Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
they can successfully trick a user into performing an action such as clicking on a link while logged in to turboSMTP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cca9f71c-42e6-416f-94f2-cb79bbdfc69a?source=cve - https://plugins.trac.wordpress.org/browser/turbosmtp/trunk/turbo-stats-section.php#L209 - https://plugins.trac.wordpress.org/changeset/3205021/
CVE ID: CVE-2024-12324 State: PUBLISHED Published: 2025-01-07T04:22:23.847Z Last Updated: 2025-01-07T16:17:13.129Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: letscms Products: Unilevel MLM Plan Problem Types: CWE-79 Description: The Unilevel MLM Plan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional An
s that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe71e2b9-ddd7-4d6d-97e5-5fad41f8f35c?source=cve - https://plugins.trac.wordpress.org/browser/unilevel-mlm-plan/trunk/includes/admin/settings/view/ump-epins-list.php#L81
CVE ID: CVE-2024-12325 State: PUBLISHED Published: 2024-12-11T11:24:48.419Z Last Updated: 2024-12-11T14:49:46.684Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: morehawes Products: Waymark Problem Types: CWE-79 Description: The Waymark plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: -
if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4f24b32-58a0-4b10-b8ff-65e574966b6e?source=cve - https://plugins.trac.wordpress.org/browser/waymark/trunk/inc/Admin/Waymark_Settings.php#L1457 - https://plugins.trac.wordpress.org/browser/waymark/trunk/inc/Admin/Waymark_Settings.php#L1458 - https://plugins.trac.wordpress.org/browser/waymark/trunk/inc/Admin/Waymark_Settings.php#L1531 - https://plugins.trac.wordpress.org/browser/waymark/trunk/inc/Admin/Waymark_Settings.php#L1532 - https://plugins.trac.wordpress.org/changeset/320510
ess.org/browser/waymark/trunk/inc/Admin/Waymark_Settings.php#L1532 - https://plugins.trac.wordpress.org/changeset/3205103/
CVE ID: CVE-2024-12326 State: PUBLISHED Published: 2024-12-06T20:50:51.062Z Last Updated: 2024-12-30T14:51:38.301Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Jirafeau project Products: Jirafeau Problem Types: CWE-79 Description: Jirafeau normally prevents browser preview for SVG files due to the possibility that manipulated SVG files could be exploited for cross site scripting. This was done by storing the MIME type of a file and preventing the browser preview for MIME type image/svg+xml. This issue was first reported in CVE-2022-30110. However, it was still possible to do a browser preview of a SVG file by sending a manipulated MIME type during the upl
. However, it was still possible to do a browser preview of a SVG file by sending a manipulated MIME type during the upload, where the case of any letter in image/svg+xml had been changed (like image/svg+XML). The check for image/svg+xml has been changed to be case insensitive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/jirafeau/Jirafeau/-/commit/6cfca8753d54e2025c6020b2af32529e25f58c66 - https://www.cve.org/CVERecord?id=CVE-2022-30110
CVE ID: CVE-2024-12327 State: PUBLISHED Published: 2025-01-07T04:22:20.523Z Last Updated: 2025-01-07T16:19:04.728Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: proloybhaduri Products: LazyLoad Background Images Problem Types: CWE-862 Description: The LazyLoad Background Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pblzbg_save_settings() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
ccess and above, to update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d57fa9f3-b1c0-4601-96d9-178d0dba1332?source=cve - https://plugins.trac.wordpress.org/browser/lazyload-background-images/trunk/admin/plugin-functions.php#L152 - https://plugins.trac.wordpress.org/browser/lazyload-background-images/trunk/admin/plugin-functions.php#L153
CVE ID: CVE-2024-12328 State: PUBLISHED Published: 2025-01-08T08:18:16.153Z Last Updated: 2025-01-08T14:10:37.884Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: madrasthemes Products: MAS Elementor Problem Types: CWE-79 Description: The MAS Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP
trary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01ccc7b8-3dd4-4b83-bd53-687f7479b214?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212434%40mas-addons-for-elementor&new=3212434%40mas-addons-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12329 State: PUBLISHED Published: 2024-12-12T06:46:35.297Z Last Updated: 2024-12-12T14:46:16.727Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: g5theme Products: Essential Real Estate Problem Types: CWE-200 Description: The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thre
ces and transaction logs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa5b1bf3-344e-4ae6-87b9-2dcaafd417a5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204549%40essential-real-estate&new=3204549%40essential-real-estate&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12330 State: PUBLISHED Published: 2025-01-09T11:10:56.083Z Last Updated: 2025-01-09T14:46:23.200Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: databasebackup Products: WP Database Backup – Unlimited Database & Files Backup by Backup for WP Problem Types: CWE-530 Description: The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database. Additional Analys
unauthenticated attackers to extract sensitive data including all information stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3f36839b-850e-4c39-aa61-4fd7a89cd5bc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209380%40wp-database-backup&new=3209380%40wp-database-backup&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209387%40wp-database-backup&new=3209387%40wp-database-backup&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12331 State: PUBLISHED Published: 2024-12-19T11:14:14.862Z Last Updated: 2024-12-20T17:41:11.368Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ninjateam Products: File Manager Pro – Filester Problem Types: CWE-862 Description: The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_plugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Filebird plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://w
ss and above, to install the Filebird plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b09bfff-4d6e-4de0-b6ab-6ac27c4f2be6?source=cve - https://plugins.trac.wordpress.org/changeset/3208858/filester
CVE ID: CVE-2024-12332 State: PUBLISHED Published: 2025-01-07T04:22:18.694Z Last Updated: 2025-01-07T16:20:01.345Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: jdsofttech Products: School Management System – WPSchoolPress Problem Types: CWE-89 Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Student/Parent-level access and above, to append additional S
. This makes it possible for authenticated attackers, with Student/Parent-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c0248af2-f9f3-4652-bf6d-b46aa91b66f3?source=cve - https://plugins.trac.wordpress.org/browser/wpschoolpress/trunk/pages/wpsp-teacher.php#L72 - https://plugins.trac.wordpress.org/browser/wpschoolpress/trunk/pages/wpsp-teacher.php#L73 - https://plugins.trac.wordpress.org/browser/wpschoolpress/trunk/pages/wpsp-teacher.php#L49
CVE ID: CVE-2024-12333 State: PUBLISHED Published: 2024-12-12T08:22:34.360Z Last Updated: 2024-12-12T14:47:05.955Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: xTemos Products: Woodmart Problem Types: CWE-94 Description: The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_instagram_ajax_query AJAX action. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnric
it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1caa8baa-0783-4bc9-af03-46a3a2cf3538?source=cve - https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492
CVE ID: CVE-2024-12334 State: PUBLISHED Published: 2025-01-26T11:09:45.338Z Last Updated: 2025-01-27T14:52:49.129Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: codexpert Products: WC Affiliate – A Complete WooCommerce Affiliate Plugin Problem Types: CWE-79 Description: The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user
r unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efca1ee2-2038-440e-941c-22533b4d833b?source=cve - https://plugins.trac.wordpress.org/changeset/3224312/wc-affiliate
CVE ID: CVE-2024-12335 State: PUBLISHED Published: 2024-12-25T06:42:13.625Z Last Updated: 2024-12-26T19:56:06.643Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: themefusion Products: Avada (Fusion) Builder Problem Types: CWE-639 Description: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post() function and the 'fusion_blog' shortcode and due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft
nticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4181dcad-b5bd-46db-b47c-3cdee427123c?source=cve - https://avada.com
CVE ID: CVE-2024-12336 State: PUBLISHED Published: 2025-03-15T03:23:24.688Z Last Updated: 2025-03-17T21:28:04.518Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: codexpert Products: WC Affiliate – A Complete WooCommerce Affiliate Plugin Problem Types: CWE-862 Description: The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'export_all_data' function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive affiliate data, including personally ident
icated attackers, with Subscriber-level access and above, to expose sensitive affiliate data, including personally identifiable information (PII). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0fb349-4cb8-4cf3-ae7c-5c4dcc6fd4f7?source=cve - https://plugins.trac.wordpress.org/browser/wc-affiliate/trunk/src/AJAX.php#L903
CVE ID: CVE-2024-12337 State: PUBLISHED Published: 2025-01-08T11:09:25.845Z Last Updated: 2025-01-08T13:44:41.278Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: webwirkung Products: Shipping via Planzer for WooCommerce Problem Types: CWE-79 Description: The Shipping via Planzer for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘processed-ids’ parameter in all versions up to, and including, 1.0.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing
d attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e80ed130-8ad2-4fb0-a583-02fc675804d6?source=cve - https://plugins.trac.wordpress.org/changeset/3214785/wc-planzer-shipping
CVE ID: CVE-2024-12338 State: PUBLISHED Published: 2024-12-12T03:23:10.385Z Last Updated: 2024-12-12T15:57:03.336Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: websitetoolbox Products: Website Toolbox Community Problem Types: CWE-79 Description: The Website Toolbox Community plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘websitetoolbox_username’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action
rs to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eae14ac7-ebc1-45a1-b0dd-fec2bbb14460?source=cve - https://plugins.trac.wordpress.org/browser/website-toolbox-forums/trunk/admin/admin.php#L249
CVE ID: CVE-2024-12339 State: PUBLISHED Published: 2025-02-19T07:32:10.616Z Last Updated: 2025-02-19T16:36:27.305Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: digihood Products: Digihood HTML Sitemap Problem Types: CWE-79 Description: The Digihood HTML Sitemap plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘channel' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. A
ipts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/862f8743-5c8c-45ee-a2eb-9ae12c2800ca?source=cve - https://plugins.trac.wordpress.org/browser/wedesin-html-sitemap/trunk/plugin-framework/Functions/Logging/html.php#L36 - https://plugins.trac.wordpress.org/browser/wedesin-html-sitemap/trunk/plugin-framework/Functions/Logging/html.php#L64
CVE ID: CVE-2024-12340 State: PUBLISHED Published: 2024-12-18T09:22:38.826Z Last Updated: 2024-12-18T14:45:10.572Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wealcoder Products: Animation Addons for Elementor Problem Types: CWE-200 Description: The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data. Additional Analyst Note
evel access and above, to extract sensitive private, pending, and draft Elementor template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0136e2-97f5-4368-a805-0f60d1b8ad11?source=cve - https://plugins.trac.wordpress.org/changeset/3205250/animation-addons-for-elementor
CVE ID: CVE-2024-12341 State: PUBLISHED Published: 2024-12-12T03:23:04.555Z Last Updated: 2024-12-12T15:15:16.928Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: mahendrapatidarmp Products: Custom Skins Contact Form 7 Problem Types: CWE-862 Description: The Custom Skins Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf7cs_action_callback' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the content of any post and create new skins. Additional Analyst Notes: - CISA ADP Vulnr
vel access and above, to update the content of any post and create new skins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1cee249d-0a0e-4675-9e35-3a177a3b74a2?source=cve - https://plugins.trac.wordpress.org/browser/custom-skins-contact-form-7/trunk/custom-skins-contact-form-7.php#L182
CVE ID: CVE-2024-12342 State: PUBLISHED Published: 2024-12-08T06:31:05.109Z Last Updated: 2024-12-09T15:51:51.838Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: TP-Link Products: VN020 F3v(T) Problem Types: CWE-404 Description: A vulnerability was found in TP-Link VN020 F3v(T) TT_V6.2.1021. It has been rated as critical. This issue affects some unknown processing of the file /control/WANIPConnection of the component Incomplete SOAP Request Handler. The manipulation leads to denial of service. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrich
cal network. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287261 - https://vuldb.com/?ctiid.287261 - https://github.com/Zephkek/TP-WANPunch/blob/main/README.md - https://www.tp-link.com/
CVE ID: CVE-2024-12343 State: PUBLISHED Published: 2024-12-08T09:31:05.401Z Last Updated: 2024-12-09T15:50:37.719Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: TP-Link Products: VN020 F3v(T) Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected is an unknown function of the file /control/WANIPConnection of the component SOAP Request Handler. The manipulation of the argument NewConnectionType leads to buffer overflow. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA A
thin the local network. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287262 - https://vuldb.com/?ctiid.287262 - https://vuldb.com/?submit.446212 - https://github.com/Zephkek/TP-WANPunch/blob/main/README.md - https://www.tp-link.com/
CVE ID: CVE-2024-12344 State: PUBLISHED Published: 2024-12-08T23:00:16.366Z Last Updated: 2024-12-09T15:48:32.305Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TP-Link Products: VN020 F3v(T) Problem Types: CWE-119 Description: A vulnerability, which was classified as critical, was found in TP-Link VN020 F3v(T) TT_V6.2.1021. This affects an unknown part of the component FTP USER Command Handler. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287265 - https://vuldb.com/?ctiid.287265 - h
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287265 - https://vuldb.com/?ctiid.287265 - https://vuldb.com/?submit.452658 - https://github.com/Zephkek/TP-1450 - https://www.tp-link.com/