Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7074 State: PUBLISHED Published: 2025-06-02T16:42:19.264Z Last Updated: 2025-06-02T17:05:49.920Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: WSO2 Products: WSO2 Enterprise Integrator, WSO2 API Manager, WSO2 Enterprise Service Bus, WSO2 Enterprise Mobility Manager, WSO2 Micro Integrator, WSO2 Open Banking AM, WSO2 Carbon Synapse Artifact Uploader BE Problem Types: CWE-434 Description: An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server
malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3566/
CVE ID: CVE-2024-7076 State: PUBLISHED Published: 2024-09-04T14:13:50.758Z Last Updated: 2024-09-04T15:20:00.669Z Vendors: Semtek Informatics Software Consulting Inc. Products: Semtek Sempos Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Blind SQL Injection.This issue affects Semtek Sempos: through 31072024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1396
CVE ID: CVE-2024-7077 State: PUBLISHED Published: 2024-09-04T14:24:40.357Z Last Updated: 2024-09-04T15:22:10.985Z Vendors: Semtek Informatics Software Consulting Inc. Products: Semtek Sempos Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Reflected XSS.This issue affects Semtek Sempos: through 31072024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1396
CVE ID: CVE-2024-7078 State: PUBLISHED Published: 2024-09-04T14:36:32.186Z Last Updated: 2024-09-04T15:41:08.529Z Vendors: Semtek Informatics Software Consulting Inc. Products: Semtek Sempos Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows SQL Injection.This issue affects Semtek Sempos: through 31072024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1396
CVE ID: CVE-2024-7079 State: PUBLISHED Published: 2024-07-24T15:51:36.331Z Last Updated: 2025-11-20T20:56:28.792Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4 Problem Types: CWE-306 Description: A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials.
dleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-7079 - https://bugzilla.redhat.com/show_bug.cgi?id=2299678
CVE ID: CVE-2024-7080 State: PUBLISHED Published: 2024-07-24T20:00:05.270Z Last Updated: 2024-08-01T21:52:30.657Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Insurance Management System Problem Types: CWE-425 Description: A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /E-Insurance/. The manipulation leads to direct request. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272365 was assigned to this vulnerability. Additional A
been disclosed to the public and may be used. The identifier VDB-272365 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272365 - https://vuldb.com/?ctiid.272365 - https://vuldb.com/?submit.379487 - https://github.com/Xu-Mingming/cve/blob/main/bianli.md
CVE ID: CVE-2024-7081 State: PUBLISHED Published: 2024-07-24T21:00:06.563Z Last Updated: 2024-11-02T18:17:29.565Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file expcatadd.php. The manipulation of the argument id/title leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272366 - https://vuldb.com/?ctiid.272366 - https://vuldb.com/?submit.379675 - https://github.com/zgg012/cve/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2024-7082 State: PUBLISHED Published: 2024-08-06T06:00:07.251Z Last Updated: 2024-10-27T16:18:02.374Z Vendors: Unknown Products: Easy Table of Contents Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8f30e685-00fa-4dbb-b516-2d14e4b13697/
CVE ID: CVE-2024-7084 State: PUBLISHED Published: 2024-08-06T06:00:07.489Z Last Updated: 2024-11-01T20:44:09.200Z Vendors: Unknown Products: Ajax Search Lite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d38bf4d-de6a-49f8-be69-fa483fa61bb7/
CVE ID: CVE-2024-7085 State: PUBLISHED Published: 2025-01-15T16:38:55.440Z Last Updated: 2025-01-15T20:18:52.458Z Vendors: OpenText™ Products: Solutions Business Manager (SBM) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Solutions Business Manager (SBM) allows Stored XSS. The vulnerability could result in the exposure of private information to an unauthorized actor. This issue affects Solutions Business Manager (SBM): through 12.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000036201?language=en_US
CVE ID: CVE-2024-7090 State: PUBLISHED Published: 2024-08-21T05:30:23.166Z Last Updated: 2024-08-21T13:26:50.091Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: shawfactor Products: LH Add Media From Url Problem Types: CWE-79 Description: The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lh_add_media_from_url-file_url’ parameter in all versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such a
nject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3461327-9195-48ed-b9c3-7b33198e9438?source=cve - https://plugins.trac.wordpress.org/browser/lh-add-media-from-url/trunk/lh-add-media-from-url.php#L173 - https://plugins.trac.wordpress.org/browser/lh-add-media-from-url/trunk/partials/upload.php#L6
CVE ID: CVE-2024-7091 State: PUBLISHED Published: 2024-07-24T22:07:45.260Z Last Updated: 2024-08-29T15:05:00.966Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-200 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where it was possible to disclose limited information of an exported group or project to another user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/408469
CVE ID: CVE-2024-7092 State: PUBLISHED Published: 2024-08-13T04:29:10.738Z Last Updated: 2024-08-13T13:27:22.551Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘no_more_items_text’ parameter in all versions up to, and including, 5.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated at
ncluding, 5.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/718c60c1-6117-4959-a907-d0ef457f7185?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php#L3879 - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery
ttps://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php#L3900 - https://wordpress.org/plugins/essential-addons-for-elementor-lite/#developers - https://essential-addons.com/changelog/ - https://plugins.trac.wordpress.org/changeset/3134194/
CVE ID: CVE-2024-7093 State: PUBLISHED Published: 2024-08-01T21:07:35.787Z Last Updated: 2024-08-02T16:04:37.541Z Vendors: Netflix Products: Dispatch Problem Types: CWE-94 Description: Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then executed whenever these notifications are rendered and sent out. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-003.md
CVE ID: CVE-2024-7094 State: PUBLISHED Published: 2024-08-13T02:31:39.099Z Last Updated: 2024-08-13T14:51:27.755Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: rabilal Products: JS Help Desk – The Ultimate Help Desk & Support Plugin Problem Types: CWE-94 Description: The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible fo
lied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31513f9e-6185-425b-9e7e-36f21f72d0a2?source=cve - https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/includes/formhandler.php - https://plugins.trac.wordpress.org/browser/js-suppor
org/browser/js-support-ticket/tags/2.8.5/includes/formhandler.php - https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/modules/themes/tpls/admin_themes.php - https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/modules/themes/controller.php - https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/modules/themes/model.php - https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/includes/css/style.php
CVE ID: CVE-2024-7095 State: PUBLISHED Published: 2025-01-10T20:19:10.234Z Last Updated: 2025-01-14T14:33:54.850Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Arista Networks Products: EOS Problem Types: cwe-401 Description: On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being terminated (causing SNMP requests to time out until snmpd is restarted) and memory pressure for other processes on the switch. Increased memory pressure can cause processes other than sn
rted) and memory pressure for other processes on the switch. Increased memory pressure can cause processes other than snmpd to be at risk for unexpected termination as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/20650-security-advisory-0107
CVE ID: CVE-2024-7096 State: PUBLISHED Published: 2025-05-30T14:54:32.417Z Last Updated: 2025-05-30T15:01:40.977Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: WSO2 Products: WSO2 Open Banking IAM, WSO2 Open Banking AM, WSO2 API Manager, WSO2 Enterprise Mobility Manager, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking KM Problem Types: CWE-863 Description: A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are a
eate a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announ
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/
CVE ID: CVE-2024-7097 State: PUBLISHED Published: 2025-05-30T15:04:09.940Z Last Updated: 2025-05-30T16:12:44.804Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: WSO2 Products: WSO2 Open Banking AM, WSO2 Open Banking KM, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Identity Server, WSO2 Open Banking IAM, WSO2 Enterprise Mobility Manager Description: An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper au
ration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/
CVE ID: CVE-2024-7098 State: PUBLISHED Published: 2024-09-16T14:50:42.192Z Last Updated: 2024-09-17T10:55:54.015Z Vendors: SFS Consulting Products: ww.Winsure Problem Types: CWE-611 Description: Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1475
CVE ID: CVE-2024-7099 State: PUBLISHED Published: 2024-10-13T21:09:53.816Z Last Updated: 2024-10-15T14:56:00.675Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: netease-youdao Products: netease-youdao/qanything Problem Types: CWE-89 Description: netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_files`, and `get_file_by_status`. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database
cker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/bc98983e-06cc-4a4b-be01-67e5010cb2c1 - https://github.com/netease-youdao/qanything/commit/a87354f09d93e95350fb45eb343dc75454387554
CVE ID: CVE-2024-7100 State: PUBLISHED Published: 2024-07-30T06:48:47.282Z Last Updated: 2024-08-01T21:52:30.616Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_button shortcode in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4999bbf3-3dbd-4c9a-b648-744192c9586c?source=cve - https://plugins.trac.wordpress.org/browser/bold-page-builder/trunk/content_elements/bt_bb_button/bt_bb_button.php#L155 - https://wordpress.org/plugins/bold-page-builder/#developers - https://plugins.trac.wordpress.org/changeset/3127440/
CVE ID: CVE-2024-7101 State: PUBLISHED Published: 2024-07-25T16:00:07.633Z Last Updated: 2024-08-01T21:52:30.531Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: ForIP Tecnologia Products: Administração PABX Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in ForIP Tecnologia Administração PABX 1.x. This issue affects some unknown processing of the file /login of the component Authentication Form. The manipulation of the argument usuario leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272423. NOTE:
has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272423. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272423 - https://vuldb.com/?ctiid.272423 - https://vuldb.com/?submit.375832
CVE ID: CVE-2024-7102 State: PUBLISHED Published: 2025-02-13T00:54:25.633Z Last Updated: 2025-02-13T14:59:00.454Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-250 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/474414 - https://hackerone.com/reports/2623063
CVE ID: CVE-2024-7103 State: PUBLISHED Published: 2025-05-22T18:41:12.235Z Last Updated: 2025-05-22T18:48:11.459Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: WSO2 Products: WSO2 Identity Server Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the login flow, potentially leading to UI modifications, redirections to malicious websites, or data exfiltration from the browser. While this issue could allow an attacker to manipulate th
to malicious websites, or data exfiltration from the browser. While this issue could allow an attacker to manipulate the user’s browser, session-related sensitive cookies remain protected with the httpOnly flag, preventing session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3425/
CVE ID: CVE-2024-7104 State: PUBLISHED Published: 2024-09-16T14:52:57.400Z Last Updated: 2024-09-16T15:34:22.985Z Vendors: SFS Consulting Products: ww.Winsure Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection.This issue affects ww.Winsure: before 4.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1475