Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1205 State: PUBLISHED Published: 2024-03-20T06:48:27.397Z Last Updated: 2024-08-05T14:58:40.855Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: israelb1 Products: Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the nouvello_upload_csv_file function in all versions up to, and including, 1.2.0. Th
to missing file type validation in the nouvello_upload_csv_file function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4219c10-9d2a-429d-9ac7-61efc02bd4cf?source=cve - https://plugins.trac.wordpress.org/browser/wemanage-app-worker/trunk/includes/class-nouvello-wemanage-worker-api-wc-ext-controller-functions.php#L982 - https://plugins.trac.wordpress.org/br
includes/class-nouvello-wemanage-worker-api-wc-ext-controller-functions.php#L982 - https://plugins.trac.wordpress.org/browser/wemanage-app-worker/trunk/includes/class-nouvello-wemanage-worker-api-wc-ext-controller.php#L166
CVE ID: CVE-2024-1206 State: PUBLISHED Published: 2024-02-20T18:56:41.390Z Last Updated: 2024-08-08T20:05:31.113Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: brechtvds Products: WP Recipe Maker Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up to, and including, 9.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and
paration on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b10d8f8a-517f-4286-b501-0ca040529362?source=cve - https://plugins.trac.wordpress.org/changeset/3032702/wp-recipe-maker/trunk/includes/admin/import/class-wprm-import-mealplannerpro.php - https://plugins.trac.wordpress.org/changeset/3032702/wp-recipe-maker/trunk/includes/admin/import/class-wpr
nnerpro.php - https://plugins.trac.wordpress.org/changeset/3032702/wp-recipe-maker/trunk/includes/admin/import/class-wprm-import-recipecard.php - https://plugins.trac.wordpress.org/changeset/3032702/wp-recipe-maker/trunk/includes/admin/import/class-wprm-import-wpzoom.php - https://plugins.trac.wordpress.org/changeset/3032702/wp-recipe-maker/trunk/includes/admin/import/class-wprm-import-wpzoomcpt.php - https://plugins.trac.wordpress.org/changeset/3032702/wp-recipe-maker/trunk/includes/admin/import/class-wprm-import-yummly.php - https://plugins.trac.wordpress.org/changeset/3032702/wp-recipe-maker/trunk/includes/admin/class-wprm-import-manager.php
CVE ID: CVE-2024-1207 State: PUBLISHED Published: 2024-02-08T08:32:07.622Z Last Updated: 2024-08-01T18:33:25.155Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpdevelop Products: WP Booking Calendar Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticat
upplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7802ed1f-138c-4a3d-916c-80fb4f7699b2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3032596%40booking&new=3032596%40booking&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1208 State: PUBLISHED Published: 2024-02-05T21:21:57.946Z Last Updated: 2024-08-27T16:20:59.824Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: LearnDash LMS Problem Types: CWE-200 Information Exposure Description: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae735117-e68b-448e-ad41-258d1be3aebc?sour
ainer: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae735117-e68b-448e-ad41-258d1be3aebc?source=cve - https://www.learndash.com/release-notes/ - https://github.com/karlemilnikka/CVE-2024-1208-and-CVE-2024-1210
CVE ID: CVE-2024-1209 State: PUBLISHED Published: 2024-02-05T21:21:48.587Z Last Updated: 2025-06-17T21:29:25.554Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: LearnDash LMS Problem Types: CWE-200 Information Exposure Description: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attackers to obtain those uploads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/v
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7191955e-0db1-4ad1-878b-74f90ca59c91?source=cve - https://www.learndash.com/release-notes/ - https://github.com/karlemilnikka/CVE-2024-1209
CVE ID: CVE-2024-1210 State: PUBLISHED Published: 2024-02-05T21:21:45.748Z Last Updated: 2025-06-17T21:29:25.683Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: LearnDash LMS Problem Types: CWE-200 Information Exposure Description: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it possible for unauthenticated attackers to obtain access to quizzes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61ca5ab6-5fe9-4313-9b0d-8736663d0e89?source=cve
References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61ca5ab6-5fe9-4313-9b0d-8736663d0e89?source=cve - https://www.learndash.com/release-notes/ - https://github.com/karlemilnikka/CVE-2024-1208-and-CVE-2024-1210
CVE ID: CVE-2024-1211 State: PUBLISHED Published: 2025-01-30T23:45:00.772Z Last Updated: 2025-01-31T20:51:47.207Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-352 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/440313 - https://hackero
yst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/440313 - https://hackerone.com/reports/2323594
CVE ID: CVE-2024-1212 State: PUBLISHED Published: 2024-02-21T17:39:12.599Z Last Updated: 2025-10-21T23:05:23.864Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Software Products: LoadMaster Problem Types: CWE-78 Description: Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kemptechnologies.com/ - https://freeloadbalancer.com/ - https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-121
pport.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 - https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212
CVE ID: CVE-2024-1213 State: PUBLISHED Published: 2024-03-12T23:33:49.560Z Last Updated: 2024-08-01T19:07:52.226Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: sjaved Products: Easy Social Feed – Social Photos Gallery – Post Feed – Like Box Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the esf_insta_save_access_token and efbl_save_facebook_access_token functions. This makes it possible for unauthenticat
the esf_insta_save_access_token and efbl_save_facebook_access_token functions. This makes it possible for unauthenticated attackers to connect their facebook and instagram pages to the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/262dcea7-3ac4-43ee-90d7-91f200c3496c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3047064%40easy-facebook-likebox&new=3047064%40easy-facebook-likebox&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1214 State: PUBLISHED Published: 2024-03-12T23:33:50.978Z Last Updated: 2024-08-05T15:09:41.469Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: sjaved Products: Easy Social Feed – Social Photos Gallery – Post Feed – Like Box Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the save_groups_list function. This makes it possible for unauthenticated attackers to disconnect a site's facebook or
the save_groups_list function. This makes it possible for unauthenticated attackers to disconnect a site's facebook or instagram page/group connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aaf62045-b9ce-40d7-92b3-7ab683e5a08c?source=cve - https://plugins.trac.wordpress.org/browser/easy-facebook-likebox/trunk/facebook/admin/class-easy-facebook-likebox-admin.php?rev=3047064
CVE ID: CVE-2024-1215 State: PUBLISHED Published: 2024-02-03T15:31:03.720Z Last Updated: 2025-05-15T19:48:34.775Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: CRUD without Page Reload Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file fetch_data.php. The manipulation of the argument username/city leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252782 is the identifier assigned to this vulnerability. Additional Anal
en disclosed to the public and may be used. VDB-252782 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252782 - https://vuldb.com/?ctiid.252782 - https://github.com/PrecursorYork/crud-without-refresh-reload-Reflected_XSS-POC/blob/main/README.md
CVE ID: CVE-2024-1216 State: REJECTED Published: 2024-02-13T18:41:47.892Z Last Updated: 2024-03-08T21:46:42.875Z Description: No description available.
CVE ID: CVE-2024-1217 State: PUBLISHED Published: 2024-02-20T18:56:35.250Z Last Updated: 2025-04-24T15:03:23.203Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: kaliforms Products: Contact Form builder with drag & drop for WordPress – Kali Forms Problem Types: CWE-862 Missing Authorization Description: The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the await_plugin_deactivation function in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate a
including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate any active plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7be75b0a-737d-4f0d-b024-e207af4573cd?source=cve - https://plugins.trac.wordpress.org/changeset/3036466/kali-forms/trunk?contextall=1&old=3029334&old_path=%2Fkali-forms%2Ftrunk
CVE ID: CVE-2024-1218 State: PUBLISHED Published: 2024-02-20T18:56:49.746Z Last Updated: 2024-08-01T18:33:25.285Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: kaliforms Products: Contact Form builder with drag & drop for WordPress – Kali Forms Problem Types: CWE-862 Missing Authorization Description: The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API due to an inconsistent capability check on several REST endpoints in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with contributor access and higher, t
up to, and including, 2.3.41. This makes it possible for authenticated attackers, with contributor access and higher, to obtain access to or modify forms or entries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed1aae32-6040-4c42-b8a7-4c3be371a8c0?source=cve - https://plugins.trac.wordpress.org/changeset/3036466/kali-forms/trunk?contextall=1&old=3029334&old_path=%2Fkali-forms%2Ftrunk
CVE ID: CVE-2024-1219 State: PUBLISHED Published: 2024-04-17T05:00:02.372Z Last Updated: 2024-08-01T18:33:25.329Z Vendors: Unknown Products: Easy Social Feed Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ce4ac9c4-d293-4464-b6a0-82ddf8d4860
ulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ce4ac9c4-d293-4464-b6a0-82ddf8d4860b/
CVE ID: CVE-2024-1220 State: PUBLISHED Published: 2024-03-06T01:51:19.200Z Last Updated: 2024-08-23T20:33:09.565Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Moxa Products: NPort W2150A/W2250A Series Problem Types: CWE-121 Description: A stack-based buffer overflow in the built-in web server in Moxa NPort W2150A/W2250A Series firmware version 2.3 and prior allows a remote attacker to exploit the vulnerability by sending crafted payload to the web service. Successful exploitation of the vulnerability could result in denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/pr
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-238975-nport-w2150a-w2250a-series-web-server-stack-based-buffer-overflow-vulnerability
CVE ID: CVE-2024-1221 State: PUBLISHED Published: 2024-03-14T03:01:05.179Z Last Updated: 2024-09-26T03:46:19.820Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: PaperCut Products: PaperCut NG, PaperCut MF Problem Types: CWE-76 Description: This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.papercut.com/kb/Main/Se
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE ID: CVE-2024-1222 State: PUBLISHED Published: 2024-03-14T03:03:18.638Z Last Updated: 2024-09-26T03:50:54.624Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: PaperCut Products: PaperCut NG, PaperCut MF Problem Types: CWE-250 Description: This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE ID: CVE-2024-1223 State: PUBLISHED Published: 2024-03-14T03:04:43.588Z Last Updated: 2024-09-26T03:50:15.610Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: PaperCut Products: PaperCut NG, PaperCut MF Problem Types: CWE-488 Description: This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www
fic runtime state. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
CVE ID: CVE-2024-1224 State: PUBLISHED Published: 2024-03-06T11:22:53.214Z Last Updated: 2024-08-01T18:33:25.283Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: CDAC Products: USB Pratirodh Problem Types: CWE-326 Description: This vulnerability exists in USB Pratirodh due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. A local attacker with administrative privileges could exploit this vulnerability to obtain the password of USB Pratirodh on the targeted system. Successful exploitation of this vulnerability could allow the attacker to take control of the application and modify the access control of registered users or devi
ty could allow the attacker to take control of the application and modify the access control of registered users or devices on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0080
CVE ID: CVE-2024-1225 State: PUBLISHED Published: 2024-02-05T13:00:05.298Z Last Updated: 2025-05-15T19:47:21.129Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: QiboSoft Products: QiboCMS X1 Problem Types: CWE-502 Description: A vulnerability classified as critical was found in QiboSoft QiboCMS X1 up to 1.0.6. Affected by this vulnerability is the function rmb_pay of the file /application/index/controller/Pay.php. The manipulation of the argument callback_class leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252847. NOTE: The vendor was contacted e
public and may be used. The associated identifier of this vulnerability is VDB-252847. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252847 - https://vuldb.com/?ctiid.252847 - https://note.zhaoj.in/share/jDWk6INLzO12
CVE ID: CVE-2024-1226 State: PUBLISHED Published: 2024-03-12T15:07:18.532Z Last Updated: 2024-08-05T17:48:59.065Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Rejetto Products: Http File Server Problem Types: CWE-93 Description: The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the browser. An attacker could control the response and craft attacks such as cross-site scripting and cache poisoning attacks. Additional Analyst Notes: - CVE Program Container: - CI
ttacks such as cross-site scripting and cache poisoning attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-rejettos-http-file-server
CVE ID: CVE-2024-1227 State: PUBLISHED Published: 2024-03-12T15:11:26.293Z Last Updated: 2024-08-02T17:02:56.714Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Rejetto Products: Http File Server Problem Types: CWE-601 Description: An open redirect vulnerability, the exploitation of which could allow an attacker to create a custom URL and redirect a legitimate page to a malicious site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-rejettos-http-file-server
CVE ID: CVE-2024-1228 State: PUBLISHED Published: 2024-06-10T11:13:44.453Z Last Updated: 2025-10-07T13:21:10.928Z Vendors: EuroSoft Sp. z o. o. Products: Eurosoft Przychodnia Problem Types: CWE-259 Description: Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations. This issue affects Eurosoft Przychodnia software before version 20240417.001 (from that version vulnerability is fixed). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/06/CVE-2024-1228/ - https://cert.pl/posts/2024/06/CVE-