Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
fic namespaces, without requiring any authorization or permissions. The issue affects all versions up to and including the latest version, with a fix introduced in version 1.0.0. Exploitation of this vulnerability can lead to complete data loss of document embeddings across all workspaces, rendering workspace chats and embeddable chat widgets non-functional. Additionally, attackers can list all namespaces, potentially exposing private workspace names. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/8a98a0b4-7886-41c5-8624-fc5c21972e5a - https://github.com/mintplex-labs/anything-llm/commit/bf8df60c02b9ddc7ba682809ca12c563760
4-7886-41c5-8624-fc5c21972e5a - https://github.com/mintplex-labs/anything-llm/commit/bf8df60c02b9ddc7ba682809ca12c5637606393a
CVE ID: CVE-2024-3034 State: PUBLISHED Published: 2024-04-27T04:33:28.612Z Last Updated: 2024-08-01T19:32:42.649Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: willmot Products: BackUpWordPress Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The BackUpWordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.13 via the hmbkp_directory_browse parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to traverse directories outside of the context in which the plugin should allow. Additional Analyst N
access and above, to traverse directories outside of the context in which the plugin should allow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2805cb0-8913-4487-8445-031b7d920e2d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076291%40backupwordpress&new=3076291%40backupwordpress&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3035 State: PUBLISHED Published: 2024-08-08T10:31:32.879Z Last Updated: 2024-09-17T15:29:42.165Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-639 Description: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/452297 - https://hackerone.com/reports/2424715
CVE ID: CVE-2024-3036 State: PUBLISHED Published: 2024-06-21T10:26:30.550Z Last Updated: 2025-09-11T14:14:49.114Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ABB Products: 800xA Base Problem Types: CWE-1284 Description: Improper Input Validation vulnerability in ABB 800xA Base. An attacker who successfully exploited this vulnerability could cause services to crash by sending specifically crafted messages. This issue affects 800xA Base: from 6.0.0 through 6.1.1-2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=7PAA013309&LanguageCode=en&DocumentPartId=&Actio
: References: - https://search.abb.com/library/Download.aspx?DocumentID=7PAA013309&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-3037 State: PUBLISHED Published: 2024-05-14T00:12:37.696Z Last Updated: 2024-10-07T20:27:00.841Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PaperCut Products: PaperCut NG, PaperCut MF Problem Types: CWE-59 Description: An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server. Important: In most installations, this risk is mitigated by the default Windows Server configuration,
tly on the server. Important: In most installations, this risk is mitigated by the default Windows Server configuration, which typically restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log in to the local console of the Windows environment hosting the PaperCut NG/MF application server. Note: This CVE has been split into two separate CVEs (CVE-2024-3037 and CVE-2024-8404) and it’s been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard users o
ing of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard users on the host server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/Security-Bulletin-May-2024/
CVE ID: CVE-2024-3039 State: PUBLISHED Published: 2024-03-28T14:31:03.962Z Last Updated: 2025-03-25T14:43:46.915Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Shanghai Brad Technology Products: BladeX Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml(1,concat(0x3f,md5(123456),0x3f),1)=1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258426 is the identifier assigned to this v
remotely. The exploit has been disclosed to the public and may be used. VDB-258426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258426 - https://vuldb.com/?ctiid.258426 - https://vuldb.com/?submit.301469 - https://spoofer.cn/bladex_sqli/
CVE ID: CVE-2024-3040 State: PUBLISHED Published: 2024-03-28T14:31:05.302Z Last Updated: 2024-08-01T19:32:42.505Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_crl_conf. The manipulation of the argument CRLId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258429 was assigned to this vulnerability. NOTE: The vendor was
losed to the public and may be used. The identifier VDB-258429 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258429 - https://vuldb.com/?ctiid.258429 - https://vuldb.com/?submit.302340 - https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-list_crl_conf.md
CVE ID: CVE-2024-3041 State: PUBLISHED Published: 2024-03-28T15:00:05.375Z Last Updated: 2024-08-01T19:32:42.624Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early
blic and may be used. VDB-258430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258430 - https://vuldb.com/?ctiid.258430 - https://vuldb.com/?submit.302342 - https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-listloginfo.md
CVE ID: CVE-2024-3042 State: PUBLISHED Published: 2024-03-28T15:00:06.943Z Last Updated: 2024-08-01T19:32:42.734Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Subscription Website Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Subscription Website 1.0 and classified as critical. This issue affects some unknown processing of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258431. Additional Analyst Notes: - CISA ADP V
c and may be used. The associated identifier of this vulnerability is VDB-258431. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258431 - https://vuldb.com/?ctiid.258431 - https://vuldb.com/?submit.306119 - https://github.com/maxmvp666/planCve/blob/main/Simple%20Subscription%20Website%20with%20Admin%20System%20manage_user.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2024-3043 State: PUBLISHED Published: 2024-06-27T18:17:15.392Z Last Updated: 2024-08-01T19:32:42.579Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: Ember ZNet SDK Problem Types: CWE-829 Description: An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier (pan ID), leading to a denial of service. This packet type is not useful in production and should be used only for PHY qualification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SiliconLabs/gecko_sdk - https://community.silabs.com/06
hment: - CVE Program Container: References: - https://github.com/SiliconLabs/gecko_sdk - https://community.silabs.com/069Vm000005UCH0IAO
CVE ID: CVE-2024-3044 State: PUBLISHED Published: 2024-05-14T20:19:51.426Z Last Updated: 2024-11-12T20:14:27.961Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-356 Description: Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2024-3044 - https://lists.debian.org/debian-lts-announ
s: - https://www.libreoffice.org/about-us/security/advisories/CVE-2024-3044 - https://lists.debian.org/debian-lts-announce/2024/05/msg00016.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TU3TYDXICKPYHMCNL7ARYYBXACEAYJ4/
CVE ID: CVE-2024-3045 State: PUBLISHED Published: 2024-05-02T16:51:55.493Z Last Updated: 2024-08-01T19:32:42.660Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wpovernight Products: PDF Invoices & Packing Slips for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scri
nput sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d0e5d24-5d65-4ed5-8086-347969cbd3ec?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/trunk/ubl/Transformers/AddressTransformer.php#L16 - https://plugins.trac.wordpress.org/changeset/3076105/
CVE ID: CVE-2024-3046 State: PUBLISHED Published: 2024-04-09T10:02:39.146Z Last Updated: 2024-08-22T19:59:23.361Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Eclipse Foundation Products: Kura Problem Types: CWE-303 Description: In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to retrieve the device logs. Also, downloaded logs may be used by an attacker to perform privilege escalation by using the session id of an authenticated user reported in logs. This issue affects org.eclipse.kura:org.eclipse.kura.web2 version range [2.0.600, 2.4.0], which is includ
orted in logs. This issue affects org.eclipse.kura:org.eclipse.kura.web2 version range [2.0.600, 2.4.0], which is included in Eclipse Kura version range [5.0.0, 5.4.1] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/188
CVE ID: CVE-2024-3047 State: PUBLISHED Published: 2024-05-02T16:51:50.588Z Last Updated: 2024-08-15T14:22:56.699Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wpovernight Products: PDF Invoices & Packing Slips for WooCommerce Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform() function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal
o arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/18f16148-b4a8-4f89-af0d-c0baba8f9ccf?source=cve - https://plugins.trac.wordpress.org/changeset/3076105/
CVE ID: CVE-2024-3048 State: PUBLISHED Published: 2024-04-26T05:00:03.832Z Last Updated: 2024-11-20T17:26:28.540Z Vendors: Unknown Products: Bannerlid Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/e179ff7d-137c-48bf-8b18-e874e3f876f4/
CVE ID: CVE-2024-3049 State: PUBLISHED Published: 2024-06-06T05:30:04.137Z Last Updated: 2025-11-08T03:10:49.077Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Re
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Problem Types: CWE-345 Description: A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:3657 - https://access.redhat.com/errata/RHSA-2024:3658 - https://access.redhat.com/errata/RHSA-2024:3659 - https://access.redhat.com/errata/RHSA-2024:3660 - https://access.r
8 - https://access.redhat.com/errata/RHSA-2024:3659 - https://access.redhat.com/errata/RHSA-2024:3660 - https://access.redhat.com/errata/RHSA-2024:3661 - https://access.redhat.com/errata/RHSA-2024:4400 - https://access.redhat.com/errata/RHSA-2024:4411 - https://access.redhat.com/security/cve/CVE-2024-3049 - https://bugzilla.redhat.com/show_bug.cgi?id=2272082 - https://github.com/ClusterLabs/booth/pull/142
CVE ID: CVE-2024-3050 State: PUBLISHED Published: 2024-05-29T06:00:01.923Z Last Updated: 2024-08-01T19:32:42.587Z Vendors: Unknown Products: Site Reviews Problem Types: CWE-290 Authentication Bypass by Spoofing Description: The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/04c1581e-fd36-49d4-8463-b49915d4b1ac/
CVE ID: CVE-2024-3051 State: PUBLISHED Published: 2024-04-26T21:26:38.377Z Last Updated: 2024-09-27T16:09:38.663Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: Z/IP Gateway SDK Problem Types: CWE-248, CWE-419 Description: Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowledged by the gateway during this time. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.silabs.com/068Vm0000045w2j
CVE ID: CVE-2024-3052 State: PUBLISHED Published: 2024-04-26T21:27:16.422Z Last Updated: 2025-08-27T21:23:01.372Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: Z/IP Gateway SDK Problem Types: CWE-248 Description: Malformed S2 Nonce Get command classes can be sent to crash the gateway. A hard reset is required to recover the gateway. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.silabs.com/068Vm0000045w2j
CVE ID: CVE-2024-3053 State: PUBLISHED Published: 2024-04-09T18:58:34.949Z Last Updated: 2024-08-01T19:32:42.567Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmudev Products: Forminator – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminator_form shortcode attribute in versions up to, and including, 1.29.2 due to insufficient input sanitization and output escaping. This makes it possible
versions up to, and including, 1.29.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/19439622-6396-4f10-ab71-aa243b6812fa?source=cve - https://plugins.trac.wordpress.org/changeset/3066927/forminator
CVE ID: CVE-2024-3054 State: PUBLISHED Published: 2024-04-12T09:30:15.475Z Last Updated: 2024-08-01T19:32:42.600Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Problem Types: CWE-502 Deserialization of Untrusted Data Description: WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated att
providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf26fc68-9fd4-4e4e-b34f-c947d95891f9?source=cve - ht
rences: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf26fc68-9fd4-4e4e-b34f-c947d95891f9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3067224%40wpvivid-backuprestore&new=3067224%40wpvivid-backuprestore&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3055 State: PUBLISHED Published: 2024-05-10T21:32:43.333Z Last Updated: 2024-08-01T19:32:42.527Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: unitecms Products: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.102 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on
and including, 1.5.102 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ebc0c8e6-a365-4ef7-9c1a-41454855096c?source=cve - https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/1.5.93/inc_php/framework/db.class.php#L238 - https://plug
ac.wordpress.org/browser/unlimited-elements-for-elementor/tags/1.5.93/inc_php/framework/db.class.php#L238 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3081509%40unlimited-elements-for-elementor%2Ftrunk&old=3076456%40unlimited-elements-for-elementor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3056 State: PUBLISHED Published: 2024-08-02T20:37:59.053Z Last Updated: 2025-11-14T01:32:55.488Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4 Problem Types: CWE-400 Description: A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious contain