Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ver shutting down. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8b642a78-2b80-4fb0-9b2f-8ba0ff37db6a
CVE ID: CVE-2024-8021 State: PUBLISHED Published: 2025-03-20T10:11:13.192Z Last Updated: 2025-03-20T13:11:17.795Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-601 Description: An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/adc23067-ec04-47ef-9265-a
e. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/adc23067-ec04-47ef-9265-afd452071888
CVE ID: CVE-2024-8022 State: PUBLISHED Published: 2024-08-20T23:31:03.646Z Last Updated: 2024-08-22T13:53:24.884Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Genexis Products: Tilgin Home Gateway Problem Types: CWE-79 Description: A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been rated as problematic. This issue affects some unknown processing of the file /vood/cgi-bin/vood_view.cgi?lang=EN&act=user/spec_conf&sessionId=86213915328111654515&user=A&message2user=Account%20updated. The manipulation of the argument Phone Number leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public
Number leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275291 - https://vuldb.com/?ctiid.275291 - https://vuldb.com/?submit.389913
CVE ID: CVE-2024-8023 State: PUBLISHED Published: 2024-08-20T23:31:05.010Z Last Updated: 2024-08-21T13:41:36.426Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: chillzhuang Products: SpringBlade Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list?updatexml. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrich
was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275292 - https://vuldb.com/?ctiid.275292 - https://vuldb.com/?submit.390087 - https://gist.github.com/topsky979/74dcbe81062718f314d81fb6ad5dc1e0
CVE ID: CVE-2024-8024 State: PUBLISHED Published: 2025-03-20T10:10:09.073Z Last Updated: 2025-03-20T18:30:47.993Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: netease-youdao Products: netease-youdao/qanything Problem Types: CWE-346 Description: A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially leading to sensitive information exposure. Properly implementing a restrictive CORS policy is crucial to prevent such security issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/bda53fab-88aa-4e03-8d
ssues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/bda53fab-88aa-4e03-8d9d-4cf50a98ffc7
CVE ID: CVE-2024-8025 State: PUBLISHED Published: 2024-11-22T21:11:29.489Z Last Updated: 2024-12-05T14:40:39.072Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Nikon Products: NEF Codec Problem Types: CWE-122 Description: Nikon NEF Codec Thumbnail Provider NRW File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nikon NEF Codec. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of NRW files. The issue results from th
cious page or open a malicious file. The specific flaw exists within the parsing of NRW files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19873. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1422/ - https://downloadcenter.nikonimglib.com/en/download/sw/259.html
CVE ID: CVE-2024-8026 State: PUBLISHED Published: 2025-03-20T10:11:03.731Z Last Updated: 2025-03-20T15:49:53.923Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: netease-youdao Products: netease-youdao/qanything Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, uploading, listing, deleting files, and managing knowledge bases. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
uploading, listing, deleting files, and managing knowledge bases. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e57f1e32-0fe5-4997-926c-587461aa6274
CVE ID: CVE-2024-8027 State: PUBLISHED Published: 2025-03-20T10:10:30.392Z Last Updated: 2025-03-20T18:20:41.263Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: netease-youdao Products: netease-youdao/qanything Problem Types: CWE-79 Description: A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything. Attackers can upload malicious knowledge files to the knowledge base, which can trigger XSS attacks during user chats. This vulnerability affects all versions prior to the fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/cf75f024-3d64-416d-adfe-c4255d7c3f34
CVE ID: CVE-2024-8028 State: PUBLISHED Published: 2025-03-20T10:09:52.038Z Last Updated: 2025-10-15T12:49:54.627Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-770 Description: A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can be exploited by sending a single crafted request, affecting all users on the server. Add
on inaccessible. This issue can be exploited by sending a single crafted request, affecting all users on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/55530ecb-0ac2-4dc1-9527-bf24de594a57
CVE ID: CVE-2024-8029 State: PUBLISHED Published: 2025-03-20T10:09:21.980Z Last Updated: 2025-03-20T18:55:55.477Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: imartinez Products: imartinez/privategpt Problem Types: CWE-79 Description: An XSS vulnerability was discovered in the upload file(s) process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/5941dc63-a4db-4b04-8007-bcaa828106d0
CVE ID: CVE-2024-8030 State: PUBLISHED Published: 2024-08-28T02:05:47.143Z Last Updated: 2024-08-28T13:44:08.460Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: bdthemes Products: Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider Problem Types: CWE-502 Description: The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_wishlist cookie in versions up to , and inc
Injection via deserialization of untrusted input via the _ultimate_store_kit_wishlist cookie in versions up to , and including, 2.0.3. This makes it possible for an unauthenticated attacker to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker or above to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef566dca-91ed-4929-b36b-4e424e07e1d4?source=cve - https://plugins.trac.wordpress.org/changeset/3141022/ultimate-sto
s/id/ef566dca-91ed-4929-b36b-4e424e07e1d4?source=cve - https://plugins.trac.wordpress.org/changeset/3141022/ultimate-store-kit/trunk/includes/helper.php
CVE ID: CVE-2024-8031 State: PUBLISHED Published: 2025-05-15T20:07:12.565Z Last Updated: 2025-05-17T03:24:49.534Z Vendors: Unknown Products: Secure Downloads Problem Types: CWE-552 Files or Directories Accessible to External Parties Description: The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c6f54e6f-0a50-424f-ae3a-00b9880d9f13/
CVE ID: CVE-2024-8032 State: PUBLISHED Published: 2025-05-15T20:07:12.766Z Last Updated: 2025-05-20T19:20:57.776Z Vendors: Unknown Products: Smooth Gallery Replacement Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4c9120b1-ca81-411b-a2e2-a8d30f32a74b/
CVE ID: CVE-2024-8033 State: PUBLISHED Published: 2024-08-21T20:20:26.856Z Last Updated: 2025-03-25T15:44:57.756Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user to install a malicious application to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/350256139
CVE ID: CVE-2024-8034 State: PUBLISHED Published: 2024-08-21T20:20:27.045Z Last Updated: 2025-03-27T14:26:25.383Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/353858776
CVE ID: CVE-2024-8035 State: PUBLISHED Published: 2024-08-21T20:20:27.239Z Last Updated: 2025-03-13T20:31:02.015Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/40059470
CVE ID: CVE-2024-8036 State: PUBLISHED Published: 2024-10-25T16:57:31.114Z Last Updated: 2024-10-30T17:20:11.747Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H) Vendors: ABB Products: Relion Protection Relays RE_611 IEC, Relion Protection Relays REF615 IEC, Relion Protection Relays REF615 ANSI, Relion Protection Relays REX615, Relion Protection Relays REX610, Relion Protection Relays REX640, Substation Merging Unit SMU615, Smart Substation Control and Protection SSC600, Relion Protection Relays REF615R ANSI, Relion Protection Relays RED615 IEC, Relion Protection Relays 615 series IEC, Relion Protection Relays 615 series CN, Relion Protection Relays 615 series ANSI,
ion Protection Relays 615 series IEC, Relion Protection Relays 615 series CN, Relion Protection Relays 615 series ANSI, Relion Protection Relays RER615, Relion Protection Relays REC615, RBX615, RER620 ANSI, 620 Series IEC/CN, RE_630, RIO600, COM600, SPA ZC-400, COM600F ANSI, SPA ZC-402, REF542plus, SUE 3000, ARG600/ARP600/ARR600/ARC600 single SIM, ARG600/ARP600 dual SIM, ARM600, REC601/RER601, REC603/RER603 Problem Types: CWE-347 Description: ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a specially crafted firmware or configuration to the system node, causing the node to stop, bec
lnerabilities by sending a specially crafted firmware or configuration to the system node, causing the node to stop, become inaccessible, or allowing the attacker to take control of the node. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=2NGA001911&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-8037 State: PUBLISHED Published: 2024-10-02T10:12:32.318Z Last Updated: 2024-11-01T15:31:40.233Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Canonical Ltd. Products: Juju Description: Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/juju/juju/security/advisories/GHSA-8v4w-f4r9-7h6x - https://www.cv
SA ADP Vulnrichment: References: - https://github.com/juju/juju/security/advisories/GHSA-8v4w-f4r9-7h6x - https://www.cve.org/CVERecord?id=CVE-2024-8037
CVE ID: CVE-2024-8038 State: PUBLISHED Published: 2024-10-02T10:12:38.806Z Last Updated: 2024-10-02T13:53:24.639Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: Canonical Ltd. Products: Juju Problem Types: CWE-420 Description: Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq - https://www.cve.org/CVERecord?id=CVE-2024-8038
CVE ID: CVE-2024-8039 State: PUBLISHED Published: 2024-09-14T03:28:20.825Z Last Updated: 2024-09-16T19:14:21.273Z Vendors: TECNO Products: com.afmobi.boomplayer Problem Types: CWE-732 Description: Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.tecno.com/SRC/blogdetail/307?lang=en_US - https://security.tecno.com/SRC/securityUpdates?type=SA
CVE ID: CVE-2024-8040 State: PUBLISHED Published: 2024-10-16T11:28:50.444Z Last Updated: 2024-10-16T16:11:10.021Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Dassault Systèmes Products: 3DSwymer Problem Types: CWE-639 Description: An authorization bypass through user-controlled key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an authenticated attacker to access some unauthorized data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-8041 State: PUBLISHED Published: 2024-08-22T15:30:37.643Z Last Updated: 2024-08-29T15:05:01.304Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-400 Description: A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A denial of service could occur upon importing a maliciously crafted repository using the GitHub importer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/463092 - https://hackerone.com/reports/2499070
CVE ID: CVE-2024-8042 State: PUBLISHED Published: 2024-09-09T15:02:38.681Z Last Updated: 2024-09-09T17:12:45.623Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: Rapid7 Products: Insight Platform Problem Types: CWE-862 Description: Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect customer. This vulnerability is remediated as of August 14, 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
erability is remediated as of August 14, 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/862.html
CVE ID: CVE-2024-8043 State: PUBLISHED Published: 2024-09-17T06:00:03.699Z Last Updated: 2024-09-17T14:42:45.857Z Vendors: Unknown Products: Vikinghammer Tweet Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2ba27715-add4-4e2c-ad0d-83ebdc26aec1/
CVE ID: CVE-2024-8044 State: PUBLISHED Published: 2024-09-17T06:00:04.660Z Last Updated: 2024-09-17T14:38:33.331Z Vendors: Unknown Products: infolinks Ad Wrap Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/14b42ba8-7a8b-4fbf-86fb-6095879ec05c/
CVE ID: CVE-2024-8045 State: PUBLISHED Published: 2024-09-11T07:31:33.110Z Last Updated: 2024-09-11T13:15:58.773Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nko Products: Advanced WordPress Backgrounds Problem Types: CWE-79 Description: The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78e49869-5e7e-45f2-8239-4df18b28db53?source=cve - https://plugins.trac.wordpress.org/browser/advanced-backgrounds/trunk/assets/admin/gutenberg/index.min.js - https://wordpress.org/plugins/advanced-backgrounds/#developers - https://plugins.trac.wordpress.org/browser/advanced-backgrounds/trunk/classes/class-gutenberg.php#L146 - https://plugins.trac.wordpress.org/browser/advanced-backgrounds/trunk/assets/admin/gutenberg/block.json#L69 - https://plugi
ps://plugins.trac.wordpress.org/browser/advanced-backgrounds/trunk/assets/admin/gutenberg/block.json#L69 - https://plugins.trac.wordpress.org/changeset/3147938/
CVE ID: CVE-2024-8046 State: PUBLISHED Published: 2024-08-27T07:34:33.457Z Last Updated: 2024-08-27T13:01:54.796Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpwax Products: Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Problem Types: CWE-79 Description: The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages t
it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89525af0-105a-4d7d-93d1-af724a837e7a?source=cve - https://plugins.trac.wordpress.org/browser/logo-showcase-ultimate/tags/1.4.1/lcg_adl_main.php#L236 - https://wordpress.org/plugins/logo-showcase-ultimate/#developers - https://plugins.trac.wordpress.org/changeset/3141393/#file3 - https://plugins.trac.wordpress.org/changeset/3141393/
CVE ID: CVE-2024-8047 State: PUBLISHED Published: 2024-09-17T06:00:05.001Z Last Updated: 2024-09-17T14:29:59.767Z Vendors: Unknown Products: Visual Sound (old) Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0ae1474c-9193-48ee-8cf6-d19900ad95f4/
CVE ID: CVE-2024-8048 State: PUBLISHED Published: 2024-10-09T14:18:56.968Z Last Updated: 2025-11-03T19:34:46.500Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik Reporting Problem Types: CWE-470 Description: In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.telerik.com/reporting/knowledge-base/insecure-expression-evaluation-cve-2024-8048