Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10899 State: PUBLISHED Published: 2024-11-20T06:42:56.080Z Last Updated: 2024-11-20T20:24:29.071Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: wcproducttable Products: WooCommerce Product Table Lite Problem Types: CWE-94 Description: The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The same 'id' parameter is vulnerable to Re
s it possible for unauthenticated attackers to execute arbitrary shortcodes. The same 'id' parameter is vulnerable to Reflected Cross-Site Scripting as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9b010ff-8a4a-4553-bb2b-d58a254d7ee4?source=cve - https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/3.8.6/main.php#L1778 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3190789%40wc-product-table-lite&new=3190789%40wc-product-table-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10900 State: PUBLISHED Published: 2024-11-20T06:42:54.323Z Last Updated: 2024-11-20T15:16:27.429Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: metagauss Products: ProfileGrid – User Profiles, Groups and Communities Problem Types: CWE-862 Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_remove_file_attachment() function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary user meta which can do things
for authenticated attackers, with subscriber-level access and above, to delete arbitrary user meta which can do things like deny an administrator's access to their site. . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e5fcfa-ebc9-45f6-9cbc-c9e3540baa6f?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php#L1902 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3190069%40profilegrid-user-profiles-groups-and-communities&new=3190069%40profilegrid-user-profiles-groups-and-communities&sfp_email
rofilegrid-user-profiles-groups-and-communities&new=3190069%40profilegrid-user-profiles-groups-and-communities&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10901 State: PUBLISHED Published: 2025-03-20T10:09:40.856Z Last Updated: 2025-03-20T18:36:09.245Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: eosphoros-ai Products: eosphoros-ai/db-gpt Problem Types: CWE-434 Description: In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as `__init__.py` in the Python
This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as `__init__.py` in the Python's `/site-packages/` directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/db2c1d59-6e3a-4553-a1f6-94c8df162a18
CVE ID: CVE-2024-10902 State: PUBLISHED Published: 2025-03-20T10:09:18.262Z Last Updated: 2025-10-15T12:50:12.310Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: eosphoros-ai Products: eosphoros-ai/db-gpt Problem Types: CWE-22 Description: In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential for remote code execution (RCE) by writing malicious files, such as a malicious `__init__.py` in the Py
es the potential for remote code execution (RCE) by writing malicious files, such as a malicious `__init__.py` in the Python's `/site-packages/` directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f7fbf76e-aa1c-4106-b007-e9579f4f7d5f
CVE ID: CVE-2024-10903 State: PUBLISHED Published: 2024-12-26T06:00:05.613Z Last Updated: 2024-12-30T17:13:04.285Z Vendors: Unknown Products: Broken Link Checker Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/39027390-ce01-4dd5-a979-426785aa7acb/
CVE ID: CVE-2024-10904 State: PUBLISHED Published: 2025-03-03T19:37:16.214Z Last Updated: 2025-04-10T19:37:32.457Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: ArcGIS Server Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no im
k are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE ID: CVE-2024-10905 State: PUBLISHED Published: 2024-12-02T14:49:51.199Z Last Updated: 2025-01-06T17:42:22.215Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SailPoint Technologies Products: IdentityIQ Problem Types: CWE-66 Description: IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sailpoint.com/security-advisories/identityiq-im
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sailpoint.com/security-advisories/identityiq-improper-access-control-vulnerability-cve-2024-10905
CVE ID: CVE-2024-10906 State: PUBLISHED Published: 2025-03-20T10:10:05.603Z Last Updated: 2025-03-20T18:31:38.806Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) Vendors: eosphoros-ai Products: eosphoros-ai/db-gpt Problem Types: CWE-352 Description: In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to interact with any endpoints of the instance, even if the ins
rgery (CSRF). An attacker can exploit this vulnerability to interact with any endpoints of the instance, even if the instance is not publicly exposed to the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8864aca5-a342-4dab-b866-b2882ba6f160
CVE ID: CVE-2024-10907 State: PUBLISHED Published: 2025-03-20T10:10:13.852Z Last Updated: 2025-10-15T12:50:14.123Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: lm-sys Products: lm-sys/fastchat Problem Types: CWE-835 Description: In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary. Each extra character is processed in an infinite loop, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticate
excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/bf3ca81d-3508-4455-95d9-0b653e46d6e4
CVE ID: CVE-2024-10908 State: PUBLISHED Published: 2025-03-20T10:09:58.361Z Last Updated: 2025-03-20T18:32:18.205Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: lm-sys Products: lm-sys/fastchat Problem Types: CWE-601 Description: An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2
CVE ID: CVE-2024-10909 State: PUBLISHED Published: 2024-12-06T09:22:58.651Z Last Updated: 2024-12-06T17:31:07.849Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: kingyes Products: Pojo Forms Problem Types: CWE-94 Description: The The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via form_preview_shortcode AJAX action in all versions up to, and including, 1.4.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. This was p
ossible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. This was partially fixed in version 1.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/511ce6f6-aea3-4c37-8312-d6e5ff2fdf6f?source=cve - https://plugins.trac.wordpress.org/browser/pojo-forms/tags/1.4.7/classes/class-pojo-forms-ajax.php#L16 - https://wordpress.org/plugins/pojo-forms/#developers - https://plugins.trac.wordpress.org/changeset/3201936/
CVE ID: CVE-2024-10910 State: PUBLISHED Published: 2024-12-12T04:23:10.508Z Last Updated: 2024-12-12T15:01:28.858Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: g5theme Products: Grid Plus – Unlimited grid layout Problem Types: CWE-94 Description: The The Grid Plus – Unlimited grid layout plugin for WordPress is vulnerable to arbitrary shortcode execution via grid_plus_load_by_category AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. A
lue before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/266032a8-a139-4a14-8eda-8be7a66357df?source=cve - https://plugins.trac.wordpress.org/browser/grid-plus/tags/1.3.5/core/ajax_fe.php#L19 - https://wordpress.org/plugins/grid-plus/#developers
CVE ID: CVE-2024-10912 State: PUBLISHED Published: 2025-03-20T10:10:59.830Z Last Updated: 2025-03-20T18:14:28.739Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: lm-sys Products: lm-sys/fastchat Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
server to become overwhelmed and unavailable to legitimate users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/52f335b8-1134-4d0f-acb4-efef516de414
CVE ID: CVE-2024-10913 State: PUBLISHED Published: 2024-11-20T13:55:12.878Z Last Updated: 2024-11-20T14:39:30.433Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: migrate Products: Clone Problem Types: CWE-502 Description: The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow t
e software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/16569267-ab52-4b96-86f0-d37c470a3938?source=cve - https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy//tags/2.4.6/lib/icit_srdb_replacer.php#L24 - https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.4.7/lib/icit_srdb_replacer.php#L24
CVE ID: CVE-2024-10914 State: PUBLISHED Published: 2024-11-06T13:31:05.242Z Last Updated: 2024-11-24T14:48:27.443Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DNS-320, DNS-320LW, DNS-325, DNS-340L Problem Types: CWE-78, CWE-74, CWE-707 Description: A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument name leads to os command injection. The attack can be launched remotely. The complexity of an attack is rather high. The ex
e leads to os command injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.283309 - https://vuldb.com/?ctiid.283309 - https://vuldb.com/?submit.432847 - https://netsecfish.notion.site/Command-Injection-Vulnerability-in-name-parameter-for-D-Link-NAS-12d6b683e67c80c49ffcc9214c239a07?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2024-10915 State: PUBLISHED Published: 2024-11-06T14:00:06.041Z Last Updated: 2024-11-06T15:26:07.833Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DNS-320, DNS-320LW, DNS-325, DNS-340L Problem Types: CWE-78, CWE-74, CWE-707 Description: A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument group leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation
os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283310 - https://vuldb.com/?ctiid.283310 - https://vuldb.com/?submit.432848 - https://netsecfish.notion.site/Command-Injection-Vulnerability-in-group-parameter-for-D-Link-NAS-12d6b683e67c803fa1a0c0d236c9a4c5?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2024-10916 State: PUBLISHED Published: 2024-11-06T15:00:08.202Z Last Updated: 2024-11-06T16:15:00.331Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: D-Link Products: DNS-320, DNS-320LW, DNS-325, DNS-340L Problem Types: CWE-200, CWE-284 Description: A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the file /xml/info.xml of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst No
ble to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283311 - https://vuldb.com/?ctiid.283311 - https://vuldb.com/?submit.432849 - https://netsecfish.notion.site/Information-Disclosure-Vulnerability-Report-in-xml-info-xml-for-D-Link-NAS-12d6b683e67c8019a311e699582f51b6?pvs=4 - https://www.dlink.com/
CVE ID: CVE-2024-10917 State: PUBLISHED Published: 2024-11-11T16:55:11.393Z Last Updated: 2024-11-12T20:14:21.838Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Eclipse Foundation Products: Open J9 Problem Types: CWE-190 Description: In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/47 - https://github.com/eclipse-openj9/openj9/pull/20362 - https://github.com/ecl
.org/security/cve-assignement/-/issues/47 - https://github.com/eclipse-openj9/openj9/pull/20362 - https://github.com/eclipse-openj9/openj9/releases/tag/openj9-0.48.0
CVE ID: CVE-2024-10918 State: PUBLISHED Published: 2025-02-27T11:44:25.170Z Last Updated: 2025-11-03T20:36:25.510Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: libmodbus Products: libmodbus Problem Types: CWE-121 Description: Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflow the buffer allocated for the Modbus response if the function tries to reply to a Modbus request with an unexpected length. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-10918
CVE ID: CVE-2024-10919 State: PUBLISHED Published: 2024-11-06T16:00:07.297Z Last Updated: 2024-11-06T16:11:02.111Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: didi Products: Super-Jacoco Problem Types: CWE-78, CWE-74 Description: A vulnerability has been found in didi Super-Jacoco 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cov/triggerUnitCover. The manipulation of the argument uuid leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283315 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283315 - https://vuldb.com/?ctiid.283315 - https://vuldb.com/?submit.432689 - https://github.com/didi/super-jacoco/issues/49
CVE ID: CVE-2024-10920 State: PUBLISHED Published: 2024-11-06T16:00:09.086Z Last Updated: 2024-11-06T16:09:49.168Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: mariazevedo88 Products: travels-java-api Problem Types: CWE-321, CWE-320 Description: A vulnerability was found in mariazevedo88 travels-java-api up to 5.0.1 and classified as problematic. Affected by this issue is the function doFilterInternal of the file travels-java-api-master\src\main\java\io\github\mariazevedo88\travelsjavaapi\filters\JwtAuthenticationTokenFilter.java of the component JWT Secret Handler. The manipulation leads to use of hard-coded cryptographic key . The attack may be launched re
ponent JWT Secret Handler. The manipulation leads to use of hard-coded cryptographic key . The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283316 - https://vuldb.com/?ctiid.283316 - https://vuldb.com/?submit.433458 - https://github.com/mariazevedo88/travels-java-api/issues/23
CVE ID: CVE-2024-10921 State: PUBLISHED Published: 2024-11-14T16:04:04.062Z Last Updated: 2024-11-15T09:45:56.720Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-158 Description: An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2. Additional Analyst
B Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-96419
CVE ID: CVE-2024-10922 State: REJECTED Published: 2024-11-07T01:57:12.331Z Last Updated: 2024-12-12T18:00:15.384Z Description: No description available.
CVE ID: CVE-2024-10923 State: PUBLISHED Published: 2024-11-12T16:55:11.548Z Last Updated: 2024-11-21T16:20:14.503Z Vendors: OpenText™ Products: ALM Octane Management Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ ALM Octane Management allows Stored XSS. The vulnerability could result in a remote code execution attack. This issue affects ALM Octane Management: from 16.2.100 through 24.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000036146?language=en_US
CVE ID: CVE-2024-10924 State: PUBLISHED Published: 2024-11-15T03:18:45.746Z Last Updated: 2024-11-19T13:37:03.351Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Really Simple Plugins, rogierlankhorst Products: Really Simple Security Pro multisite, Really Simple Security – Simple and Performant Security (formerly Really Simple SSL), Really Simple Security Pro Problem Types: CWE-288 Description: The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_