Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-0838 State: PUBLISHED Published: 2024-02-20T18:56:48.371Z Last Updated: 2024-08-01T18:18:18.857Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the side image URL parameter in the Age Gate in all versions up to, and including, 3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher,
anitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d55bab2a-5e2e-440e-b4fa-03853679ba22?source=cve - https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.10.1/widgets/age-gate/widget.php#L2121 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3028056%40happy-elementor-addons%2Ftrunk&old=3016053%40happy-elementor-addons%2Ftrunk
fp_email=&sfph_mail=&reponame=&new=3028056%40happy-elementor-addons%2Ftrunk&old=3016053%40happy-elementor-addons%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0839 State: PUBLISHED Published: 2024-03-13T15:26:36.360Z Last Updated: 2024-08-28T16:13:15.063Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: radgeek Products: FeedWordPress Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
sts that may contain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ead46fd-5744-4fbb-9efd-980f9216abbc?source=cve - https://wordpress.org/plugins/feedwordpress/
CVE ID: CVE-2024-0840 State: PUBLISHED Published: 2024-04-29T18:42:57.112Z Last Updated: 2024-08-01T18:18:18.719Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Grandstream Products: UCM Series Problem Types: CWE-141 Description: The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Co
dels are the UCM6202, UCM6204, UCM6208, and UCM6510. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vulncheck.com/advisories/grand-stream-param-injection
CVE ID: CVE-2024-0841 State: PUBLISHED Published: 2024-01-28T11:20:40.159Z Last Updated: 2025-11-06T19:54:47.949Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-476 Description: A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
heir privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2024-0841 - https://bugzilla.redhat.com/show_bug.cgi?id=2256490
CVE ID: CVE-2024-0842 State: PUBLISHED Published: 2024-02-09T04:31:54.615Z Last Updated: 2024-08-01T18:18:19.075Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: softaculous Products: Backuply – Backup, Restore, Migrate and Clone Problem Types: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion') Description: The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 1.2.5. This is due to direct access of the backuply/restore_ins.php file and. This makes it possible for unauthenticated attackers to make excessive requests that result in the server running out of r
is makes it possible for unauthenticated attackers to make excessive requests that result in the server running out of resources. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f955d88-ab4c-4cf4-a23b-91119d412716?source=cve - https://plugins.trac.wordpress.org/changeset/3033242/backuply/trunk/restore_ins.php
CVE ID: CVE-2024-0844 State: PUBLISHED Published: 2024-02-02T11:34:14.634Z Last Updated: 2024-08-01T18:18:18.686Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: devfelixmoira Products: Popup More Popups, Lightboxes, and more popup modules Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementData() function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files end
sible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files ending with "Form.php" on the server , allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7894a19c-b873-4c5b-8c82-6656cc306ee2?source=cve - https://plugins.trac.wordpress.org/browser/popup-more/trunk/classes/Ajax.php#L184
CVE ID: CVE-2024-0845 State: PUBLISHED Published: 2024-06-18T02:37:12.131Z Last Updated: 2024-08-01T18:18:18.699Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: redlettuce Products: PDF Viewer for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary we
ing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d6f9c80-ef86-4910-a88e-98f2b444ee30?source=cve - https://plugins.trac.wordpress.org/browser/pdf-viewer-for-elementor/trunk/widgets/pdfjs-viewer.php#L215 - https://plugins.trac.wordpress.org/browser/pdf-viewer-for-elementor/trunk/widgets/pdfjs-viewer.php#L219 - https://plugins.trac.wordpress.org/browser/pdf-viewer-for-elementor/trunk/widgets/pdf-view
dgets/pdfjs-viewer.php#L219 - https://plugins.trac.wordpress.org/browser/pdf-viewer-for-elementor/trunk/widgets/pdf-viewer.php#L256 - https://plugins.trac.wordpress.org/browser/pdf-viewer-for-elementor/trunk/widgets/pdf-viewer.php#L260
CVE ID: CVE-2024-0847 State: PUBLISHED Published: 2024-05-02T16:51:50.133Z Last Updated: 2024-08-01T18:18:18.860Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: 5280studios Products: 5280 Bootstrap Modal Contact Form Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-table.php. This makes it possible for unauthenticated attackers to bulk delete messages via a forged request granted they can trick a site administrator into pe
authenticated attackers to bulk delete messages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/18464483-1d2f-4a4e-a1cc-6c1ddcc2dcf5?source=cve - https://plugins.trac.wordpress.org/browser/5280-bootstrap-modal-contact-form/trunk/inc/class-sbmm-list-table.php#L142
CVE ID: CVE-2024-0848 State: PUBLISHED Published: 2024-05-02T16:52:25.111Z Last Updated: 2024-08-01T18:18:18.834Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: aaextention Products: AA Cash Calculator Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The AA Cash Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘invoice’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can su
his makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/933ea8a2-3d1d-43a3-bb14-52f37576c9e5?source=cve - https://plugins.trac.wordpress.org/browser/aa-calculator/trunk/aacalculation.php#L79
CVE ID: CVE-2024-0849 State: PUBLISHED Published: 2024-02-07T02:50:42.355Z Last Updated: 2025-05-19T16:29:44.682Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Leanote Products: Leanote Problem Types: CWE-73 Description: Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/leanote/desktop-app - https://fluidattacks.com/advisories/alesso
CVE ID: CVE-2024-0851 State: PUBLISHED Published: 2024-05-27T14:23:57.642Z Last Updated: 2024-08-01T18:18:18.909Z Vendors: Grup Arge Energy and Control Systems Products: Smartpower Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Grup Arge Energy and Control Systems Smartpower allows SQL Injection.This issue affects Smartpower: through V24.05.27. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0556
CVE ID: CVE-2024-0852 State: PUBLISHED Published: 2025-05-15T20:09:31.811Z Last Updated: 2025-11-13T21:11:05.938Z Vendors: Unknown Products: coreActivity: Activity Logging for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/743c4d79-e1d5-4fb0-a17d-296df2c54e8a/
CVE ID: CVE-2024-0853 State: PUBLISHED Published: 2024-02-03T13:35:25.863Z Last Updated: 2025-06-20T20:04:09.066Z Vendors: curl Products: curl Problem Types: CWE-299 Improper Check for Certificate Revocation Description: curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2024-0853.json - https://curl.se/docs/CVE-2024-0853.html - https://hackerone.com/repor
ences: - https://curl.se/docs/CVE-2024-0853.json - https://curl.se/docs/CVE-2024-0853.html - https://hackerone.com/reports/2298922 - https://security.netapp.com/advisory/ntap-20240307-0004/ - https://security.netapp.com/advisory/ntap-20240426-0009/ - https://security.netapp.com/advisory/ntap-20240503-0012/
CVE ID: CVE-2024-0854 State: PUBLISHED Published: 2024-01-24T10:08:55.529Z Last Updated: 2025-05-30T14:16:55.201Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-601 Description: URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7 and 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advi
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_02
CVE ID: CVE-2024-0855 State: PUBLISHED Published: 2024-02-27T08:30:29.193Z Last Updated: 2024-08-08T20:36:38.282Z Vendors: Unknown Products: Spiffy Calendar Problem Types: CWE-863 Incorrect Authorization Description: The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5d5da91e-3f34-46b0-8db2-354a88bdf934/
CVE ID: CVE-2024-0856 State: PUBLISHED Published: 2024-03-20T05:00:02.675Z Last Updated: 2024-08-05T18:06:03.929Z Vendors: Unknown Products: Appointment Booking Calendar Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/
CVE ID: CVE-2024-0857 State: PUBLISHED Published: 2024-07-18T17:32:35.662Z Last Updated: 2024-08-01T18:18:18.811Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Universal Software Inc. Products: FlexWater Corporate Water Management Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection.This issue affects FlexWater Corporate Water Management: before 5.452.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-1011
CVE ID: CVE-2024-0858 State: PUBLISHED Published: 2024-03-18T19:05:49.195Z Last Updated: 2024-08-02T15:24:33.234Z Vendors: Unknown Products: Innovs HR Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Innovs HR WordPress plugin through 1.0.3.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f6627a35-d158-495e-9d56-69405cfca221/
CVE ID: CVE-2024-0859 State: PUBLISHED Published: 2024-02-05T21:21:42.042Z Last Updated: 2024-11-07T20:44:35.861Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: mra13 Products: Affiliates Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the process_bulk_action function in ListAffiliatesTable.php. This makes it possible for unauthenticated attackers to delete affiliates via a forged request granted they can trick a site administrator into perf
nauthenticated attackers to delete affiliates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/433a03c2-09fd-4ce6-843b-55ad09f4b4f7?source=cve - https://plugins.trac.wordpress.org/browser/affiliates-manager/trunk/classes/ListAffiliatesTable.php - https://plugins.trac.wordpress.org/changeset/3028484/affiliates-manager/trunk?contextall=1&old=3015278&old_path=%2Faffiliates-manager%2Ftrunk
CVE ID: CVE-2024-0860 State: PUBLISHED Published: 2024-03-14T20:54:56.710Z Last Updated: 2024-08-12T20:30:17.682Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Softing Products: edgeConnector, edgeAggregator Problem Types: CWE-319 Description: The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-13
CVE ID: CVE-2024-0861 State: PUBLISHED Published: 2024-02-21T23:30:39.942Z Last Updated: 2025-11-20T04:11:54.541Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-425 Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/439240 - https
E Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/439240 - https://hackerone.com/reports/2316435
CVE ID: CVE-2024-0862 State: PUBLISHED Published: 2024-05-14T19:07:04.897Z Last Updated: 2024-08-20T18:43:47.007Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Proofpoint Products: Enterprise Protection Problem Types: CWE-918 Description: The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an authenticated user to relay HTTP requests from the Protection server to otherwise private network addresses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0001
CVE ID: CVE-2024-0864 State: PUBLISHED Published: 2024-02-29T12:56:23.545Z Last Updated: 2024-10-10T15:36:13.513Z Vendors: Leo Khoa Products: Laragon Problem Types: CWE-434 Description: Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://laragon.org/ - https://cert.pl/en/posts/2024/02/CVE-2024-0864 - https://cert.pl/posts/2024/02/CVE-2024-0864
CVE ID: CVE-2024-0865 State: PUBLISHED Published: 2024-06-12T17:23:00.908Z Last Updated: 2024-08-01T18:18:18.824Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure IT Gateway Problem Types: CWE-798 Description: CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-03.pdf
CVE ID: CVE-2024-0866 State: PUBLISHED Published: 2024-03-26T03:08:07.854Z Last Updated: 2024-08-02T16:16:16.936Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: checkemail Products: Check & Log Email Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce
dPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9307c-680c-43c7-8246-a3e6149c1fb6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050794%40check-email&new=3050794%40check-email&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0867 State: PUBLISHED Published: 2024-05-24T05:30:53.992Z Last Updated: 2024-08-01T18:18:18.811Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: sudar Products: Email Log Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to