmin%2Ffeedzy-rss-feeds-admin.php
CVE ID: CVE-2024-1319 State: PUBLISHED Published: 2024-03-04T21:00:09.049Z Last Updated: 2025-03-27T16:48:48.662Z Vendors: Unknown Products: Events Tickets Plus Problem Types: CWE-284 Improper Access Control Description: The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/
CVE ID: CVE-2024-1320 State: PUBLISHED Published: 2024-03-09T07:01:09.784Z Last Updated: 2024-08-01T18:33:25.376Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: metagauss Products: EventPrime – Events Calendar, Bookings and Tickets Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'offline_status' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers
3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e82e1c5-0ed4-4dee-9990-976591693eb5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043888%40eventprime-event-calendar-management&new=3043888%40eventprime-event-calendar-management&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1321 State: PUBLISHED Published: 2024-03-13T15:26:56.986Z Last Updated: 2024-08-28T16:07:23.899Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: metagauss Products: EventPrime – Events Calendar, Bookings and Tickets Problem Types: CWE-345 Insufficient Verification of Data Authenticity Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for unauthenticated attackers to book events for free. Additional Analyst Not
of order payments. This makes it possible for unauthenticated attackers to book events for free. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/765d0933-8db2-471c-ad4e-e19d3b4ff015?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033882%40eventprime-event-calendar-management&new=3033882%40eventprime-event-calendar-management&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1322 State: PUBLISHED Published: 2024-02-20T18:56:39.030Z Last Updated: 2024-08-08T18:50:04.943Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpwax Products: Directorist – WordPress Business Directory Plugin with Classified Ads Listings Problem Types: CWE-862 Missing Authorization Description: The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and ena