stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2024-21275 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.7-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Quoting accessible data as well as unauthorized access to critical data or complete access to all Oracle Quoting accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2024-21276 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Messages). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2024-21277 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle MES for Process Manufacturing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle MES for Process Manufacturing accessible data as well as unauthorized access to critical data or complete access to all Oracle MES for Process Manufacturing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2024-21278 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award Processes). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Contract Lifecycle Management for Public Sector accessible data as well as unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2024-21279 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sourcing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sourcing accessible data as well as unauthorized access to critical data or complete access to all Oracle Sourcing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2024-2128 (severity: MEDIUM, weakness: CWE-79)
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed widget in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-21280 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Supported versions that are affected are 12.2.5-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Contracts. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Service Contracts accessible data as well as unauthorized access to critical data or complete access to all Oracle Service Contracts accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2024-21281 (severity: MEDIUM, weakness: CWE-444)
Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.7.0.6.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Banking Liquidity Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Liquidity Management accessible data as well as unauthorized read access to a subset of Oracle Banking Liquidity Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Liquidity Management. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:L).
CVE-2024-21282 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financials accessible data as well as unauthorized access to critical data or complete access to all Oracle Financials accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2024-21283 (severity: HIGH, weakness: CWE-863)
Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). Supported versions that are affected are 9.2.48-9.2.50. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Global Payroll Core. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Global Payroll Core accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Global Payroll Core accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2024-21284 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The supported version that is affected is 14.5.0.12.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Liquidity Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Banking Liquidity Management. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVE-2024-21285 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The supported version that is affected is 14.5.0.12.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Liquidity Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Banking Liquidity Management. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVE-2024-21286 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the PeopleSoft Enterprise ELM Enterprise Learning Management product of Oracle PeopleSoft (component: Enterprise Learning Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise ELM Enterprise Learning Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise ELM Enterprise Learning Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise ELM Enterprise Learning Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise ELM Enterprise Learning Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVE-2024-21287 (severity: HIGH, weakness: CWE-863)
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2024-2129 (severity: MEDIUM, weakness: CWE-79)
The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widget in all versions up to, and including, 1.3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-2130 (severity: MEDIUM, weakness: CWE-79)
The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-21302 (severity: MEDIUM, weakness: CWE-284)
Summary: Microsoft was notified that an elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security (VBS), including a subset of Azure Virtual Machine SKUS. This vulnerability enables an attacker with administrator privileges to replace current versions of Windows system files with outdated versions. By exploiting this vulnerability, an attacker could reintroduce previously mitigated vulnerabilities, circumvent some features of VBS, and exfiltrate data protected by VBS. Microsoft is developing a security update to mitigate this threat, but it is not yet available. Guidance to help customers reduce the risks associated with this vulnerability and to protect their systems until the mitigation is available in a Windows security update is provided in the Recommended Actions section of this CVE. This CVE will be updated when the mitigation is available in a Windows security update. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert when this update occurs. Update: August 13, 2024 Microsoft has released the August 2024 security updates that include an opt-in revocation policy mitigation to address this vulnerability. Customers running affected versions of Windows are encouraged to review KB5042562: Guidance for blocking rollback of virtualization-based security related updates to assess if this opt-in policy meets the needs of their environment before implementing this mitigation. There are risks associated with this mitigation that should be understood prior to applying it to your systems. Detailed information about these risks is also available in KB5042562. Details: A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows 10, Windows 11, Windows Server 2016, and higher based systems including Azure Virtual Machines (VM) that support VBS. For more information on Windows versions and VM SKUs supporting VBS, reference: Virtualization-based Security (VBS) | Microsoft Learn. The vulnerability enables an attacker with administrator privileges on the target system to replace current Windows system files with outdated versions. Successful exploitation provides an attacker with the ability to reintroduce previously mitigated vulnerabilities, circumvent VBS security features, and exfiltrate data protected by VBS. Microsoft is developing a security... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21302
CVE-2024-21303 (severity: HIGH, weakness: CWE-416)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21304 (severity: MEDIUM, weakness: CWE-20)
Trusted Compute Base Elevation of Privilege Vulnerability
CVE-2024-21305 (severity: MEDIUM, weakness: CWE-732)
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
CVE-2024-21306 (severity: MEDIUM, weakness: CWE-306)
Microsoft Bluetooth Driver Spoofing Vulnerability
CVE-2024-21307 (severity: HIGH, weakness: CWE-416)
Remote Desktop Client Remote Code Execution Vulnerability
CVE-2024-21308 (severity: HIGH, weakness: CWE-416)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21309 (severity: HIGH, weakness: CWE-191)
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-2131 (severity: MEDIUM, weakness: CWE-79)
The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's infobox and button widget in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-21310 (severity: HIGH, weakness: CWE-197)
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2024-21311 (severity: MEDIUM, weakness: CWE-125)
Windows Cryptographic Services Information Disclosure Vulnerability
CVE-2024-21312 (severity: HIGH, weakness: CWE-20)
.NET Framework Denial of Service Vulnerability
CVE-2024-21313 (severity: MEDIUM, weakness: CWE-209)
Windows TCP/IP Information Disclosure Vulnerability
CVE-2024-21314 (severity: MEDIUM, weakness: CWE-125)
Microsoft Message Queuing Information Disclosure Vulnerability
CVE-2024-21315 (severity: HIGH, weakness: CWE-20)
Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability
CVE-2024-21316 (severity: MEDIUM, weakness: CWE-20)
Windows Server Key Distribution Service Security Feature Bypass
CVE-2024-21317 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21318 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-21319 (severity: MEDIUM, weakness: CWE-20)
Microsoft Identity Denial of service vulnerability
CVE-2024-2132 (severity: MEDIUM, weakness: CWE-79)
The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Widget in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-21320 (severity: MEDIUM, weakness: CWE-200)
Windows Themes Spoofing Vulnerability
CVE-2024-21322 (severity: HIGH, weakness: CWE-77)
Microsoft Defender for IoT Remote Code Execution Vulnerability
CVE-2024-21323 (severity: HIGH, weakness: CWE-36)
Microsoft Defender for IoT Remote Code Execution Vulnerability
CVE-2024-21324 (severity: HIGH, weakness: CWE-269)
Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVE-2024-21325 (severity: HIGH, weakness: CWE-426)
Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability
CVE-2024-21326 (severity: CRITICAL, weakness: CWE-416)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2024-21327 (severity: HIGH, weakness: CWE-79)
Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
CVE-2024-21328 (severity: HIGH, weakness: CWE-79)
Dynamics 365 Sales Spoofing Vulnerability
CVE-2024-21329 (severity: HIGH, weakness: CWE-59)
Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2024-2133 (severity: LOW, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0. This affects an unknown part of the file /dashboard/Cinvoice/manage_invoice of the component Manage Sale Page. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255495.
CVE-2024-21330 (severity: HIGH, weakness: CWE-122)
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
CVE-2024-21331 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21332 (severity: HIGH, weakness: CWE-416)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21333 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21334 (severity: CRITICAL, weakness: CWE-416)
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
CVE-2024-21335 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21336 (severity: LOW, weakness: CWE-357)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-21337 (severity: MEDIUM, weakness: CWE-122)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2024-21338 (severity: HIGH, weakness: CWE-822)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21339 (severity: MEDIUM, weakness: CWE-416)
Windows USB Generic Parent Driver Remote Code Execution Vulnerability
CVE-2024-2134 (severity: MEDIUM, weakness: CWE-352)
A vulnerability has been found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This vulnerability affects unknown code of the file /investigation/delete/ of the component Investigation Report Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255496. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-21340 (severity: MEDIUM, weakness: CWE-126)
Windows Kernel Information Disclosure Vulnerability
CVE-2024-21341 (severity: MEDIUM, weakness: CWE-122)
Windows Kernel Remote Code Execution Vulnerability
CVE-2024-21342 (severity: HIGH, weakness: CWE-400)
Windows DNS Client Denial of Service Vulnerability
CVE-2024-21343 (severity: HIGH, weakness: CWE-125)
Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVE-2024-21344 (severity: MEDIUM, weakness: CWE-125)
Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVE-2024-21345 (severity: HIGH, weakness: CWE-122)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21346 (severity: HIGH, weakness: CWE-822)
Win32k Elevation of Privilege Vulnerability
CVE-2024-21347 (severity: HIGH, weakness: CWE-122)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2024-21348 (severity: HIGH, weakness: CWE-122)
Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVE-2024-21349 (severity: HIGH, weakness: CWE-122)
Microsoft ActiveX Data Objects Remote Code Execution Vulnerability
CVE-2024-2135 (severity: LOW, weakness: CWE-79)
A vulnerability was found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This issue affects some unknown processing of the file /hospital_activities/birth/form of the component Hospital Activities Page. The manipulation of the argument Description with the input <img src=a onerror=alert(1)> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255497 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-21350 (severity: HIGH, weakness: CWE-190)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21351 (severity: HIGH, weakness: CWE-94)
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2024-21352 (severity: HIGH, weakness: CWE-197)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21353 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability
CVE-2024-21354 (severity: HIGH, weakness: CWE-122)
Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
CVE-2024-21355 (severity: HIGH, weakness: CWE-591)
Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
CVE-2024-21356 (severity: MEDIUM, weakness: CWE-476)
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
CVE-2024-21357 (severity: HIGH, weakness: CWE-843)
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2024-21358 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-21359 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability