generated content from 2025-02-16

mapping.csv

@@ -267502,3 +267502,27 @@ vulnerability,CVE-2025-0821,vulnerability--64e571d0-caff-4c36-b23d-3500e38c1834
 vulnerability,CVE-2025-0867,vulnerability--3a73e67b-4e15-4268-9acc-4835a6b4907c
 vulnerability,CVE-2025-0592,vulnerability--5fdd8475-787d-44ed-9899-a133a473063a
 vulnerability,CVE-2025-0593,vulnerability--6644ca2e-3176-418a-b747-df3b9e0f2751
+vulnerability,CVE-2024-5461,vulnerability--a2f7f61b-9afd-412d-9c7e-dfe97526effa
+vulnerability,CVE-2024-10581,vulnerability--d812daa1-d5fe-4936-a49f-7f89eee9d3aa
+vulnerability,CVE-2024-12562,vulnerability--3a7af0d4-199c-414c-bfce-a04ae0d7ed20
+vulnerability,CVE-2024-13752,vulnerability--26507740-e010-46d9-922e-9b58dc27b8d3
+vulnerability,CVE-2024-13834,vulnerability--18a199e4-6ac5-400b-ada4-d6f388c5318b
+vulnerability,CVE-2024-13306,vulnerability--3e5fdeb5-0b25-4924-b667-a9ed417656d2
+vulnerability,CVE-2024-13208,vulnerability--f6a9f51c-8a68-4ad6-8d38-2fa9f6a96a33
+vulnerability,CVE-2024-13439,vulnerability--c83b843b-2ddc-4a6c-bb43-fc4fcb214232
+vulnerability,CVE-2024-13563,vulnerability--71604e5f-6c41-4566-8811-9752ce6d2cb6
+vulnerability,CVE-2024-13513,vulnerability--12fc39e4-eda5-471f-9502-fcffaefc1c76
+vulnerability,CVE-2024-13525,vulnerability--69215df5-4174-408f-a9fb-06a31180ea66
+vulnerability,CVE-2024-13488,vulnerability--f8fbb63d-2d64-46f5-9cd8-57d69d596073
+vulnerability,CVE-2024-13500,vulnerability--28c8fab7-ad9e-4e34-a340-96d9b216cb57
+vulnerability,CVE-2025-1302,vulnerability--8fd67d41-e3fd-4f78-b07f-73c183aacc60
+vulnerability,CVE-2025-1005,vulnerability--f06c3e2a-4f35-45da-87e0-b6a6020a7c38
+vulnerability,CVE-2025-26793,vulnerability--776a8e95-ede9-45e1-b0a1-b420c4c5b6c4
+vulnerability,CVE-2025-22209,vulnerability--e26dbb28-7201-4bc1-b1e4-74d3dd3bd3ea
+vulnerability,CVE-2025-22208,vulnerability--9b769989-6438-4903-8f54-f6afe67449c8
+vulnerability,CVE-2025-0996,vulnerability--b9751cf5-afd3-4121-b7a3-f5ed8f651498
+vulnerability,CVE-2025-0998,vulnerability--0aed46c0-4df6-4b55-89a1-02cf2111464f
+vulnerability,CVE-2025-0935,vulnerability--0f095725-e16a-4e09-af17-a90a3db98366
+vulnerability,CVE-2025-0822,vulnerability--bdbace05-a4d6-405e-a073-d3739c03816d
+vulnerability,CVE-2025-0995,vulnerability--d76e412b-0a9d-4f03-84cc-76b1606890e7
+vulnerability,CVE-2025-0997,vulnerability--123d5480-515c-49cd-a0fd-ed9847c9821e

objects/vulnerability/vulnerability--0aed46c0-4df6-4b55-89a1-02cf2111464f.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--1a03321c-bf48-4e79-bb9b-6bdde29562a2",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0aed46c0-4df6-4b55-89a1-02cf2111464f",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:43.342505Z",
+            "modified": "2025-02-16T00:40:43.342505Z",
+            "name": "CVE-2025-0998",
+            "description": "Out of bounds memory access in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0998"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0f095725-e16a-4e09-af17-a90a3db98366.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5c9ed7fc-2438-4f93-b89c-041836598877",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0f095725-e16a-4e09-af17-a90a3db98366",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:43.363207Z",
+            "modified": "2025-02-16T00:40:43.363207Z",
+            "name": "CVE-2025-0935",
+            "description": "The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to change plugin settings related to things such as IP-blocking.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0935"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--123d5480-515c-49cd-a0fd-ed9847c9821e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7a8e57cd-6bf7-4734-b9ea-07e08e2d41cc",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--123d5480-515c-49cd-a0fd-ed9847c9821e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:43.383701Z",
+            "modified": "2025-02-16T00:40:43.383701Z",
+            "name": "CVE-2025-0997",
+            "description": "Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0997"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--12fc39e4-eda5-471f-9502-fcffaefc1c76.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--bf822d58-f744-452a-b04b-b6b1385cdfbe",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--12fc39e4-eda5-471f-9502-fcffaefc1c76",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:39.447173Z",
+            "modified": "2025-02-16T00:40:39.447173Z",
+            "name": "CVE-2024-13513",
+            "description": "The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's clientToken, which in turn can be used to change user account information including emails and account type. This allows attackers to then change account passwords resulting in a complete site takeover. Version 2.4.2.3 disabled logging but left sites with existing log files vulnerable.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13513"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--18a199e4-6ac5-400b-ada4-d6f388c5318b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--873072de-cc3e-4c38-b22e-74f0177f3711",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--18a199e4-6ac5-400b-ada4-d6f388c5318b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:39.414832Z",
+            "modified": "2025-02-16T00:40:39.414832Z",
+            "name": "CVE-2024-13834",
+            "description": "The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remote_request' function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13834"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--26507740-e010-46d9-922e-9b58dc27b8d3.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d6173971-8326-47e7-91b0-ce5bd5156fef",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--26507740-e010-46d9-922e-9b58dc27b8d3",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:39.411504Z",
+            "modified": "2025-02-16T00:40:39.411504Z",
+            "name": "CVE-2024-13752",
+            "description": "The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cause a persistent denial of service condition.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13752"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--28c8fab7-ad9e-4e34-a340-96d9b216cb57.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a71f5e93-5390-4d44-bd22-c17c0a5cf67b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--28c8fab7-ad9e-4e34-a340-96d9b216cb57",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:39.466406Z",
+            "modified": "2025-02-16T00:40:39.466406Z",
+            "name": "CVE-2024-13500",
+            "description": "The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13500"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--3a7af0d4-199c-414c-bfce-a04ae0d7ed20.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--95b5f042-db3f-4644-9d4d-ac1395841565",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3a7af0d4-199c-414c-bfce-a04ae0d7ed20",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:38.007959Z",
+            "modified": "2025-02-16T00:40:38.007959Z",
+            "name": "CVE-2024-12562",
+            "description": "The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12562"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--3e5fdeb5-0b25-4924-b667-a9ed417656d2.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a7baf8dd-66cb-47a2-8c3a-eb81e5c81b15",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3e5fdeb5-0b25-4924-b667-a9ed417656d2",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:39.417915Z",
+            "modified": "2025-02-16T00:40:39.417915Z",
+            "name": "CVE-2024-13306",
+            "description": "The Maps Plugin using Google Maps for WordPress  WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13306"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--69215df5-4174-408f-a9fb-06a31180ea66.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a8aa9f42-c990-4dc0-b820-4c48f70d4470",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--69215df5-4174-408f-a9fb-06a31180ea66",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:39.451381Z",
+            "modified": "2025-02-16T00:40:39.451381Z",
+            "name": "CVE-2024-13525",
+            "description": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via Shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including emails as well as hashed passwords of any user.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13525"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--71604e5f-6c41-4566-8811-9752ce6d2cb6.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d6864f51-74e2-4c6d-8ee9-67dcc9192201",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--71604e5f-6c41-4566-8811-9752ce6d2cb6",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:39.439863Z",
+            "modified": "2025-02-16T00:40:39.439863Z",
+            "name": "CVE-2024-13563",
+            "description": "The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all versions up to, and including, 3.2.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13563"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--776a8e95-ede9-45e1-b0a1-b420c4c5b6c4.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--495018de-7280-4fe6-9d35-f917456d3bae",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--776a8e95-ede9-45e1-b0a1-b420c4c5b6c4",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:43.049705Z",
+            "modified": "2025-02-16T00:40:43.049705Z",
+            "name": "CVE-2025-26793",
+            "description": "The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the \"vulnerable systems are not following manufacturers' recommendations to change the default password.\"",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-26793"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--8fd67d41-e3fd-4f78-b07f-73c183aacc60.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--aa692f09-b342-4db6-98e7-26fd9da438a3",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--8fd67d41-e3fd-4f78-b07f-73c183aacc60",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:42.970784Z",
+            "modified": "2025-02-16T00:40:42.970784Z",
+            "name": "CVE-2025-1302",
+            "description": "Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.\r\r**Note:**\r\rThis is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-1302"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--9b769989-6438-4903-8f54-f6afe67449c8.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--87679a1f-eb6e-44f7-a52b-d573f6852fea",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--9b769989-6438-4903-8f54-f6afe67449c8",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:43.106052Z",
+            "modified": "2025-02-16T00:40:43.106052Z",
+            "name": "CVE-2025-22208",
+            "description": "A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-22208"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--a2f7f61b-9afd-412d-9c7e-dfe97526effa.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8f785b59-ec69-443c-a2fc-f68e3d537eec",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--a2f7f61b-9afd-412d-9c7e-dfe97526effa",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-02-16T00:40:37.323365Z",
+            "modified": "2025-02-16T00:40:37.323365Z",
+            "name": "CVE-2024-5461",
+            "description": "Implementation of the Simple Network \nManagement Protocol (SNMP) operating on the Brocade 6547 (FC5022) \nembedded switch blade, makes internal script calls to system.sh from \nwithin the SNMP binary. An authenticated attacker could perform command \nor parameter injection on SNMP operations that are only enabled on the \nBrocade 6547 (FC5022) embedded switch. This injection could allow the \nauthenticated attacker to issue commands as Root.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-5461"
+                }
+            ]
+        }
+    ]
+}