Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11006 State: PUBLISHED Published: 2024-11-12T16:06:16.240Z Last Updated: 2024-11-22T16:32:34.967Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-78 Description: Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Poli
CVE ID: CVE-2024-11007 State: PUBLISHED Published: 2024-11-12T16:05:26.487Z Last Updated: 2024-11-22T16:32:05.425Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-78 Description: Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Poli
CVE ID: CVE-2024-11008 State: PUBLISHED Published: 2024-12-11T10:57:29.270Z Last Updated: 2024-12-11T15:04:50.170Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: supercleanse Products: Members – Membership & User Role Editor Plugin Problem Types: CWE-200 Description: The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA
data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6ad375-da04-4b56-8077-e26c148e7527?source=cve - https://plugins.trac.wordpress.org/changeset/3199682/members
CVE ID: CVE-2024-11009 State: PUBLISHED Published: 2024-11-27T11:33:23.230Z Last Updated: 2024-11-27T12:01:11.846Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: pagup Products: Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) Problem Types: CWE-89 Description: The Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for
on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35a690c5-dc7e-4bb7-be5b-c70bd0ea7d10?source=cve - https://wordpress.org/plugins/automatic-internal-links-for-seo/#developers - https://plugins.trac.wordpress.org/changeset/3197510/
CVE ID: CVE-2024-11010 State: PUBLISHED Published: 2024-12-07T09:27:05.743Z Last Updated: 2025-01-06T17:33:33.732Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: softaculous Products: FileOrganizer – Manage WordPress and Website Files Problem Types: CWE-22 Description: The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the 'default_lang' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server, allowing the execution of any Java
el access and above, to include and execute arbitrary JavaScript files on the server, allowing the execution of any JavaScript code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e958653-36c4-4979-89e1-d9411a35a92a?source=cve - https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/init.php#L222 - https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/main/fileorganizer.php#L149 - https://plugins.trac.wordpress.org
/plugins.trac.wordpress.org/browser/fileorganizer/trunk/main/fileorganizer.php#L149 - https://plugins.trac.wordpress.org/changeset/3201635/
CVE ID: CVE-2024-11012 State: PUBLISHED Published: 2024-12-13T09:27:28.012Z Last Updated: 2024-12-23T21:24:54.933Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: ninjateam Products: Notibar – Notification Bar for WordPress Problem Types: CWE-94 Description: The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njt_nofi_text AJAX action in all versions up to, and including, 2.1.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access a
a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1766727d-ba54-4b46-b362-415c14be027d?source=cve - https://plugins.trac.wordpress.org/browser/notibar/trunk/includes/NotificationBar/WpCustomNotification.php#L90 - https://wordpress.org/plugins/notibar/#developers - https://plugins.trac.wordpress.org/changeset/3205224/
CVE ID: CVE-2024-11013 State: PUBLISHED Published: 2024-11-29T08:03:07.458Z Last Updated: 2025-07-24T14:40:37.401Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: NEC Corporation Products: UNIVERGE IX, UNIVERGE IX-R/IX-V Problem Types: CWE-77 Description: Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secin
ment interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv24-009_en.html
CVE ID: CVE-2024-11014 State: PUBLISHED Published: 2024-11-29T08:06:19.712Z Last Updated: 2025-07-24T14:37:20.170Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: NEC Corporation Products: UNIVERGE IX Problem Types: CWE-352 Description: Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the device via the management interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv24-009_en.html
CVE ID: CVE-2024-11015 State: PUBLISHED Published: 2024-12-12T03:23:08.908Z Last Updated: 2024-12-12T16:27:37.738Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tarecord Products: Sign In With Google Problem Types: CWE-287 Description: The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authenticate_user' user function not implementing sufficient null value checks when setting the access token and user information. This makes it possible for unauthenticated attackers to log in as the first user who has signed in using Google OAuth, which could be the site adm
unauthenticated attackers to log in as the first user who has signed in using Google OAuth, which could be the site administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/afe894b0-5e91-4aa2-bbd1-1f74274701cf?source=cve - https://plugins.trac.wordpress.org/browser/sign-in-with-google/trunk/src/admin/class-sign-in-with-google-admin.php#L525
CVE ID: CVE-2024-11016 State: PUBLISHED Published: 2024-11-11T06:51:41.630Z Last Updated: 2024-11-11T16:01:37.603Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Grand Vice info Products: Webopac Problem Types: CWE-89 Description: Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8209-bf75d-1.html - https://www.twcert.org.tw/en/cp-139-8210-46322-2.html
CVE ID: CVE-2024-11017 State: PUBLISHED Published: 2024-11-11T06:54:52.479Z Last Updated: 2024-11-11T16:02:12.805Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Grand Vice info Products: Webopac Problem Types: CWE-434 Description: Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells, which could lead to arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8211-a2da2-1.html - https://www.twcert.org.tw/en/cp-139-8212-a7d3a-2.html
CVE ID: CVE-2024-11018 State: PUBLISHED Published: 2024-11-11T07:02:59.316Z Last Updated: 2024-11-11T16:02:46.183Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Grand Vice info Products: Webopac Problem Types: CWE-434 Description: Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which could lead to arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8213-3413b-1.html - https://www.twcert.org.tw/en/cp-139-8214-64fa2-2.html
CVE ID: CVE-2024-11019 State: PUBLISHED Published: 2024-11-11T07:06:57.452Z Last Updated: 2024-11-11T11:54:39.790Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Grand Vice info Products: Webopac7 Problem Types: CWE-79 Description: Webopac from Grand Vice info has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8215-98582-1.html - https://www.twcert.org.tw/en/cp-139-8216-f7dbf-2.html
CVE ID: CVE-2024-11020 State: PUBLISHED Published: 2024-11-11T07:16:24.533Z Last Updated: 2024-11-11T16:03:11.895Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Grand Vice info Products: Webopac7 Problem Types: CWE-89 Description: Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8217-05b42-1.html - https://www.twcert.org.tw/en/cp-139-8218-e238b-2.html
CVE ID: CVE-2024-11021 State: PUBLISHED Published: 2024-11-11T07:24:09.725Z Last Updated: 2024-11-11T11:54:20.356Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Grand Vice info Products: Webopac Problem Types: CWE-79 Description: Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability. Remote attackers with regular privileges can inject arbitrary JavaScript code into the server. When users visit the compromised page, the code is automatically executed in their browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8219-f12d0-1.html - https://www.twcert.org.tw/en/cp-139-8220-e75c2-2.h
References: - https://www.twcert.org.tw/tw/cp-132-8219-f12d0-1.html - https://www.twcert.org.tw/en/cp-139-8220-e75c2-2.html
CVE ID: CVE-2024-11022 State: PUBLISHED Published: 2024-12-06T12:13:50.253Z Last Updated: 2024-12-06T18:18:19.952Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SICK AG Products: SICK InspectorP61x, SICK InspectorP62x Problem Types: CWE-323 Description: The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. This challenge can be used several times for login and is therefore vulnerable for a replay attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_I
nces: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json
CVE ID: CVE-2024-11023 State: PUBLISHED Published: 2024-11-18T10:19:54.581Z Last Updated: 2024-11-18T15:02:10.044Z Vendors: Firebase Products: JavaScript SDK Problem Types: CWE-79 Description: Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
e SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/firebase/firebase-js-sdk/pull/8056 - https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024
CVE ID: CVE-2024-11024 State: PUBLISHED Published: 2024-11-26T11:04:29.624Z Last Updated: 2024-11-26T16:12:10.472Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scottopolis Products: AppPresser – Mobile App Framework Problem Types: CWE-230 Description: The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possible for unauthenticated attackers, with knowledge of a user's email address, to reset the user's password and gain
possible for unauthenticated attackers, with knowledge of a user's email address, to reset the user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43cb0399-4add-43d5-863c-30e11803bd90?source=cve - https://plugins.trac.wordpress.org/changeset/3192531/apppresser
CVE ID: CVE-2024-11025 State: PUBLISHED Published: 2024-11-27T10:24:50.001Z Last Updated: 2024-11-27T12:01:12.145Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SMA Products: Sunny Central SC 1760-US, Sunny Central SC 1850-US, Sunny Central SC 2000 EV-US, Sunny Central SC 2000-US, Sunny Central SC-2200-10, Sunny Central SC 2200-US, Sunny Central SC-2475-10, Sunny Central SC 2500 EV-US, Sunny Central SC 2660 UP, Sunny Central SC 2660 UP-US, Sunny Central SC 2750 EV-US, Sunny Central SC 2750 UP-US, Sunny Central SC 2800 UP, Sunny Central SC 2800 UP-US, Sunny Central SC 2930 UP, Sunny Central SC 2930 UP-US, Sunny Central SC 3060 UP, Sunny Central SC 3060 UP-U
2800 UP-US, Sunny Central SC 2930 UP, Sunny Central SC 2930 UP-US, Sunny Central SC 3060 UP, Sunny Central SC 3060 UP-US, Sunny Central SC 4000 UP, Sunny Central SC 4000 UP-US, Sunny Central SC 4200 UP, Sunny Central SC 4200 UP-US, Sunny Central SC 4400 UP, Sunny Central SC 4400 UP-JP, Sunny Central SC 4400 UP-US, Sunny Central SC 4600 UP, Sunny Central SC 4600 UP-US, Sunny Central Storage SCS-1900-10, Sunny Central Storage SCS-2200-10, Sunny Central Storage SCS 2300 UP-XT, Sunny Central Storage SCS 2300 UP-XT-US, Sunny Central Storage SCS 2400 UP-XT, Sunny Central Storage SCS 2400 UP-XT-US, Sunny Central Storage SCS-2475-10, Sunny Central Storage SCS 2530 UP-XT, Sunny Central Storage SCS 2
SCS 2400 UP-XT-US, Sunny Central Storage SCS-2475-10, Sunny Central Storage SCS 2530 UP-XT, Sunny Central Storage SCS 2530 UP-XT-US, Sunny Central Storage SCS 2630 UP-XT, Sunny Central Storage SCS 2630 UP-XT-US, Sunny Central Storage SCS-2900-10, Sunny Central Storage SCS 3450 UP, Sunny Central Storage SCS 3450 UP-US, Sunny Central Storage SCS 3450 UP-XT, Sunny Central Storage SCS 3450 UP-XT-JP, Sunny Central Storage SCS 3450 UP-XT-US, Sunny Central Storage SCS 3600 UP, Sunny Central Storage SCS 3600 UP-US, Sunny Central Storage SCS 3600 UP-XT, Sunny Central Storage SCS 3600 UP-XT-US, Sunny Central Storage SCS 3800 UP, Sunny Central Storage SCS 3800 UP-US, Sunny Central Storage SCS 3800 UP-
00 UP-XT-US, Sunny Central Storage SCS 3800 UP, Sunny Central Storage SCS 3800 UP-US, Sunny Central Storage SCS 3800 UP-XT, Sunny Central Storage SCS 3800 UP-XT-US, Sunny Central Storage SCS 3950 UP, Sunny Central Storage SCS 3950 UP-US, Sunny Central Storage SCS 3950 UP-XT, Sunny Central Storage SCS 3950 UP-XT-US Problem Types: CWE-89 Description: An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2024-074
CVE ID: CVE-2024-11026 State: PUBLISHED Published: 2024-11-08T21:31:04.769Z Last Updated: 2024-11-12T15:34:24.548Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Intelligent Apps Products: Freenow App Problem Types: CWE-259, CWE-255 Description: A vulnerability was found in Intelligent Apps Freenow App 12.10.0 on Android. It has been rated as problematic. Affected by this issue is some unknown functionality of the file ch/qos/logback/core/net/ssl/SSL.java of the component Keystore Handler. The manipulation of the argument DEFAULT_KEYSTORE_PASSWORD with the input changeit leads to use of hard-coded password. The attack may be launched remotely. The complexity o
SWORD with the input changeit leads to use of hard-coded password. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283544 - https://vuldb.com/?ctiid.283544 - https://vuldb.com/?submit.434538 - https://github.com/secuserx/CVE/blob/main/%5BHardcoded%20Keystore%20Password%5D%20found%20in%20FREENOW%20(ex%20Beat%20app)%2012.10.0%20-%20(SSL.java).md
CVE ID: CVE-2024-11028 State: PUBLISHED Published: 2024-11-13T09:30:26.145Z Last Updated: 2024-11-13T14:59:40.159Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: icdsoft Products: MultiManager WP – Manage All Your WordPress Sites Easily Problem Types: CWE-288 Description: The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the user impersonation feature inappropriately determining the current user via user-supplied input. This makes it possible for unauthenticated attackers to generate an impersonation link that will allow them
lied input. This makes it possible for unauthenticated attackers to generate an impersonation link that will allow them to log in as any existing user, such as an administrator. NOTE: The user impersonation feature was disabled in version 1.1.0 and re-enabled with a patch in version 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de8e7adc-3777-4fb1-a708-68da950e3d4f?source=cve - https://plugins.trac.wordpress.org/changeset/3184657/multimanager-wp - https://plugins.trac.wordpress.org/changeset/3184678/multimanager-wp - https://plugins.trac.wordpress.org/changeset/3184826/multimanager-wp
CVE ID: CVE-2024-11029 State: PUBLISHED Published: 2025-01-15T12:55:30.964Z Last Updated: 2025-11-20T18:21:31.557Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-497 Description: A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log i
ials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:0334 - https://access.redhat.com/security/cve/CVE-2024-11029 - https://bugzilla.redhat.com/show_bug.cgi?id=2325557
CVE ID: CVE-2024-11030 State: PUBLISHED Published: 2025-03-20T10:11:15.720Z Last Updated: 2025-03-20T13:24:02.898Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-918 Description: GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_everything() API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Academic's Gradio Web server's credentials to access unauthorized web resources. Additional Analyst Notes: - CISA ADP Vulnr
demic's Gradio Web server's credentials to access unauthorized web resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/729d9928-c28a-40fd-8a86-bb4ca2984bba