Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3719 State: PUBLISHED Published: 2024-04-13T11:00:05.430Z Last Updated: 2024-08-01T20:20:00.992Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: House Rental Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Campcodes House Rental Management System 1.0. This affects an unknown part of the file ajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260571. Additional Analyst Notes: - CISA ADP Vulnrich
ay be used. The associated identifier of this vulnerability is VDB-260571. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260571 - https://vuldb.com/?ctiid.260571 - https://vuldb.com/?submit.314205 - https://github.com/E1CHO/cve_hub/blob/main/House%20Rental%20Management%20System/House%20Rental%20Management%20System%20-%20vuln%205.pdf
CVE ID: CVE-2024-3720 State: PUBLISHED Published: 2024-04-13T11:31:04.334Z Last Updated: 2024-08-01T20:20:01.137Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tianwell Products: Fire Intelligent Command Platform Problem Types: CWE-89 Description: A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical. This vulnerability affects unknown code of the file /mfsNotice/page of the component API Interface. The manipulation of the argument gsdwid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260572. Addition
e exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260572. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260572 - https://vuldb.com/?ctiid.260572 - https://vuldb.com/?submit.314922 - https://github.com/scausoft/cve/blob/main/sql.md
CVE ID: CVE-2024-3721 State: PUBLISHED Published: 2024-04-13T12:00:04.795Z Last Updated: 2024-08-01T20:20:00.692Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TBK Products: DVR-4104, DVR-4216 Problem Types: CWE-78 Description: A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability. Additional Analyst No
losed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260573 - https://vuldb.com/?ctiid.260573 - https://vuldb.com/?submit.314969 - https://github.com/netsecfish/tbk_dvr_command_injection
CVE ID: CVE-2024-3722 State: PUBLISHED Published: 2024-05-09T20:03:28.124Z Last Updated: 2024-08-01T20:20:01.136Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: swte Products: Swift Performance Lite Problem Types: CWE-863 Incorrect Authorization Description: The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_handler() function in all versions up to, and including, 2.3.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve and modify settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen
ve, to retrieve and modify settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/58b7736a-e3e0-4ecd-9adf-284568b02ef7?source=cve - https://plugins.trac.wordpress.org/browser/swift-performance-lite/trunk/includes/setup/setup.php#L97
CVE ID: CVE-2024-3723 State: PUBLISHED Published: 2024-06-11T05:33:40.801Z Last Updated: 2024-08-01T20:20:01.104Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: vsourz1td Products: Advanced Contact form 7 DB Problem Types: CWE-922 Insecure Storage of Sensitive Information Description: The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
xtract sensitive data uploaded via this plugin through a form. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a1f1a1-4f0a-48b5-80c8-525b69006863?source=cve - https://wordpress.org/plugins/advanced-cf7-db/#developers
CVE ID: CVE-2024-3724 State: PUBLISHED Published: 2024-05-02T16:52:18.348Z Last Updated: 2024-08-01T20:20:01.024Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Stack Group, Photo Stack, & Horizontal Timeline widgets in all versions up to, and including, 3.10.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible
g, 3.10.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/826483d7-948d-46c4-890c-71001b03847c?source=cve - https://plugins.trac.wordpress.org/changeset/3072960/happy-elementor-addons/trunk/widgets/photo-stack/widget.php - https://plugins.trac.wordpress.org/changeset/3072960/happy-elementor-addons/trunk/widgets/imag
/photo-stack/widget.php - https://plugins.trac.wordpress.org/changeset/3072960/happy-elementor-addons/trunk/widgets/image-stack-group/widget.php - https://plugins.trac.wordpress.org/changeset/3072960/happy-elementor-addons/trunk/widgets/horizontal-timeline/widget.php
CVE ID: CVE-2024-3725 State: PUBLISHED Published: 2024-05-02T16:52:40.615Z Last Updated: 2024-08-01T20:20:00.967Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Grid widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user sup
idget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes such as 'titleTag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb041f6-b88a-495a-8f5f-7f39f640748d?source=cve - https://plugins.trac.wordpress.org/changeset/3071504/otter-blocks/trunk/inc/render/class-posts-grid-block.php
CVE ID: CVE-2024-3726 State: PUBLISHED Published: 2024-05-30T02:35:08.522Z Last Updated: 2024-08-01T20:20:00.880Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vinod-dalvi Products: Login Logout Register Menu Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'llrmloginlogout' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contri
ization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a93aab-4845-46ed-8adc-d06b2ee8ee9e?source=cve - https://wordpress.org/plugins/login-logout-register-menu/
CVE ID: CVE-2024-3727 State: PUBLISHED Published: 2024-05-09T14:57:21.327Z Last Updated: 2025-11-19T21:31:24.978Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: OADP-1.3-RHEL-9, Red Hat Advanced Cluster Security 4.4, Red Hat Advanced Cluster Security 4.5, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Migration Toolkit for Containers 1.8, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, RHEL-9-CNV-4.15, Multicluster Eng
Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, RHEL-9-CNV-4.15, Multicluster Engine for Kubernetes, OpenShift Developer Tools and Services, OpenShift Serverless, OpenShift Source-to-Image (S2I), Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 3, Red Hat Ansible Automation Platform 1.2, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform Assisted Installer 1, Red Hat OpenShift Dev Spaces, Red Hat Openshift Sandboxed Containers, Red Hat OpenShift Virtual
rm Assisted Installer 1, Red Hat OpenShift Dev Spaces, Red Hat Openshift Sandboxed Containers, Red Hat OpenShift Virtualization 4, Red Hat OpenStack Platform 16.2, Red Hat Quay 3 Problem Types: CWE-354 Description: A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0045 - https://access.redhat.com/errata/RHSA-2024:3718 - https://access.redhat.com/errata/RHSA-2024:4159 - https
SA-2024:0045 - https://access.redhat.com/errata/RHSA-2024:3718 - https://access.redhat.com/errata/RHSA-2024:4159 - https://access.redhat.com/errata/RHSA-2024:4613 - https://access.redhat.com/errata/RHSA-2024:4850 - https://access.redhat.com/errata/RHSA-2024:4960 - https://access.redhat.com/errata/RHSA-2024:5258 - https://access.redhat.com/errata/RHSA-2024:5951 - https://access.redhat.com/errata/RHSA-2024:6054 - https://access.redhat.com/errata/RHSA-2024:6122 - https://access.redhat.com/errata/RHSA-2024:6708 - https://access.redhat.com/errata/RHSA-2024:6818 - https://access.redhat.com/errata/RHSA-2024:6824 - https://access.redhat.com/errata/RHSA-2024:7164 - https://access.redhat.com/errata/RH
redhat.com/errata/RHSA-2024:6824 - https://access.redhat.com/errata/RHSA-2024:7164 - https://access.redhat.com/errata/RHSA-2024:7174 - https://access.redhat.com/errata/RHSA-2024:7182 - https://access.redhat.com/errata/RHSA-2024:7187 - https://access.redhat.com/errata/RHSA-2024:7922 - https://access.redhat.com/errata/RHSA-2024:7941 - https://access.redhat.com/errata/RHSA-2024:8260 - https://access.redhat.com/errata/RHSA-2024:8425 - https://access.redhat.com/errata/RHSA-2024:9097 - https://access.redhat.com/errata/RHSA-2024:9098 - https://access.redhat.com/errata/RHSA-2024:9102 - https://access.redhat.com/errata/RHSA-2024:9960 - https://access.redhat.com/security/cve/CVE-2024-3727 - https://bu
02 - https://access.redhat.com/errata/RHSA-2024:9960 - https://access.redhat.com/security/cve/CVE-2024-3727 - https://bugzilla.redhat.com/show_bug.cgi?id=2274767
CVE ID: CVE-2024-3728 State: PUBLISHED Published: 2024-05-02T16:51:53.633Z Last Updated: 2024-08-01T20:20:01.082Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery & Interactive Circle widgets in all versions up to, and including,
ss-Site Scripting via the plugin's Filterable Gallery & Interactive Circle widgets in all versions up to, and including, 5.9.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/284ea577-ff67-4681-995b-f7bb5ef0ff3e?source=cve - https://plugins.trac.wordpress.org/changeset/3075644/essential-addons-for-elementor-lite/ta
5b-f7bb5ef0ff3e?source=cve - https://plugins.trac.wordpress.org/changeset/3075644/essential-addons-for-elementor-lite/tags/5.9.16/includes/Elements/Filterable_Gallery.php - https://plugins.trac.wordpress.org/changeset/3075644/essential-addons-for-elementor-lite/tags/5.9.16/includes/Elements/Interactive_Circle.php
CVE ID: CVE-2024-3729 State: PUBLISHED Published: 2024-05-02T16:52:28.332Z Last Updated: 2024-08-01T20:20:01.048Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: shabti Products: Frontend Admin by DynamiApps Problem Types: CWE-636 Not Failing Securely ('Failing Open') Description: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatic
he user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d22c5d-5ef5-4920-a1b5-e8284394c7e8?source=cve - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.18.15/main/helpers.php#L617 - https://plugins.trac.wordpress.org/changeset/3073379/ac
r/acf-frontend-form-element/tags/3.18.15/main/helpers.php#L617 - https://plugins.trac.wordpress.org/changeset/3073379/acf-frontend-form-element#file4
CVE ID: CVE-2024-3730 State: PUBLISHED Published: 2024-04-25T11:00:21.879Z Last Updated: 2024-08-01T20:20:00.911Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: mra13 Products: Simple Membership Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib
zation and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63779ab7-ba8b-459d-beb3-a32faf8f4394?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076221%40simple-membership&new=3076221%40simple-membership&sfp_email=&sfph_mail=#file31
CVE ID: CVE-2024-3731 State: PUBLISHED Published: 2024-04-19T02:34:43.754Z Last Updated: 2024-08-01T20:20:01.124Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ivole Products: Customer Reviews for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.47.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exe
output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3489038-2833-4080-b802-5733afab5de8?source=cve - https://plugins.trac.wordpress.org/changeset/3072688/customer-reviews-woocommerce/trunk/includes/reminders/class-cr-reminders-log-table.php
CVE ID: CVE-2024-3732 State: PUBLISHED Published: 2024-04-23T09:32:54.806Z Last Updated: 2024-08-01T20:20:01.035Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: paoltaia Products: GeoDirectory – WordPress Business Directory Plugin, or Classified Directory Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output esca
ngle_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a91e786-f570-4c6c-b1c7-0110774cb808?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071121%40geodirectory&new=3071121%40geodirectory&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3733 State: PUBLISHED Published: 2024-04-25T08:29:00.282Z Last Updated: 2024-08-01T20:20:01.126Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-200 Information Exposure Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.9.15 via the ajax_load_more() , eael_woo_pagination_product_ajax(), and ajax_eael_product_gallery() functions. This makes
15 via the ajax_load_more() , eael_woo_pagination_product_ajax(), and ajax_eael_product_gallery() functions. This makes it possible for unauthenticated attackers to extract posts that may be in private or draft status. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d604f7a-947c-43f4-bba6-e7e98b2d7844?source=cve - https://plugins.trac.wordpress.org/changeset/3075644/essential-addons-for-elementor-lite/tags/5.9.16/includes/Traits/Ajax_Handler.php
CVE ID: CVE-2024-3734 State: PUBLISHED Published: 2024-05-02T16:52:03.882Z Last Updated: 2024-08-11T14:11:27.580Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: realmag777 Products: FOX – Currency Switcher Professional for WooCommerce Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The FOX – Currency Switcher Professional for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 1.4.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode f
e arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1d49d0-c9aa-401c-80b9-d4df7fe97691?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-currency-switcher/trunk/classes/woocs.php#L4154 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3072307%40woocommerce-currency-switcher%2Ftrunk&old=3049249%40woocommerce-currency-switcher%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3735 State: PUBLISHED Published: 2024-04-13T13:00:05.571Z Last Updated: 2024-08-01T20:20:00.969Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Smart Office Problem Types: CWE-521 Description: A vulnerability was found in Smart Office up to 20240405. It has been classified as problematic. Affected is an unknown function of the file Main.aspx. The manipulation of the argument New Password/Confirm Password with the input 1 leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the pub
exity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-260574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260574 - https://vuldb.com/?ctiid.260574 - https://vuldb.com/?submit.311153 - https://mega.nz/file/7F0BSJhD#EvnXFRviBstJGHSafvLmVWosWH2JFPAouD6ER8wnGxk