Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-39591 State: PUBLISHED Published: 2024-08-13T05:00:42.912Z Last Updated: 2024-08-13T13:53:27.312Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Document Builder Problem Types: CWE-862 Description: SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3477423 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-39592 State: PUBLISHED Published: 2024-07-09T03:45:56.018Z Last Updated: 2024-08-02T04:26:15.969Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP PDCE Problem Types: CWE-862 Description: Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3483344
CVE ID: CVE-2024-39593 State: PUBLISHED Published: 2024-07-09T03:51:46.533Z Last Updated: 2024-08-02T04:26:15.997Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: SAP_SE Products: SAP Landscape Management Problem Types: CWE-200 Description: SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can cause high impact on confidentiality of the managed entities. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3466801
CVE ID: CVE-2024-39594 State: PUBLISHED Published: 2024-07-09T04:10:40.727Z Last Updated: 2024-08-02T04:26:16.083Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Business Warehouse - Business Planning and Simulation Problem Types: CWE-79 Description: SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
y and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3482217
CVE ID: CVE-2024-39595 State: PUBLISHED Published: 2024-07-09T04:13:49.560Z Last Updated: 2024-08-02T04:26:16.023Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Business Warehouse - Business Planning and Simulation Problem Types: CWE-79 Description: SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows users to modify website content and on successful exploitation, an attacker can cause low impact to the confidentiality and integrity of the application. Additional Analyst Notes: -
, an attacker can cause low impact to the confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3482217
CVE ID: CVE-2024-39596 State: PUBLISHED Published: 2024-07-09T04:25:57.251Z Last Updated: 2024-08-02T04:26:16.017Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Enable Now Problem Types: CWE-862 Description: Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be restricted. On successful exploitation, the attacker can cause limited impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3476348
CVE ID: CVE-2024-39597 State: PUBLISHED Published: 2024-07-09T03:48:11.488Z Last Updated: 2024-08-02T04:26:15.985Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Commerce Problem Types: CWE-285 Description: In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not configured as isolated site, this can also grant access to other non-isolated early login sites, even if registration is not enabled for those other sites. Additional Analyst Not
other non-isolated early login sites, even if registration is not enabled for those other sites. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3490515
CVE ID: CVE-2024-39598 State: PUBLISHED Published: 2024-07-09T04:04:41.283Z Last Updated: 2024-08-02T04:26:15.953Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP CRM WebClient UI Problem Types: CWE-918 Description: SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday -
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3467377
CVE ID: CVE-2024-39599 State: PUBLISHED Published: 2024-07-09T04:24:31.103Z Last Updated: 2024-08-02T04:26:16.192Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-693 Description: Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. This leads to a low impact on the application's confidentiality, integrity, and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sa
d availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3456952
CVE ID: CVE-2024-39600 State: PUBLISHED Published: 2024-07-09T04:19:47.498Z Last Updated: 2024-08-02T04:26:16.037Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP GUI for Windows Problem Types: CWE-200 Description: Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attacker to get hold of the password and impersonate the affected user. As a result, it has a high impact on the confidentiality but there is no impact on the integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sap
ilability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3461110
CVE ID: CVE-2024-39601 State: PUBLISHED Published: 2024-07-22T13:54:50.768Z Last Updated: 2025-11-03T20:38:20.135Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Siemens Products: CPCI85 Central Processing/Communication, SICORE Base system Problem Types: CWE-306 Description: A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). Affected devices allow a remote authenticated user or an unauthenticated user with physical access to downgrade the firmware of the device. This could allow an attacker to downgrade the device to older versions with known vulnerabilities. Add
re of the device. This could allow an attacker to downgrade the device to older versions with known vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-071402.html
CVE ID: CVE-2024-39602 State: PUBLISHED Published: 2025-01-14T14:21:01.049Z Last Updated: 2025-01-15T20:08:23.476Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Wavlink Products: Wavlink AC3000 Problem Types: CWE-15 Description: An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024
Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2052
CVE ID: CVE-2024-39603 State: PUBLISHED Published: 2025-01-14T14:21:20.463Z Last Updated: 2025-01-14T16:04:09.905Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Wavlink Products: Wavlink AC3000 Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerabili
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2042
CVE ID: CVE-2024-39604 State: PUBLISHED Published: 2025-01-14T14:21:22.841Z Last Updated: 2025-01-15T20:56:29.993Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Wavlink Products: Wavlink AC3000 Problem Types: CWE-74 Description: A command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2038
CVE ID: CVE-2024-39605 State: PUBLISHED Published: 2024-11-11T14:57:23.741Z Last Updated: 2024-11-11T16:07:22.507Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAScreen Problem Types: CWE-121 Description: If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the attacker to remotely execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-312-02 - https://www.deltaww.com/en-US/Cybersecurity_Advisory
CVE ID: CVE-2024-39606 State: PUBLISHED Published: 2025-02-12T21:20:04.502Z Last Updated: 2025-02-13T19:48:13.951Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows Problem Types: Denial of Service, CWE-20 Description: Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01224.htm
: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01224.html
CVE ID: CVE-2024-39607 State: PUBLISHED Published: 2024-08-01T01:17:00.982Z Last Updated: 2025-02-17T05:37:48.242Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ELECOM CO.,LTD. Products: WRC-X1500GS-B, WRC-X1500GSA-B, WRC-X1800GS-B, WRC-X1800GSA-B, WRC-X1800GSH-B, WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B, WRC-XE5400GS-G, WRC-XE5400GSA-G, WRC-X6000QS-G, WRC-X6000QSA-G, WRC-X6000XS-G, WRC-X6000XST-G Problem Types: CWE-78 Description: OS command injection vulnerability exists in ELECOM wireless LAN routers. A specially crafted request may be sent to the affected product by a logged-in user with an administrative privilege to execute an arbitrary OS com
may be sent to the affected product by a logged-in user with an administrative privilege to execute an arbitrary OS command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20240730-01/ - https://jvn.jp/en/jp/JVN06672778/
CVE ID: CVE-2024-39608 State: PUBLISHED Published: 2025-01-14T14:21:23.983Z Last Updated: 2025-01-14T16:04:12.016Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Wavlink Products: Wavlink AC3000 Problem Types: CWE-306 Description: A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can send an unauthenticated message to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2036
CVE ID: CVE-2024-39609 State: PUBLISHED Published: 2024-11-13T21:10:52.544Z Last Updated: 2024-11-14T19:41:42.256Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server Board M70KLP Problem Types: escalation of privilege, CWE-284 Description: Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html
CVE ID: CVE-2024-39610 State: PUBLISHED Published: 2024-11-15T05:26:37.148Z Last Updated: 2024-11-15T17:54:38.148Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: unclebob Products: FitNesse Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/unclebob/fitnesse/releases/tag/20241026 - https://fitnesse.org/FitNesseDownload - https://jvn.jp/en/jp/JVN36791327/
CVE ID: CVE-2024-39612 State: PUBLISHED Published: 2024-09-02T03:25:05.302Z Last Updated: 2024-09-03T14:54:40.783Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125, CWE-922 Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE ID: CVE-2024-39613 State: PUBLISHED Published: 2024-09-16T06:40:58.501Z Last Updated: 2024-09-16T13:05:12.477Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-427 Description: Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-39614 State: PUBLISHED Published: 2024-07-10T00:00:00.000Z Last Updated: 2025-11-04T16:12:29.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/forum/#%21forum/django-announce - https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
CVE ID: CVE-2024-39619 State: PUBLISHED Published: 2024-08-01T20:44:53.608Z Last Updated: 2024-08-02T14:55:02.016Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CridioStudio Products: ListingPro Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through 2.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/listingpro-plugin/wordpress-listingpro-plugin-2-9-3-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-39620 State: PUBLISHED Published: 2024-08-29T14:14:39.262Z Last Updated: 2024-08-29T14:27:33.063Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: CridioStudio Products: ListingPro Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro allows SQL Injection.This issue affects ListingPro: from n/a through 2.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/listingpro-plugin/wordpress-listingpro-plugin-2-9-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-39621 State: PUBLISHED Published: 2024-08-01T20:42:45.163Z Last Updated: 2024-08-02T15:04:07.329Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: CridioStudio Products: ListingPro Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through 2.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/listingpro-plugin/wordpress-listingpro-plugin-2-9-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-39622 State: PUBLISHED Published: 2024-08-29T14:18:36.446Z Last Updated: 2024-08-29T14:50:38.305Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: CridioStudio Products: ListingPro Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro.This issue affects ListingPro: from n/a through 2.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/listingpro/wordpress-listingpro-theme-2-9-3-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-39623 State: PUBLISHED Published: 2025-01-02T12:56:23.968Z Last Updated: 2025-01-02T14:52:00.714Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: CridioStudio Products: ListingPro Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro allows Authentication Bypass.This issue affects ListingPro: from n/a through 2.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/listingpro/vulnerability/wordpress-listingpro-theme-2-9-3-cross-site-request-forgery-csrf-to-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2024-39624 State: PUBLISHED Published: 2024-08-01T20:40:30.563Z Last Updated: 2024-08-01T20:51:04.326Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: CridioStudio Products: ListingPro Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through 2.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/listingpro/wordpress-listingpro-theme-2-9-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-39625 State: PUBLISHED Published: 2024-11-01T14:17:54.939Z Last Updated: 2024-11-01T18:24:16.414Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: icegram Products: Icegram Problem Types: CWE-862 Description: Missing Authorization vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Icegram: from n/a through 3.1.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-engage-plugin-3-1-24-unauthenticated-message-duplication-vulnerability?_s_id=cve
CVE ID: CVE-2024-39626 State: PUBLISHED Published: 2024-08-01T22:32:47.232Z Last Updated: 2024-08-02T14:26:15.608Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: 5 Star Plugins Products: Pretty Simple Popup Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 5 Star Plugins Pretty Simple Popup Builder allows Stored XSS.This issue affects Pretty Simple Popup Builder: from n/a through 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pretty-simple-popup-builder/wordpress-pretty-simple-popup-buil
ferences: - https://patchstack.com/database/vulnerability/pretty-simple-popup-builder/wordpress-pretty-simple-popup-builder-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-39627 State: PUBLISHED Published: 2024-08-01T22:30:47.822Z Last Updated: 2024-08-02T18:18:55.754Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Imagely Products: NextGEN Gallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Imagely NextGEN Gallery allows Stored XSS.This issue affects NextGEN Gallery: from n/a through 3.59.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/nextgen-gallery/wordpress-photo-gallery-sliders-proofing-and-themes-nextgen-gallery-plugin-3-59-3-cross-site-sc
rability/nextgen-gallery/wordpress-photo-gallery-sliders-proofing-and-themes-nextgen-gallery-plugin-3-59-3-cross-site-scripting-xss-vulnerability?_s_id=cve