Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2027 State: PUBLISHED Published: 2024-04-09T18:58:52.514Z Last Updated: 2024-08-01T18:56:22.513Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devowl Products: Real Media Library: Media Library Folder & File Manager Problem Types: CWE-20 Improper Input Validation Description: The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style attributes in all versions up to, and including, 4.22.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scri
ping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67a44d4c-da3f-4c3d-997b-1417c6906a9c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3050229%40real-media-library-lite%2Ftrunk&old=3041112%40real-media-library-lite%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2028 State: PUBLISHED Published: 2024-03-13T15:27:17.490Z Last Updated: 2024-08-01T18:56:22.690Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: timstrifler Products: Exclusive Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Covid-19 Stats Widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to
on and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d44ecf8a-d19a-403a-96c7-89e223a5cc22?source=cve - https://plugins.trac.wordpress.org/changeset/3042217/exclusive-addons-for-elementor
CVE ID: CVE-2024-2029 State: PUBLISHED Published: 2024-04-10T17:08:05.727Z Last Updated: 2024-08-01T18:56:22.784Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mudler Products: mudler/localai Problem Types: CWE-78 Description: A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing them to ffmpeg via a shell command, allowing an attacker to execute arbitrary commands on the host system. Successful exploitation could
a a shell command, allowing an attacker to execute arbitrary commands on the host system. Successful exploitation could lead to unauthorized access, data breaches, or other detrimental impacts, depending on the privileges of the process executing the code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/e092528a-ce3b-4e66-9b98-3f56d6b276b0 - https://github.com/mudler/localai/commit/31a4c9c9d3abc58de2bdc5305419181c8b33eb1c
CVE ID: CVE-2024-2030 State: PUBLISHED Published: 2024-03-13T15:27:13.560Z Last Updated: 2024-08-01T18:56:22.681Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: crmperks Products: Database for Contact Form 7, WPforms, Elementor forms Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authe
due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4528b63-8d8e-44a4-a71f-2ad1636ac93c?source=cve - https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/templates/leads-table.php - https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php - https://plugins.trac.
- https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php - https://plugins.trac.wordpress.org/changeset/3046066/
CVE ID: CVE-2024-2031 State: PUBLISHED Published: 2024-03-12T19:32:29.141Z Last Updated: 2024-08-01T18:56:22.559Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: j_3rk Products: Video Conferencing with Zoom Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meeting' shortcode in all versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers w
input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/06e48355-6932-4401-8787-e6432444930f?source=cve - https://plugins.trac.wordpress.org/changeset/3048838/video-conferencing-with-zoom-api/trunk/includes/Shortcodes/Recordings.php
CVE ID: CVE-2024-2032 State: PUBLISHED Published: 2024-06-06T18:49:18.482Z Last Updated: 2024-08-01T18:56:22.635Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-366 Description: A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes
tion requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/6199cd5d-611f-4ea9-96c5-52a952ba5a56 - https://github.com/zenml-io/zenml/commit/afcaf741ef9114c9b32f722f101b97de3d8d147b
CVE ID: CVE-2024-2033 State: PUBLISHED Published: 2024-04-09T18:58:30.782Z Last Updated: 2024-08-01T18:56:23.018Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: j_3rk Products: Video Conferencing with Zoom Problem Types: CWE-862 Missing Authorization Description: The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the get_assign_host_id AJAX action. This makes it possible for authenticated attackers, with subscriber access or higher, to enumerate usernames, emails and IDs of all users on a site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program C
ate usernames, emails and IDs of all users on a site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0966057b-8a3c-4d3c-84cb-cf36f1d97922?source=cve - https://plugins.trac.wordpress.org/changeset/3054964/video-conferencing-with-zoom-api/trunk?contextall=1&old=3048839&old_path=%2Fvideo-conferencing-with-zoom-api%2Ftrunk
CVE ID: CVE-2024-2035 State: PUBLISHED Published: 2024-06-06T18:25:00.141Z Last Updated: 2025-10-21T14:13:36.235Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-862 Description: An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is sig
ivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/1cfc6493-082e-4229-9f2f-496801a6557c - https://github.com/zenml-io/zenml/commit/b95f083efffa56831cd41d8ed536aeb0b6038fa3
CVE ID: CVE-2024-2036 State: PUBLISHED Published: 2024-05-22T08:31:21.914Z Last Updated: 2024-08-01T18:56:22.890Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: farhannoor Products: ApplyOnline – Application Form Builder and Manager Problem Types: CWE-862 Missing Authorization Description: The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the aol_modal_box AJAX action in all versions up to, and including, 2.6. This makes it possible for authenticated attackers, with subscriber access or higher, to view Application submissions. Additional Analyst Notes
for authenticated attackers, with subscriber access or higher, to view Application submissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3eff4992-dbd4-4b9b-872e-1670ce7dab9d?source=cve - https://wordpress.org/plugins/apply-online/
CVE ID: CVE-2024-2037 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:59.536Z Description: No description available.
CVE ID: CVE-2024-2038 State: PUBLISHED Published: 2024-05-23T06:46:02.833Z Last Updated: 2024-08-01T18:56:22.827Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: wpfeedback Products: Visual Website Collaboration, Feedback & Project Management – Atarim Problem Types: CWE-259 Use of Hard-coded Password Description: The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.22.6. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to modify plugin settings, d
nticate all the incoming API requests. This makes it possible for unauthenticated attackers to modify plugin settings, delete posts, modify post titles, and upload images. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29532f4d-e830-4c99-ad77-076eebbbe98d?source=cve - https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/3.18/inc/wpf_api.php - https://plugins.trac.wordpress.org/changeset?old=3076514&old_path=atarim-visual-collaboration%2Ftrunk%2Fatarim-visual-collaboration.php&new=3090249&new_path=atarim-visual-collaboration%2Ftrunk%2Fatarim-visual-collaboration.php
CVE ID: CVE-2024-2039 State: PUBLISHED Published: 2024-04-09T18:59:27.171Z Last Updated: 2024-08-01T19:03:37.811Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bfintal Products: Stackable – Page Builder Gutenberg Blocks Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post(v2) block title tag in all versions up to, and including, 3.12.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated atta
icient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/daa30b1b-cb8f-43fd-8329-c64b4024408f?source=cve - https://plugins.trac.wordpress.org/changeset/3058710/stackable-ultimate-gutenberg-blocks/tags/3.12.12/src/deprecated/v2/block/blog-posts/index.php?old=3037996&old_path=stackable-ultimate-gutenberg-blocks/tags/3.12.11/src/deprecat
recated/v2/block/blog-posts/index.php?old=3037996&old_path=stackable-ultimate-gutenberg-blocks/tags/3.12.11/src/deprecated/v2/block/blog-posts/index.php
CVE ID: CVE-2024-2040 State: PUBLISHED Published: 2024-07-03T06:00:02.427Z Last Updated: 2024-08-01T19:03:37.841Z Vendors: Unknown Products: Himer Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1b97bbf0-c7d1-4e6c-bb80-f9bf45fbfe1e/
CVE ID: CVE-2024-2041 State: REJECTED Published: N/A Last Updated: 2024-05-06T13:58:44.268Z Description: No description available.
CVE ID: CVE-2024-2042 State: PUBLISHED Published: 2024-03-16T02:34:27.645Z Last Updated: 2024-08-01T19:03:37.825Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor addons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inj
and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be4ce3e6-8baa-419f-a48e-4256c306fbc1?source=cve - https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.0.4/widgets/image-accordion/image-accordion.php#L962 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050248%40elementskit-lite&new=3050248%40elementskit-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2043 State: PUBLISHED Published: 2024-05-02T16:52:13.126Z Last Updated: 2024-08-01T19:03:37.850Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: cscode Products: EleForms – All In One Form Integration including DB for Elementor Problem Types: CWE-862 Missing Authorization Description: The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when downloading form submissions in all versions up to, and including, 2.9.9.7. This makes it possible for unauthenticated attackers to view form submissions. Additional Analyst Notes: - CISA
.9.9.7. This makes it possible for unauthenticated attackers to view form submissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6a40ed3c-1f4b-4bf7-b6f4-fc1e145cc989?source=cve - https://plugins.trac.wordpress.org/browser/all-contact-form-integration-for-elementor/trunk/includes/export_csv.php#L14 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3056456%40all-contact-form-integration-for-elementor%2Ftrunk&old=3021680%40all-contact-form-integration-for-elementor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2044 State: PUBLISHED Published: 2024-03-07T20:48:10.066Z Last Updated: 2025-02-13T17:32:31.782Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: pgadmin.org Products: pgAdmin 4 Description: pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
load pickle objects, deserialize them, and gain code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pgadmin-org/pgadmin4/issues/7258 - https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/
CVE ID: CVE-2024-2045 State: PUBLISHED Published: 2024-02-29T23:37:37.339Z Last Updated: 2025-05-19T16:56:56.891Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Session Products: Session Problem Types: CWE-22 Description: Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fluidattacks.com/advisories/newman/ - https://github.com/oxen-io/session-android/
CVE ID: CVE-2024-2047 State: PUBLISHED Published: 2024-03-30T04:31:07.657Z Last Updated: 2024-08-09T19:11:58.646Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: xpeedstudio Products: ElementsKit Elementor addons Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allo
enticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/413e6326-14c6-4734-8adc-114a7842c574?source=cve - https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.0.5/widgets/testimonial/testimonial.php#L2458 - https://plugins.trac.wordpress.org/changese
wser/elementskit-lite/tags/3.0.5/widgets/testimonial/testimonial.php#L2458 - https://plugins.trac.wordpress.org/changeset/3054091/elementskit-lite/tags/3.0.7/widgets/testimonial/testimonial.php
CVE ID: CVE-2024-2048 State: PUBLISHED Published: 2024-03-04T19:56:47.253Z Last Updated: 2025-02-13T17:32:32.417Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-295 Description: Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ed in Vault 1.15.5 and 1.14.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382 - https://security.netapp.com/advisory/ntap-20240524-0009/
CVE ID: CVE-2024-2049 State: PUBLISHED Published: 2024-03-12T12:39:45.077Z Last Updated: 2025-04-15T15:26:57.364Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Citrix Products: Citrix SD-WAN Standard/Premium Editions Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX617071/citrix-sdwan-security-bulletin-for-cve20242049
CVE ID: CVE-2024-2050 State: PUBLISHED Published: 2024-03-18T16:04:57.375Z Last Updated: 2024-08-01T19:03:37.851Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Schneider Electric, Schneider Electric Products: Easergy T200 (Modbus) Models: T200I, T200E, T200P, T200S, T200H , Easergy T200 (IEC104) Models: T200I, T200E, T200P, T200S, T200H, Easergy T200 (DNP3) Models: T200I, T200E, T200P, T200S, T200H Problem Types: CWE-79 Description: CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an attacker injects then executes arbitrary malicious JavaScript code within the context of the product. Addit
ists when an attacker injects then executes arbitrary malicious JavaScript code within the context of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-072-01.pdf