Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-34432 State: PUBLISHED Published: 2024-05-09T11:06:52.732Z Last Updated: 2024-08-02T02:51:11.459Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: BetterAddons Products: Better Elementor Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BetterAddons Better Elementor Addons better-elementor-addons allows Stored XSS.This issue affects Better Elementor Addons: from n/a through 1.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/better-elementor-addons/wordpress-be
CVE Program Container: References: - https://patchstack.com/database/vulnerability/better-elementor-addons/wordpress-better-elementor-addons-plugin-1-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34433 State: PUBLISHED Published: 2024-05-09T12:00:35.135Z Last Updated: 2024-08-02T02:51:11.448Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: OCDI Products: One Click Demo Import Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in OCDI One Click Demo Import.This issue affects One Click Demo Import: from n/a through 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/one-click-demo-import/wordpress-one-click-demo-import-plugin-3-2-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-34434 State: PUBLISHED Published: 2024-05-17T08:11:18.325Z Last Updated: 2024-08-11T14:10:02.023Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: realmag777 Products: WordPress Meta Data and Taxonomies Filter (MDTF) Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Misuse.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-meta-data-filter-a
Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-meta-data-filter-and-taxonomy-filter/wordpress-mdtf-meta-data-and-taxonomies-filter-plugin-1-3-3-2-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE ID: CVE-2024-34435 State: PUBLISHED Published: 2024-06-09T11:57:35.799Z Last Updated: 2024-08-02T02:51:11.440Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: CodeRevolution Products: Aiomatic Problem Types: CWE-862 Description: Missing Authorization vulnerability in CodeRevolution Aiomatic.This issue affects Aiomatic: from n/a through 1.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/aiomatic-automatic-ai-content-writer/wordpress-aiomatic-plugin-1-9-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-34436 State: PUBLISHED Published: 2024-05-09T11:05:34.212Z Last Updated: 2024-08-02T02:51:11.429Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: SKT Themes Products: SKT Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/skt-addons-for-elementor/wordpress-skt-addons-for-elementor-plu
erences: - https://patchstack.com/database/vulnerability/skt-addons-for-elementor/wordpress-skt-addons-for-elementor-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34437 State: PUBLISHED Published: 2024-05-09T11:03:03.215Z Last Updated: 2024-08-02T02:51:11.535Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: 10Web Form Builder Team Products: Form Maker by 10Web Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.24. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-plugin-
Container: References: - https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-plugin-1-15-24-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34439 State: PUBLISHED Published: 2024-05-09T11:47:58.575Z Last Updated: 2024-08-02T02:51:11.451Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: divSpot Products: DS Site Message Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in divSpot DS Site Message.This issue affects DS Site Message: from n/a through 1.14.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ds-site-message/wordpress-ds-site-message-plugin-1-14-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34440 State: PUBLISHED Published: 2024-05-13T08:45:35.880Z Last Updated: 2024-08-02T02:51:11.513Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Jordy Meow Products: AI Engine: ChatGPT Chatbot Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.2.63. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ai-engine/wordpress-ai-engine-plugin-2-2-63-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-34441 State: PUBLISHED Published: 2024-05-09T11:01:50.993Z Last Updated: 2024-08-02T02:51:11.456Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Bootstrapped Ventures Products: Easy Affiliate Links Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures Easy Affiliate Links allows Stored XSS.This issue affects Easy Affiliate Links: from n/a through 3.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/easy-affiliate-links/wordpress-easy-affiliate-links
ntainer: References: - https://patchstack.com/database/vulnerability/easy-affiliate-links/wordpress-easy-affiliate-links-plugin-3-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34442 State: PUBLISHED Published: 2024-06-11T13:34:41.974Z Last Updated: 2024-08-02T02:51:11.471Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: weDevs Products: weDocs Problem Types: CWE-862 Description: Missing Authorization vulnerability in weDevs weDocs.This issue affects weDocs: from n/a through 2.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wedocs/wordpress-wedocs-plugin-2-1-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-34443 State: PUBLISHED Published: 2024-06-19T14:53:54.645Z Last Updated: 2024-08-02T02:51:11.453Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemePunch OHG Products: Slider Revolution Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemePunch OHG Slider Revolution allows Stored XSS.This issue affects Slider Revolution: from n/a before 6.7.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-7-11-cross-site-scri
ces: - https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-7-11-cross-site-scripting-xss-vulnerability?_s_id=cve - https://patchstack.com/articles/unauthenticated-xss-vulnerability-patched-in-slider-revolution-plugin?_s_id=cve
CVE ID: CVE-2024-34444 State: PUBLISHED Published: 2024-06-19T14:57:09.389Z Last Updated: 2024-08-02T02:51:11.524Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemePunch OHG Products: Slider Revolution Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a before 6.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-7-0-unauthenticated-broken-access-control-vulnerability?_s_id=cve - https://patchstack.com/articles/unauthenti
-plugin-6-7-0-unauthenticated-broken-access-control-vulnerability?_s_id=cve - https://patchstack.com/articles/unauthenticated-xss-vulnerability-patched-in-slider-revolution-plugin?_s_id=cve
CVE ID: CVE-2024-34445 State: PUBLISHED Published: 2024-05-09T11:00:34.193Z Last Updated: 2024-08-02T02:51:11.528Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: SKT Themes Products: SKT Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/skt-addons-for-elementor/wordpress-skt-addons-for-elementor-plu
erences: - https://patchstack.com/database/vulnerability/skt-addons-for-elementor/wordpress-skt-addons-for-elementor-plugin-1-8-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2024-34446 State: PUBLISHED Published: 2024-05-03T00:00:00 Last Updated: 2024-08-02T02:51:11.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the affected device was the origin of sensitive DNS requests may be observed and logged by operators of unintended DNS servers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mullvad/mullvadvpn-app/tags - https://github.com/mullvad/mullvadvpn-app/blob/main/CHANGELOG.md - https:/
ps://github.com/mullvad/mullvadvpn-app/tags - https://github.com/mullvad/mullvadvpn-app/blob/main/CHANGELOG.md - https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the-vpn-tunnel-on-android - https://github.com/mullvad/mullvadvpn-app/commit/0c39306a40f426853d617e20d596942e41091f13 - https://news.ycombinator.com/item?id=40247604
CVE ID: CVE-2024-34447 State: PUBLISHED Published: 2024-05-03T00:00:00.000Z Last Updated: 2025-06-17T19:33:58.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pr
some situations, opening up a possibility of DNS poisoning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.bouncycastle.org/latest_releases.html - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447 - https://security.netapp.com/advisory/ntap-20240614-0007/
CVE ID: CVE-2024-34448 State: PUBLISHED Published: 2024-05-22T16:01:29.178Z Last Updated: 2025-02-13T15:53:24.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ghost before 5.82.0 allows CSV Injection during a member CSV export. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/phulelouch/CVEs/blob/main/CVE-2024-34448.md
CVE ID: CVE-2024-34449 State: PUBLISHED Published: 2024-05-03T00:00:00 Last Updated: 2024-08-02T02:51:11.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Vanessa219/vditor/issues/1604 - https://github.com/Vanessa219/vditor/blob/b3a14d6e4462b0c17141e1fcc66173264ada64e0/README_en_US.md?plain=1#L310
CVE ID: CVE-2024-34451 State: PUBLISHED Published: 2024-06-16T00:00:00 Last Updated: 2024-08-20T16:51:00.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ghost.org/docs/faq/proxying-https-infinite-loops/ - https://github.com/TryGhost/Ghost/releases - https://docs.google.com/document/d/1i
/faq/proxying-https-infinite-loops/ - https://github.com/TryGhost/Ghost/releases - https://docs.google.com/document/d/1iy0X4Vc9xXYoBxFrcW6ATo8GKPV6ivuLVzn6GgEpwqE
CVE ID: CVE-2024-34452 State: PUBLISHED Published: 2024-06-21T00:00:00 Last Updated: 2024-08-02T02:51:11.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/surajhacx/CVE-2024-34452/
CVE ID: CVE-2024-34453 State: PUBLISHED Published: 2024-05-03T00:00:00 Last Updated: 2024-08-02T02:51:11.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: TwoNav 2.1.13 contains an SSRF vulnerability via the url paramater to index.php?c=api&method=read_data&type=connectivity_test (which reaches /system/api.php). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tznb1/TwoNav/issues/9#issuecomment-2022194939 - https://github.com/tznb1/TwoNav/compare/v2.1.13-20240321...v2.1.14-20240419
CVE ID: CVE-2024-34454 State: PUBLISHED Published: 2024-05-26T21:48:04.835Z Last Updated: 2025-02-13T15:53:25.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nintendo Wii U OS 5.5.5 allows man-in-the-middle attackers to forge SSL certificates as though they came from a Root CA, because there is a secondary verification mechanism that only checks whether a CA is known and ignores the CA details and signature (and because * is accepted as a Common Name). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/PretendoNetwork/SSSL - https://github.com/PretendoNetwork/SSSL-DNS
CVE ID: CVE-2024-34455 State: PUBLISHED Published: 2024-05-03T00:00:00 Last Updated: 2024-08-02T02:51:11.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2024/04/11/13 - https://github.com/buildroot/buildroot/commit/0b2967e15800421efbdfe3a7a6061cf6bd84134d - http://www.openwall.com/lists/oss-security/2024/05/06/2 - http://www.openwall.com/lists/oss-security/2024/05/06/4 - http://www.openwall.com/lists/oss-security/2024/05/07/4
CVE ID: CVE-2024-34457 State: PUBLISHED Published: 2024-07-22T09:48:23.130Z Last Updated: 2024-11-04T21:27:42.331Z Vendors: Apache Software Foundation Products: Apache StreamPark Problem Types: CWE-639 Description: On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config. Mitigation: all users should upgrade to 2.1.4 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7j - https://www.openwall.com/lists/oss-security/2024/07/22/2
CVE ID: CVE-2024-34458 State: PUBLISHED Published: 2024-08-20T00:00:00.000Z Last Updated: 2025-03-14T15:01:37.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.keyfactor.com/?itemUid=d73921fd-bc9e-4e35-a974-cfb628e6a226&source=click
CVE ID: CVE-2024-34459 State: PUBLISHED Published: 2024-05-13T00:00:00.000Z Last Updated: 2025-11-04T22:06:16.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/libxml2/-/issues/720 - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7 - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8 - https://lists.fedoraproject.org/archives/list/pac
/v2.12.7 - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/
CVE ID: CVE-2024-34460 State: PUBLISHED Published: 2024-05-04T00:00:00 Last Updated: 2024-11-15T20:51:42.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://zenar.io/zenario-9/blog/zenario-9560602-patch-released
CVE ID: CVE-2024-34461 State: PUBLISHED Published: 2024-05-04T00:00:00.000Z Last Updated: 2025-03-28T23:30:53.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://zenar.io/zenario-9/blog/zenario-9560437-patch-released
CVE ID: CVE-2024-34462 State: PUBLISHED Published: 2024-05-04T00:00:00 Last Updated: 2024-08-02T02:51:11.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alinto SOGo through 5.10.0 allows XSS during attachment preview. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Alinto/sogo/commit/2e37e59ed140d4aee0ff2fba579ca5f83f2c5920
CVE ID: CVE-2024-34463 State: PUBLISHED Published: 2024-09-03T00:00:00 Last Updated: 2024-09-03T14:05:58.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The packet data also lacks authentication and integrity protection.) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bplmedicaltechnologies.com/product-details/weighing-scales/personal-weighing-scale-pws-01bt/ - https://yashhchandna.medium.com/random-sunday-thought-turned-into-a-cve-09ca0c08343f - https://github.com/yash-chandna/CVE-2024-34463
CVE ID: CVE-2024-34466 State: REJECTED Published: N/A Last Updated: 2024-05-06T14:37:31.407192 Description: No description available.
CVE ID: CVE-2024-34467 State: PUBLISHED Published: 2024-05-04T00:00:00 Last Updated: 2024-08-16T18:18:27.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/top-think/framework/issues/2996
CVE ID: CVE-2024-34468 State: PUBLISHED Published: 2024-05-04T00:00:00 Last Updated: 2024-12-04T21:06:52.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rukovoditel before 3.5.3 allows XSS via user_photo to My Page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forum.rukovoditel.net/viewtopic.php?t=5071
CVE ID: CVE-2024-34469 State: PUBLISHED Published: 2024-05-04T00:00:00 Last Updated: 2024-08-02T02:51:11.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forum.rukovoditel.net/viewtopic.php?t=5071
CVE ID: CVE-2024-34470 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:51:11.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/osvaldotenorio/CVE-2024-34470
CVE ID: CVE-2024-34471 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:51:11.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exists in the mliRealtimeEmails.php file. The filename parameter in the export HTML functionality does not properly validate the file location, allowing an attacker to read and delete arbitrary files on the server. This was observed when the mliRealtimeEmails.php file itself was read and subsequently deleted, resulting in a 404 error for the file and disruption of email information loading. Additional Analyst Not
ently deleted, resulting in a 404 error for the file and disruption of email information loading. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/osvaldotenorio/CVE-2024-34471