Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4806 State: PUBLISHED Published: 2024-05-12T23:31:04.173Z Last Updated: 2024-08-01T20:55:10.029Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Kashipara Products: College Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Kashipara College Management System 1.0. This vulnerability affects unknown code of the file each_extracurricula_activities.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263926 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnr
and may be used. VDB-263926 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263926 - https://vuldb.com/?ctiid.263926 - https://vuldb.com/?submit.332557 - https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System/College%20Management%20System%20-%20vuln%209.pdf
CVE ID: CVE-2024-4807 State: PUBLISHED Published: 2024-05-12T23:31:05.697Z Last Updated: 2024-08-01T20:55:09.629Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Kashipara Products: College Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Kashipara College Management System 1.0. This issue affects some unknown processing of the file delete_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263927. Additional Analyst Notes: - CISA ADP Vu
and may be used. The associated identifier of this vulnerability is VDB-263927. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263927 - https://vuldb.com/?ctiid.263927 - https://vuldb.com/?submit.332564 - https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System/College%20Management%20System%20-%20vuln%2010.pdf
CVE ID: CVE-2024-4808 State: PUBLISHED Published: 2024-05-13T00:00:04.682Z Last Updated: 2024-08-02T15:27:14.306Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Kashipara Products: College Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Kashipara College Management System 1.0. Affected is an unknown function of the file delete_faculty.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263928. Additional Analyst Notes: - CVE Program Container: - CI
may be used. The identifier of this vulnerability is VDB-263928. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.263928 - https://vuldb.com/?ctiid.263928 - https://vuldb.com/?submit.332565 - https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System/College%20Management%20System%20-%20vuln%2011.pdf
CVE ID: CVE-2024-4809 State: PUBLISHED Published: 2024-05-13T00:31:04.237Z Last Updated: 2024-08-01T20:55:10.377Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Open Source Clinic Management System Problem Types: CWE-434 Description: A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file setting.php. The manipulation of the argument logo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263929 was assigned to this vulnerabili
The exploit has been disclosed to the public and may be used. The identifier VDB-263929 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263929 - https://vuldb.com/?ctiid.263929 - https://vuldb.com/?submit.332581 - https://github.com/CveSecLook/cve/issues/26
CVE ID: CVE-2024-4810 State: REJECTED Published: 2024-05-14T01:38:24.420Z Last Updated: 2024-05-29T07:53:24.899Z Description: No description available.
CVE ID: CVE-2024-4811 State: PUBLISHED Published: 2024-07-25T04:46:43.523Z Last Updated: 2025-01-16T06:43:12.488Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Octopus Deploy Products: Octopus Server Problem Types: Access to failed project imports in restricted spaces Description: In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.octopus.com/post/2024/sa2024-05/
CVE ID: CVE-2024-4812 State: PUBLISHED Published: 2024-06-05T15:06:13.886Z Last Updated: 2025-11-20T19:15:48.050Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Satellite 6 Problem Types: CWE-79 Description: A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-4812 - https://bugzilla.redhat.com/show_bug.cgi?id=2280187
CVE ID: CVE-2024-4813 State: PUBLISHED Published: 2024-05-13T10:00:05.023Z Last Updated: 2024-08-01T20:55:10.301Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Ruijie Products: RG-UAC Problem Types: CWE-78 Description: A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Affected is an unknown function of the file /view/networkConfig/physicalInterface/interface_commit.php. The manipulation of the argument name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-263934 is the identifier assigned to thi
blic and may be used. It is recommended to apply a patch to fix this issue. VDB-263934 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263934 - https://vuldb.com/?ctiid.263934 - https://vuldb.com/?submit.330020 - https://github.com/h0e4a0r1t/I_L-HxK-pF-uZ1-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-physicalInterface%3Ainterface_commit.php.pdf
CVE ID: CVE-2024-4814 State: PUBLISHED Published: 2024-05-13T10:00:06.934Z Last Updated: 2024-08-01T20:55:08.805Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Ruijie Products: RG-UAC Problem Types: CWE-78 Description: A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506. Affected by this vulnerability is an unknown functionality of the file /view/networkConfig/RouteConfig/StaticRoute/static_route_edit_commit.php. The manipulation of the argument oldipmask/oldgateway leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-
y. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263935. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263935 - https://vuldb.com/?ctiid.263935 - https://vuldb.com/?submit.330052 - https://github.com/h0e4a0r1t/I_L-HxK-pF-uZ1-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-StaticRoute%3Astatic_route_edit_commit.php.pdf
CVE ID: CVE-2024-4815 State: PUBLISHED Published: 2024-05-13T10:31:03.754Z Last Updated: 2024-08-01T20:55:09.636Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Ruijie Products: RG-UAC Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Affected by this issue is some unknown functionality of the file /view/bugSolve/viewData/detail.php. The manipulation of the argument filename leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263936. NOTE: The vendor was contacted early about
e public and may be used. The identifier of this vulnerability is VDB-263936. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263936 - https://vuldb.com/?ctiid.263936 - https://vuldb.com/?submit.329966 - https://github.com/h0e4a0r1t/I_L-HxK-pF-uZ1-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-view_bugSolve_viewData_detail.php.pdf
CVE ID: CVE-2024-4816 State: PUBLISHED Published: 2024-05-13T12:31:07.409Z Last Updated: 2024-08-01T20:55:08.771Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Ruijie Products: RG-UAC Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506. This affects an unknown part of the file /view/networkConfig/GRE/gre_add_commit.php. The manipulation of the argument name/remote/local/IP leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263937 was assigned to this vulnerability. NOTE: The vendor was contacted
the public and may be used. The identifier VDB-263937 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263937 - https://vuldb.com/?ctiid.263937 - https://vuldb.com/?submit.329953 - https://github.com/h0e4a0r1t/I_L-HxK-pF-uZ1-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-gre_add_commit.php.pdf
CVE ID: CVE-2024-4817 State: PUBLISHED Published: 2024-05-13T12:31:08.754Z Last Updated: 2024-08-01T20:55:09.982Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Laundry Management System Problem Types: CWE-99 Description: A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file manage_user.php of the component HTTP Request Parameter Handler. The manipulation of the argument id leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263938 is the identi
attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263938 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263938 - https://vuldb.com/?ctiid.263938 - https://vuldb.com/?submit.333055 - https://github.com/yylmm/CVE/blob/main/Online%20Laundry%20Management%20System/IDOR_manage_user.md
CVE ID: CVE-2024-4818 State: PUBLISHED Published: 2024-05-13T13:00:05.975Z Last Updated: 2024-08-01T20:55:09.305Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Campcodes Products: Online Laundry Management System Problem Types: CWE-73 Description: A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263939. Additional Analy
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263939. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263939 - https://vuldb.com/?ctiid.263939 - https://vuldb.com/?submit.333057 - https://github.com/yylmm/CVE/blob/main/Online%20Laundry%20Management%20System/LFI.md
CVE ID: CVE-2024-4819 State: PUBLISHED Published: 2024-05-13T13:31:04.420Z Last Updated: 2024-08-01T20:55:09.987Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Campcodes Products: Online Laundry Management System Problem Types: CWE-285 Description: A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file admin_class.php. The manipulation of the argument type with the input 1 leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VD
ttack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263940. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263940 - https://vuldb.com/?ctiid.263940 - https://vuldb.com/?submit.333058 - https://github.com/yylmm/CVE/blob/main/Online%20Laundry%20Management%20System/IDOR.md
CVE ID: CVE-2024-4820 State: PUBLISHED Published: 2024-05-13T14:00:05.088Z Last Updated: 2024-08-01T20:55:10.329Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Computer and Laptop Store Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/SystemSettings.php?f=update_settings. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263941 was assigned to this vuln
otely. The exploit has been disclosed to the public and may be used. The identifier VDB-263941 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263941 - https://vuldb.com/?ctiid.263941 - https://vuldb.com/?submit.333272 - https://github.com/jxm68868/cve/blob/main/upload.md
CVE ID: CVE-2024-4821 State: PUBLISHED Published: 2024-06-05T08:33:16.794Z Last Updated: 2024-08-01T20:55:09.988Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentica
o insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7649da-5358-4fe2-8706-b945bba02c93?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.1.5/includes/shortcodes/lightbox.php#L71 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3096024%40shortcodes-ultimate%
hp#L71 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3096024%40shortcodes-ultimate%2Ftrunk&old=3084162%40shortcodes-ultimate%2Ftrunk&sfp_email=&sfph_mail=#file1
CVE ID: CVE-2024-4822 State: PUBLISHED Published: 2024-05-13T11:26:27.512Z Last Updated: 2024-08-01T20:55:10.266Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: AROX SOLUTION Products: School ERP Pro+Responsive Problem Types: CWE-79 Description: Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability allows an attacker to partially take control of the victim's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-school-erp-proresponsive-arox-solut
ences: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-school-erp-proresponsive-arox-solution
CVE ID: CVE-2024-4823 State: PUBLISHED Published: 2024-05-13T11:27:26.304Z Last Updated: 2024-08-01T20:55:10.025Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: AROX SOLUTION Products: School ERP Pro+Responsive Problem Types: CWE-79 Description: Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index '/schoolerp/office_admin/' in the parameters es_bankacc, es_bank_name, es_bank_pin, es_checkno, es_teller_number, dc1 and dc2. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
ially hijack their browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-school-erp-proresponsive-arox-solution
CVE ID: CVE-2024-4824 State: PUBLISHED Published: 2024-05-13T11:29:37.151Z Last Updated: 2024-08-01T20:55:09.885Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AROX SOLUTION Products: School ERP Pro+Responsive Problem Types: CWE-89 Description: Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, classes_id, es_voucherid, es_class, etc. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Prog
r and retrieve all the information stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-school-erp-proresponsive-arox-solution
CVE ID: CVE-2024-4825 State: PUBLISHED Published: 2024-05-13T11:23:20.416Z Last Updated: 2024-08-01T20:55:10.120Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Agentejo Products: Cockpit CMS Problem Types: CWE-434 Description: A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-upload-file-dangerous-type-vulnerability-c
References: - https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-upload-file-dangerous-type-vulnerability-cockpit-cms
CVE ID: CVE-2024-4826 State: PUBLISHED Published: 2024-05-16T12:07:01.613Z Last Updated: 2024-08-01T20:55:10.045Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Asaancart Products: Simple PHP Shopping Cart Problem Types: CWE-89 Description: SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all the information stored in the database by sending a specially crafted SQL query, due to the lack of proper sanitisation of the category_id parameter in the category.php file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.
.php file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-simple-php-shopping-cart
CVE ID: CVE-2024-4835 State: PUBLISHED Published: 2024-05-23T06:30:50.384Z Last Updated: 2024-09-17T15:33:50.607Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/461328 - https://hackerone.com/reports/2497024
CVE ID: CVE-2024-4836 State: PUBLISHED Published: 2024-07-02T08:44:05.732Z Last Updated: 2024-08-01T20:55:09.998Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Edito Products: Edito CMS Problem Types: CWE-552 Description: Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.edito.pl/ - https:/
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.edito.pl/ - https://cert.pl/en/posts/2024/07/CVE-2024-4836 - https://cert.pl/posts/2024/07/CVE-2024-4836
CVE ID: CVE-2024-4837 State: PUBLISHED Published: 2024-05-15T17:04:05.705Z Last Updated: 2024-08-01T20:55:09.990Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Progress Software Products: Telerik Report Server Problem Types: CWE-200 Description: In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.telerik.com/report-server/knowledge-base/information-exposure-cve-2024-4837
CVE ID: CVE-2024-4838 State: PUBLISHED Published: 2024-05-16T11:05:27.037Z Last Updated: 2024-08-01T20:55:09.895Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Brainstorm Force Products: ConvertPlus Problem Types: CWE-502 Deserialization of Untrusted Data Description: The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_modal' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. I