Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-54425 State: PUBLISHED Published: 2024-12-16T14:13:49.563Z Last Updated: 2024-12-16T20:02:03.867Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LionScripts.com Products: LionScripts: Site Maintenance & Noindex Nofollow Plugin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.com LionScripts: Site Maintenance & Noindex Nofollow Plugin allows Stored XSS.This issue affects LionScripts: Site Maintenance & Noindex Nofollow Plugin: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/maintenance-and-noindex-nofollow/v
CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/maintenance-and-noindex-nofollow/vulnerability/wordpress-lionscripts-site-maintenance-plugin-2-1-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE ID: CVE-2024-54426 State: PUBLISHED Published: 2024-12-16T14:13:48.971Z Last Updated: 2024-12-16T20:02:14.033Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Andy Fradelakis Products: LeaderBoard Plugin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Andy Fradelakis LeaderBoard Plugin allows Stored XSS.This issue affects LeaderBoard Plugin: from n/a through 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/leaderboard-lite/vulnerability/wordpress-leaderboard-plugin-plugin-1-2-4-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE ID: CVE-2024-54427 State: PUBLISHED Published: 2024-12-16T14:13:48.380Z Last Updated: 2024-12-16T20:02:22.747Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Linda MacPhee-Cobb Products: Category of Posts Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Linda MacPhee-Cobb Category of Posts allows Stored XSS.This issue affects Category of Posts: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/list-one-category-of-posts/vulnerability/wordpress-category-of-posts-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54428 State: PUBLISHED Published: 2024-12-16T14:13:47.798Z Last Updated: 2024-12-16T20:02:34.560Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: onigetoc Products: Add image to Post Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in onigetoc Add image to Post allows Stored XSS.This issue affects Add image to Post: from n/a through 0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/add-image-to-post/vulnerability/wordpress-add-image-to-post-plugin-0-6-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54429 State: PUBLISHED Published: 2024-12-16T14:13:47.199Z Last Updated: 2024-12-16T20:02:44.607Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ivan Ovsyannikov Products: Aphorismus Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ivan Ovsyannikov Aphorismus allows Stored XSS.This issue affects Aphorismus: from n/a through 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/aphorismus/vulnerability/wordpress-aphorismus-plugin-1-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54430 State: PUBLISHED Published: 2024-12-16T14:13:46.585Z Last Updated: 2024-12-16T20:02:53.214Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Bastien Ho Products: EELV Newsletter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Bastien Ho EELV Newsletter allows Cross Site Request Forgery.This issue affects EELV Newsletter: from n/a through 4.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/eelv-newsletter/vulnerability/wordpress-eelv-newsletter-plugin-4-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-54431 State: PUBLISHED Published: 2024-12-16T14:13:45.998Z Last Updated: 2024-12-16T20:03:01.688Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Mohamed Riyaz Products: Admin Customization Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Mohamed Riyaz Admin Customization allows Stored XSS.This issue affects Admin Customization: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpp-customization/vulnerability/wordpress-admin-customization-plugin-2-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54432 State: PUBLISHED Published: 2024-12-16T14:13:45.399Z Last Updated: 2024-12-16T20:03:11.523Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Shambhu Prasad Patnaik Products: WP Flipkart Importer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Prasad Patnaik WP Flipkart Importer allows Stored XSS.This issue affects WP Flipkart Importer: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-flipkart-importer/vulnerability/wordpress-wp-flipkart-importer-plugin-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54433 State: PUBLISHED Published: 2024-12-16T14:13:44.784Z Last Updated: 2024-12-16T20:03:22.619Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Simple Booking Products: Simple Booking Widget Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Simple Booking Simple Booking Widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-booking-widget/vulnerability/wordpress-simple-booking-widget-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54434 State: PUBLISHED Published: 2024-12-16T14:13:44.178Z Last Updated: 2024-12-16T20:03:31.607Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Phoetry Products: phZoom Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Phoetry phZoom allows Stored XSS.This issue affects phZoom: from n/a through 1.2.92. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/phzoom/vulnerability/wordpress-phzoom-plugin-1-2-92-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54435 State: PUBLISHED Published: 2024-12-16T14:13:43.580Z Last Updated: 2024-12-16T20:03:41.635Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Thomas Hoefter Products: Onlywire Multi Autosubmitter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Onlywire Multi Autosubmitter allows Stored XSS.This issue affects Onlywire Multi Autosubmitter: from n/a through 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/onlywire-multi-autosubmitter/vulnerability/wordpress-onlywire-multi-autosubmitter-plugin-1-2-4-csrf-to-stored-xss-v
ugin/onlywire-multi-autosubmitter/vulnerability/wordpress-onlywire-multi-autosubmitter-plugin-1-2-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54436 State: PUBLISHED Published: 2024-12-16T14:13:42.979Z Last Updated: 2024-12-16T20:03:53.188Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Jettochkin Products: Jet Footer Code Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jettochkin Jet Footer Code allows Stored XSS.This issue affects Jet Footer Code: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-footer-code/vulnerability/wordpress-jet-footer-code-plugin-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54437 State: PUBLISHED Published: 2024-12-16T14:13:42.402Z Last Updated: 2024-12-16T20:04:02.956Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Merrill M. Mayer Products: jCarousel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Merrill M. Mayer jCarousel allows Stored XSS.This issue affects jCarousel: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jcarousel-for-wordpress/vulnerability/wordpress-jcarousel-for-wordpress-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_i
jcarousel-for-wordpress/vulnerability/wordpress-jcarousel-for-wordpress-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54438 State: PUBLISHED Published: 2024-12-16T14:13:41.814Z Last Updated: 2024-12-16T20:04:11.845Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: GAxx Products: Gaxx Keywords Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in GAxx Gaxx Keywords allows Stored XSS.This issue affects Gaxx Keywords: from n/a through 0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gaxx-keywords/vulnerability/wordpress-gaxx-keywords-plugin-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54439 State: PUBLISHED Published: 2024-12-16T14:13:41.224Z Last Updated: 2024-12-16T20:04:20.957Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Alok Tiwari Products: Amazon Product Price Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price allows Stored XSS.This issue affects Amazon Product Price: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/amazon-product-price/vulnerability/wordpress-amazon-product-price-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54440 State: PUBLISHED Published: 2024-12-16T14:13:40.623Z Last Updated: 2024-12-16T20:04:31.904Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: blueskyy Products: WP-Ban-User Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in blueskyy WP-Ban-User allows Stored XSS.This issue affects WP-Ban-User: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-ban-user/vulnerability/wordpress-wp-ban-user-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54441 State: PUBLISHED Published: 2024-12-16T14:14:16.769Z Last Updated: 2024-12-16T19:45:10.007Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Meini Products: Utech World Time Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time allows Stored XSS.This issue affects Utech World Time: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/utech-world-time-for-wp/vulnerability/wordpress-utech-world-time-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_i
/utech-world-time-for-wp/vulnerability/wordpress-utech-world-time-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54442 State: PUBLISHED Published: 2024-12-16T14:14:16.152Z Last Updated: 2024-12-16T19:45:17.889Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Lluís Cortès Products: Better WP Login Page Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lluís Cortès Better WP Login Page allows Stored XSS.This issue affects Better WP Login Page: from n/a through 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/better-wp-login-page/vulnerability/wordpress-better-wp-login-page-plugin-better-wp-login-pa
om/database/wordpress/plugin/better-wp-login-page/vulnerability/wordpress-better-wp-login-page-plugin-better-wp-login-page-1-1-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54443 State: PUBLISHED Published: 2024-12-16T14:14:15.536Z Last Updated: 2024-12-16T19:47:15.075Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Pluginscafe Products: Advanced Data Table For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluginscafe Advanced Data Table For Elementor allows Stored XSS.This issue affects Advanced Data Table For Elementor: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advanced-data-table-for-elementor/vulnerability/wordpr
t: References: - https://patchstack.com/database/wordpress/plugin/advanced-data-table-for-elementor/vulnerability/wordpress-advanced-data-table-for-elementor-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54444 State: PUBLISHED Published: 2025-02-25T14:17:49.943Z Last Updated: 2025-02-25T19:30:46.544Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Elementor Products: Elementor Website Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder allows Stored XSS. This issue affects Elementor Website Builder: from n/a through 3.25.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-plugin-3-25-10-cross-site-scripting
patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-plugin-3-25-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-54445 State: PUBLISHED Published: 2025-03-14T17:49:44.090Z Last Updated: 2025-03-14T18:15:11.612Z Vendors: LogicalDOC Products: LogicalDOC Community, LogicalDOC Enterprise Problem Types: CWE-89 Description: Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE ID: CVE-2024-54446 State: PUBLISHED Published: 2025-03-14T17:53:01.300Z Last Updated: 2025-03-14T18:13:21.649Z Vendors: LogicalDOC Products: LogicalDOC Community, LogicalDOC Enterprise Problem Types: CWE-89 Description: Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE ID: CVE-2024-54447 State: PUBLISHED Published: 2025-03-14T17:57:26.356Z Last Updated: 2025-03-18T16:37:33.586Z Vendors: LogicalDOC Products: LogicalDOC Community, LogicalDOC Enterprise Problem Types: CWE-89 Description: Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE ID: CVE-2024-54448 State: PUBLISHED Published: 2025-03-14T18:01:25.311Z Last Updated: 2025-03-18T16:36:58.362Z Vendors: LogicalDOC Products: LogicalDOC Community, LogicalDOC Enterprise Problem Types: CWE-94 Description: The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC. Additional Analyst Notes:
nds of their choosing on the underlying operating system of the web server running LogicalDOC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE ID: CVE-2024-54449 State: PUBLISHED Published: 2025-03-14T18:04:20.149Z Last Updated: 2025-03-18T16:27:46.227Z Vendors: LogicalDOC Products: LogicalDOC Community, LogicalDOC Enterprise Problem Types: CWE-23 Description: The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate RCE. An account with ‘read’ and ‘write’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to run comm
ication is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE ID: CVE-2024-54450 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T18:19:27.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the (possibly forged) IP address mentioned in that header rather than the real IP address that the user logged in from. This fake IP address can later be displayed in the My Account popup that shows the IP address that was used to log in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kurmi-software.com - https://kurmi-software.com/cve/cve-202
nalyst Notes: - CISA ADP Vulnrichment: References: - https://kurmi-software.com - https://kurmi-software.com/cve/cve-2024-54450/
CVE ID: CVE-2024-54451 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T18:13:38.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the graphicCustomization.do page in Kurmi Provisioning Suite before 7.9.0.38, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15 allows remote attackers (authenticated as system administrators) to inject arbitrary web script or HTML via the COMPONENT_fields(htmlTitle) field, which is rendered in other pages of the application for all users (if the graphical customization has been activated by a super-administrator). Additional Analyst Notes: - CISA ADP Vulnrichment: References
ustomization has been activated by a super-administrator). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kurmi-software.com - https://kurmi-software.com/cve/cve-2024-54451/
CVE ID: CVE-2024-54452 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T18:11:43.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35 and 7.10.x through 7.10.0.18. A Directory Traversal and Local File Inclusion vulnerability in the logsSys.do page allows remote attackers (authenticated as administrators) to trigger the display of unintended files. Any file accessible to the Kurmi user account could be displayed, e.g., configuration files with information such as the database password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kurmi-software.com - https://kurmi
se password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kurmi-software.com - https://kurmi-software.com/cve/cve-2024-54452/
CVE ID: CVE-2024-54453 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-31T18:38:06.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. A path traversal vulnerability in the DocServlet servlet allows remote attackers to retrieve any file from the Kurmi web application installation folder, e.g., files such as the obfuscated and/or compiled Kurmi source code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kurmi-software.com - https://kurmi-software.com/cve/cve-2024-54453/
CVE ID: CVE-2024-54454 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-31T18:35:45.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable Response Discrepancy vulnerability in the sendPasswordReinitLink action of the unlogged.do page allows remote attackers to test whether a username is valid or not. This allows confirmation of valid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kurmi-software.com - https://kurmi-software.com/cve-2024-54454/
CVE ID: CVE-2024-54455 State: PUBLISHED Published: 2025-01-11T12:35:42.392Z Last Updated: 2025-05-04T09:57:04.283Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix general protection fault in ivpu_bo_list() Check if ctx is not NULL before accessing its fields. References: - https://git.kernel.org/stable/c/a1e597ee5920a6aabdf4dfc3bf76e55e1b115e23 - https://git.kernel.org/stable/c/4b2efb9db0c22a130bbd1275e489b42c02d08050
CVE ID: CVE-2024-54456 State: PUBLISHED Published: 2025-02-27T02:18:08.143Z Last Updated: 2025-09-03T13:06:46.447Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() name is char[64] where the size of clnt->cl_program->name remains unknown. Invoking strcat() directly will also lead to potential buffer overflow. Change them to strscpy() and strncat() to fix potential issues. References: - https://git.kernel.org/stable/c/19b3ca651b4b473878c73539febe477905041442 - https://git.kernel.org/stable/c/dd8830779b77f4d1206d28d02ad56a03fc0e78f7 - https://git.kernel.org/stable/c/e
905041442 - https://git.kernel.org/stable/c/dd8830779b77f4d1206d28d02ad56a03fc0e78f7 - https://git.kernel.org/stable/c/e8e0eb5601d4a6c74c336e3710afe3a0348c469d - https://git.kernel.org/stable/c/49fd4e34751e90e6df009b70cd0659dc839e7ca8