Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5771 State: PUBLISHED Published: 2024-06-08T22:00:05.022Z Last Updated: 2024-08-01T21:18:07.124Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: LabVantage Products: LIMS Problem Types: CWE-89 Description: A vulnerability classified as critical was found in LabVantage LIMS 2017. This vulnerability affects unknown code of the file /labvantage/rc?command=page&page=SampleList&_iframename=list of the component POST Request Handler. The manipulation of the argument param1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-267454 is the identifier assigned to this vulnerability. NOTE: The ven
been disclosed to the public and may be used. VDB-267454 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.267454 - https://vuldb.com/?ctiid.267454 - https://vuldb.com/?submit.347403 - https://gentle-khaan-c53.notion.site/Labvantage-LIMS-3bb2137a29944e7e9efc906f23b42a4a
CVE ID: CVE-2024-5772 State: PUBLISHED Published: 2024-06-09T02:00:04.646Z Last Updated: 2024-08-01T21:18:07.043Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /protocol/iscuser/deleteiscuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is
motely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267455. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.267455 - https://vuldb.com/?ctiid.267455 - https://vuldb.com/?submit.348486 - https://github.com/charliecatsec/cve1/blob/main/NS-ASG-sql-deleteiscuser.md
CVE ID: CVE-2024-5773 State: PUBLISHED Published: 2024-06-09T03:00:04.420Z Last Updated: 2024-08-01T21:18:06.963Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/firewall/deletemacbind.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267456. NOTE:
The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267456. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.267456 - https://vuldb.com/?ctiid.267456 - https://vuldb.com/?submit.349551 - https://github.com/L1OudFd8cl09/CVE/issues/3
CVE ID: CVE-2024-5774 State: PUBLISHED Published: 2024-06-09T06:00:05.097Z Last Updated: 2024-08-01T21:18:07.052Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Stock Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Stock Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-267457 was assigned to this vulnerabil
The exploit has been disclosed to the public and may be used. The identifier VDB-267457 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.267457 - https://vuldb.com/?ctiid.267457 - https://vuldb.com/?submit.352337 - https://github.com/CveSecLook/cve/issues/43
CVE ID: CVE-2024-5775 State: PUBLISHED Published: 2024-06-09T07:31:04.250Z Last Updated: 2024-08-01T21:18:07.059Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Vehicle Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file updatebill.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-267458 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP
ublic and may be used. VDB-267458 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.267458 - https://vuldb.com/?ctiid.267458 - https://vuldb.com/?submit.352338 - https://github.com/CveSecLook/cve/issues/44
CVE ID: CVE-2024-5776 State: REJECTED Published: N/A Last Updated: 2024-06-12T07:26:58.114Z Description: No description available.
CVE ID: CVE-2024-5777 State: REJECTED Published: N/A Last Updated: 2024-06-12T07:27:05.406Z Description: No description available.
CVE ID: CVE-2024-5778 State: REJECTED Published: N/A Last Updated: 2024-06-12T07:27:12.041Z Description: No description available.
CVE ID: CVE-2024-5779 State: REJECTED Published: N/A Last Updated: 2024-06-12T07:27:18.345Z Description: No description available.
CVE ID: CVE-2024-5780 State: REJECTED Published: N/A Last Updated: 2024-06-12T07:27:25.253Z Description: No description available.
CVE ID: CVE-2024-5781 State: REJECTED Published: N/A Last Updated: 2024-06-12T07:27:31.185Z Description: No description available.
CVE ID: CVE-2024-5782 State: REJECTED Published: N/A Last Updated: 2024-06-12T07:27:36.463Z Description: No description available.
CVE ID: CVE-2024-5783 State: REJECTED Published: N/A Last Updated: 2024-06-12T07:27:43.519Z Description: No description available.
CVE ID: CVE-2024-5784 State: PUBLISHED Published: 2024-08-30T03:24:16.470Z Last Updated: 2024-08-30T14:39:05.512Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: themium Products: Tutor LMS Pro Problem Types: CWE-862 Description: The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and tutor_gc_class_action in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with the subscriber-level access and above, to preform an administrative actions on the site, like comments, posts or user
th the subscriber-level access and above, to preform an administrative actions on the site, like comments, posts or users deletion, viewing notifications, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5c23ed-7239-40e1-a795-1ae8d4c2d6c8?source=cve - https://tutorlms.com/releases/id/299/
CVE ID: CVE-2024-5785 State: PUBLISHED Published: 2024-06-10T12:13:05.682Z Last Updated: 2024-08-01T21:18:07.054Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Comtrend Products: Comtrend WLD71-T1_v2.0.201820 Problem Types: CWE-78 Description: Command injection vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulner
Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-comtrend-router
CVE ID: CVE-2024-5786 State: PUBLISHED Published: 2024-06-10T12:14:21.871Z Last Updated: 2024-08-01T21:18:07.062Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Comtrend Products: Comtrend WLD71-T1_v2.0.201820 Problem Types: CWE-352 Description: Cross-Site Request Forgery vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application to which he is authenticated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities
ment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-comtrend-router
CVE ID: CVE-2024-5787 State: PUBLISHED Published: 2024-06-13T05:34:45.943Z Last Updated: 2024-08-01T21:18:07.045Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ideaboxcreations Products: PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Link Effects widget in all versions up to, and including, 2.7.20 due to insufficient input sanitiza
within the plugin's Link Effects widget in all versions up to, and including, 2.7.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce55230e-8c9e-41aa-b107-16c5988d1feb?source=cve - https://plugins.trac.wordpress.org/browser/powerpack-lite-for-elementor/tags/2.7.20/modules/link-effects/widgets/link-effects.php#L482 - https://plugins.trac.wor
r/powerpack-lite-for-elementor/tags/2.7.20/modules/link-effects/widgets/link-effects.php#L482 - https://plugins.trac.wordpress.org/changeset/3101651/#file331 - https://wordpress.org/plugins/powerpack-lite-for-elementor/#developers
CVE ID: CVE-2024-5788 State: PUBLISHED Published: 2024-06-28T06:57:45.277Z Last Updated: 2024-08-01T21:18:07.070Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nattywp Products: Silesia Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Silesia theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ attribute within the theme's Button shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web
ng. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0183625a-611c-4353-9d2a-7a25ae12709a?source=cve - https://themes.trac.wordpress.org/browser/silesia/1.0.6/functions/shortcodes.php#L128
CVE ID: CVE-2024-5789 State: PUBLISHED Published: 2024-09-13T15:10:37.165Z Last Updated: 2024-09-13T15:34:27.168Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Towfiq I. Products: Triton Lite Problem Types: CWE-79 Description: The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/049efe5a-3f68-46ad-b73a-1892f03c9d1d?source=cve - https://themes.trac.wordpress.org/browser/triton-lite/1.3/lib/includes/shortcodes.php#L136
CVE ID: CVE-2024-5790 State: PUBLISHED Published: 2024-06-29T07:05:38.700Z Last Updated: 2024-08-01T21:25:01.772Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Gradient Heading widget in all versions up to, and including, 3.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Cont
ue to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1b948a-7a7e-4bdf-af1d-559f34d4baa3?source=cve - https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.11.0/widgets/gradient-heading/widget.php#L260 - https://plugins.trac.wordpress.org/changeset/3108597/#file575 - https://wordpress.org/plugins/happy-elementor-addons/#developer
/plugins.trac.wordpress.org/changeset/3108597/#file575 - https://wordpress.org/plugins/happy-elementor-addons/#developers
CVE ID: CVE-2024-5791 State: PUBLISHED Published: 2024-06-22T02:01:06.722Z Last Updated: 2024-08-01T21:25:01.784Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: vcita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_id' parameter in all versions up to, and including, 4.4.2 due to missing authorization checks on processAction function, as well as insufficient input sanitization and
ng, 4.4.2 due to missing authorization checks on processAction function, as well as insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a wp-admin dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c033171a-d81f-4cae-830b-8bdc4017b85e?source=cve - https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/tags/4.4.2/vcita-api-functions.php#L40
CVE ID: CVE-2024-5792 State: PUBLISHED Published: 2024-07-10T02:02:47.779Z Last Updated: 2024-08-01T21:25:01.880Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Houzez Products: Houzez CRM Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Houzez CRM plugin for WordPress is vulnerable to time-based SQL Injection via the notes ‘belong_to’ parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller)
nt preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d4df4b-ec7a-43f6-8617-161b1600d6d2?source=cve - https://favethemes.zendesk.com/hc/en-us/articles/360041639432-Changelog
CVE ID: CVE-2024-5793 State: PUBLISHED Published: 2024-07-09T02:03:12.862Z Last Updated: 2024-08-01T21:25:01.673Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Favethemes Products: Houzez Theme - Functionality Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,
ameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9bbe79-a4c3-42eb-8d4d-47d26dbe9f43?source=cve - https://favethemes.zendesk.com/hc/en-us/articles/360041639432-Changelog
CVE ID: CVE-2024-5795 State: PUBLISHED Published: 2024-07-16T21:26:54.243Z Last Updated: 2024-08-01T21:25:01.600Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-400 Description: A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large payload to the Git server. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst N
6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.14 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6 - https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1
CVE ID: CVE-2024-5796 State: PUBLISHED Published: 2024-06-28T06:57:46.200Z Last Updated: 2024-08-01T21:25:01.941Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ravichandra Products: Infinite Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Infinite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘project_url’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/673f0910-8121-4344-b756-2ed5418fdc6b?source=cve - https://themes.trac.wordpress.org/browser/infinite/1.1.2/framework/metaboxes/metaboxes.php#L79
CVE ID: CVE-2024-5798 State: PUBLISHED Published: 2024-06-12T18:55:24.788Z Last Updated: 2025-11-04T16:30:51.697Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-287 Description: Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9 Additional An
ted. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770
CVE ID: CVE-2024-5799 State: PUBLISHED Published: 2024-09-12T06:00:02.912Z Last Updated: 2024-09-12T17:57:42.676Z Vendors: Unknown Products: CM Pop-Up Banners for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as Contributors to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3ee3023a-541c-40e6-8d62-24b4b110633c/
CVE ID: CVE-2024-5800 State: PUBLISHED Published: 2024-08-10T03:50:02.159Z Last Updated: 2024-08-12T14:32:22.309Z Vendors: B&R Industrial Automation Products: Automation Runtime Problem Types: CWE-326 Description: Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack of B&R Automation Runtime versions before 6.0.2, allowing a network attacker to decrypt the SSL/TLS communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P011-d8aaf02f.pdf
CVE ID: CVE-2024-5801 State: PUBLISHED Published: 2024-08-10T03:52:02.326Z Last Updated: 2024-08-12T14:44:00.687Z Vendors: B&R Industrial Automation Products: Automation Runtime Problem Types: CWE-1188, CWE-653 Description: Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based packets through the host, potentially by-passing firewall, router, or NAC filtering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P011-d8aaf02f.pdf
CVE ID: CVE-2024-5802 State: PUBLISHED Published: 2024-07-09T06:00:04.751Z Last Updated: 2025-03-13T13:05:35.706Z Vendors: Unknown Products: URL Shortener by MyThemeShop Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The URL Shortener by Myhop WordPress plugin through 1.0.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/cd37f702-9144-4c98-9b08-c63e510cd97f/