Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-21711 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:04.162Z Description: No description available.
CVE ID: CVE-2024-21712 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:07.821Z Description: No description available.
CVE ID: CVE-2024-21713 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:09.743Z Description: No description available.
CVE ID: CVE-2024-21714 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:11.663Z Description: No description available.
CVE ID: CVE-2024-21715 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:13.374Z Description: No description available.
CVE ID: CVE-2024-21716 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:14.677Z Description: No description available.
CVE ID: CVE-2024-21717 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:15.859Z Description: No description available.
CVE ID: CVE-2024-21718 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:16.997Z Description: No description available.
CVE ID: CVE-2024-21719 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:18.169Z Description: No description available.
CVE ID: CVE-2024-21720 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:19.283Z Description: No description available.
CVE ID: CVE-2024-21721 State: REJECTED Published: N/A Last Updated: 2025-01-01T00:00:20.400Z Description: No description available.
CVE ID: CVE-2024-21722 State: PUBLISHED Published: 2024-02-20T16:22:50.937Z Last Updated: 2024-11-03T04:33:10.830Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-613 Description: The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.joomla.org/security-centre/925-20240201-core-insufficient-session-expiration-in-mfa-management-views.html
CVE ID: CVE-2024-21723 State: PUBLISHED Published: 2024-02-20T16:23:25.802Z Last Updated: 2024-12-04T16:09:52.726Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-601 Description: Inadequate parsing of URLs could result into an open redirect. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.joomla.org/security-centre/926-20240202-core-open-redirect-in-installation-application.html
CVE ID: CVE-2024-21724 State: PUBLISHED Published: 2024-02-20T16:22:56.838Z Last Updated: 2025-03-29T04:35:15.450Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-79 Description: Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.joomla.org/security-centre/927-20240203-core-xss-in-media-selection-fields.html
CVE ID: CVE-2024-21725 State: PUBLISHED Published: 2024-02-20T16:22:57.554Z Last Updated: 2024-10-28T04:34:16.221Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-79 Description: Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.joomla.org/security-centre/928-20240204-core-xss-in-mail-address-outputs.html
CVE ID: CVE-2024-21726 State: PUBLISHED Published: 2024-02-20T16:22:36.946Z Last Updated: 2024-12-25T04:35:19.649Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-79 Description: Inadequate content filtering leads to XSS vulnerabilities in various components. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.joomla.org/security-centre/929-20240205-core-inadequate-content-filtering-within-the-filter-code.html - https://www.sonarsource.com/blog/joomla-multiple-xss-vulnerabilities/
CVE ID: CVE-2024-21727 State: PUBLISHED Published: 2024-02-15T06:54:28.972Z Last Updated: 2024-11-03T04:33:10.046Z Vendors: digital-peak.com Products: DP Calendar for Joomla Problem Types: CWE-79 Description: XSS vulnerability in DP Calendar component for Joomla. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://extensions.joomla.org/extension/dpcalendar/
CVE ID: CVE-2024-21728 State: PUBLISHED Published: 2024-02-15T20:20:02.813Z Last Updated: 2024-12-04T16:10:56.400Z Vendors: smartcalc.es Products: osTicky component for Joomla Problem Types: CWE-601 Description: An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that provides Joomla fronted integration with osTicket, a popular Support ticket system. The Open Redirect vulnerability allows attackers to control the return parameter in the URL to a base64 malicious URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/solracsf/osTicky
CVE ID: CVE-2024-21729 State: PUBLISHED Published: 2024-07-09T16:15:51.461Z Last Updated: 2025-03-26T04:33:56.179Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-79 Description: Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.joomla.org/security-centre/935-20240701-core-xss-in-accessible-media-selection-field.html
CVE ID: CVE-2024-21730 State: PUBLISHED Published: 2024-07-09T16:15:49.888Z Last Updated: 2025-03-20T04:34:42.326Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-79 Description: The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.joomla.org/security-centre/936-20240702-core-self-xss-in-fancyselect-list-field-layout.html
CVE ID: CVE-2024-21731 State: PUBLISHED Published: 2024-07-09T16:15:43.351Z Last Updated: 2025-03-14T04:35:24.835Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-79 Description: Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.joomla.org/security-centre/937-20240703-core-xss-in-stringhelper-truncate-method.html
CVE ID: CVE-2024-21732 State: PUBLISHED Published: 2024-01-01T00:00:00.000Z Last Updated: 2025-06-03T14:54:31.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlyCms through abbaa5a allows XSS via the permission management feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Ghostfox2003/cms/blob/main/1.md
CVE ID: CVE-2024-21733 State: PUBLISHED Published: 2024-01-19T10:29:04.694Z Last Updated: 2025-11-03T20:36:42.598Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-209 Description: Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb
E Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz
CVE ID: CVE-2024-21734 State: PUBLISHED Published: 2024-01-09T00:54:47.844Z Last Updated: 2024-11-14T16:42:14.879Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Marketing (Contacts App) Problem Types: CWE-601 Description: SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing phishing attack with low impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3190894 - https://www.sap.com/documents/2022/02/fa865ea4-167e-00
DP Vulnrichment: References: - https://me.sap.com/notes/3190894 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-21735 State: PUBLISHED Published: 2024-01-09T00:57:37.063Z Last Updated: 2025-06-17T20:59:11.007Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP LT Replication Server Problem Types: CWE-863 Description: SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, resulting in escalation of privileges, which has High impact on confidentiality, integrity and availability of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
identiality, integrity and availability of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3407617 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-21736 State: PUBLISHED Published: 2024-01-09T01:15:17.763Z Last Updated: 2025-04-17T17:59:58.507Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP S/4HANA Finance (Advanced Payment Management) Problem Types: CWE-863 Description: SAP S/4HANA Finance for (Advanced Payment Management) - versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import could be triggered allowing the attacker to create in-house bank accounts leading to low impact on the confidentiality of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sa
the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3260667 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-21737 State: PUBLISHED Published: 2024-01-09T01:18:19.305Z Last Updated: 2025-06-03T14:33:33.116Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Application Interface Framework (File Adapter) Problem Types: CWE-94 Description: In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the application. This leads to considerable impact on confidentiality, integrity and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
on confidentiality, integrity and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3411869 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-21738 State: PUBLISHED Published: 2024-01-09T01:19:29.437Z Last Updated: 2025-06-03T14:33:28.278Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver ABAP Application Server and ABAP Platform Problem Types: CWE-79 Description: SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.s
ful exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3387737 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2024-21739 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-11-07T17:09:58.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: Geehy APM32F103CCT6, APM32F103RCT6, APM32F103RCT7, and APM32F103VCT6 devices have Incorrect Access Control. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://tches.iacr.org/index.php/TCHES/article/view/11422/10927
CVE ID: CVE-2024-21740 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-08-01T22:27:35.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://tches.iacr.org/index.php/TCHES/article/view/11422/10927
CVE ID: CVE-2024-21741 State: PUBLISHED Published: 2024-06-25T00:00:00.000Z Last Updated: 2025-03-13T14:31:39.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: GigaDevice GD32E103C8T6 devices have Incorrect Access Control. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://tches.iacr.org/index.php/TCHES/article/view/11422/10927
CVE ID: CVE-2024-21742 State: PUBLISHED Published: 2024-02-27T16:21:16.432Z Last Updated: 2025-05-06T13:11:44.183Z Vendors: Apache Software Foundation Products: Apache James Mime4J Problem Types: CWE-74 Description: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy
CVE ID: CVE-2024-21743 State: PUBLISHED Published: 2024-09-17T13:35:44.728Z Last Updated: 2024-09-17T17:24:46.656Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: favethemes Products: Houzez Login Register Problem Types: CWE-266 Description: Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/houzez-login-register/wordpress-houzez-login-register-plugin-3-2-5-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-21744 State: PUBLISHED Published: 2024-01-08T16:58:05.651Z Last Updated: 2024-11-14T16:46:17.730Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Mapster Technology Inc. Products: Mapster WP Maps Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapster Technology Inc. Mapster WP Maps allows Stored XSS.This issue affects Mapster WP Maps: from n/a through 1.2.38. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mapster-wp-maps/wordpress-mapster-wp-maps-plugin-1-2-38-cross
eferences: - https://patchstack.com/database/vulnerability/mapster-wp-maps/wordpress-mapster-wp-maps-plugin-1-2-38-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-21745 State: PUBLISHED Published: 2024-01-08T16:51:33.580Z Last Updated: 2025-06-17T20:39:16.047Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Laybuy Products: Laybuy Payment Extension for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Stored XSS.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/laybuy-gateway-for-wo
am Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/laybuy-gateway-for-woocommerce/wordpress-laybuy-payment-extension-for-woocommerce-plugin-5-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-21746 State: PUBLISHED Published: 2024-05-17T08:46:01.927Z Last Updated: 2024-08-01T22:27:36.067Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Wpmet Products: Wp Ultimate Review Problem Types: CWE-290 Description: Authentication Bypass by Spoofing vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-2-5-ip-limit-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2024-21747 State: PUBLISHED Published: 2024-01-08T16:48:10.433Z Last Updated: 2025-06-17T20:39:16.175Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: weDevs Products: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: from n/a through 1.12.8. Additional Analyst N
R solution with recruitment & job listings | WooCommerce CRM & Accounting: from n/a through 1.12.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/erp/wordpress-wp-erp-plugin-1-12-8-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-21748 State: PUBLISHED Published: 2024-06-08T16:14:02.597Z Last Updated: 2024-08-01T22:27:36.015Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Icegram Products: Icegram Problem Types: CWE-862 Description: Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-engage-plugin-3-1-20-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-21749 State: PUBLISHED Published: 2024-02-28T16:31:08.911Z Last Updated: 2024-08-01T22:27:36.189Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Atakan Au Products: 1 click disable all Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au 1 click disable all.This issue affects 1 click disable all: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/first-graders-toolbox/wordpress-1-click-disable-all-plugin-1-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-21750 State: PUBLISHED Published: 2024-02-01T09:40:16.203Z Last Updated: 2024-08-01T22:27:36.258Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Scribit Products: Shortcodes Finder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scribit Shortcodes Finder allows Reflected XSS.This issue affects Shortcodes Finder: from n/a through 1.5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/shortcodes-finder/wordpress-shortcodes-finder-plugin-1-5-4-reflected-cross-site-scripti
stack.com/database/vulnerability/shortcodes-finder/wordpress-shortcodes-finder-plugin-1-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-21751 State: PUBLISHED Published: 2024-06-10T08:05:14.665Z Last Updated: 2024-08-01T22:27:36.283Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: RabbitLoader Products: RabbitLoader Problem Types: CWE-862 Description: Missing Authorization vulnerability in RabbitLoader.This issue affects RabbitLoader: from n/a through 2.19.13. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/rabbit-loader/wordpress-rabbitloader-plugin-2-19-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-21752 State: PUBLISHED Published: 2024-02-29T05:17:57.694Z Last Updated: 2025-04-22T15:53:08.802Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ernest Marcinko Products: Ajax Search Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ernest Marcinko Ajax Search Lite allows Reflected XSS.This issue affects Ajax Search Lite: from n/a through 4.11.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ajax-search-lite/wordpress-ajax-search-lite-plugin-4-11-4-reflected-xss-via-cross-site-request-forgery-csrf-vulnerability?_
x-search-lite/wordpress-ajax-search-lite-plugin-4-11-4-reflected-xss-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-21753 State: PUBLISHED Published: 2024-09-10T14:37:48.466Z Last Updated: 2024-09-10T18:58:32.329Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:H/RL:U/RC:C) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-22 Description: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8, 1.2.1 through 1.2.5 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests Additional Analyst Notes: - CISA ADP Vulnrichment: Re
rite a limited number of files via specially crafted HTTP requests Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-362
CVE ID: CVE-2024-21754 State: PUBLISHED Published: 2024-06-11T14:32:01.335Z Last Updated: 2025-08-27T20:42:53.370Z Severity: LOW (CVSS 1.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N/E:F/RL:X/RC:R) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-916 Description: A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file. Additional Analyst Notes: - CISA ADP Vu
attacker with super-admin profile and CLI access to decrypting the backup file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-423
CVE ID: CVE-2024-21755 State: PUBLISHED Published: 2024-04-09T14:24:25.073Z Last Updated: 2024-08-01T22:27:36.253Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSandbox version 4.4.0 through 4.4.3 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests.. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-489