Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12734 State: PUBLISHED Published: 2025-05-15T20:06:55.376Z Last Updated: 2025-05-20T19:31:20.280Z Vendors: Unknown Products: Advance Post Prefix Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/038b44dc-0495-4f56-ae7e-c78a265aa535/
CVE ID: CVE-2024-12735 State: PUBLISHED Published: 2025-05-15T20:06:55.578Z Last Updated: 2025-05-20T19:31:08.249Z Vendors: Unknown Products: Advance Post Prefix Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1b355399-e92b-46aa-ada1-95e99fc03976/
CVE ID: CVE-2024-12736 State: PUBLISHED Published: 2025-01-09T06:00:09.513Z Last Updated: 2025-01-09T15:34:40.311Z Vendors: Unknown Products: BU Section Editing Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d3c6a4c1-8358-4f8b-b58d-3f712052668f/
CVE ID: CVE-2024-12737 State: PUBLISHED Published: 2025-02-26T06:00:06.774Z Last Updated: 2025-02-26T14:41:14.983Z Vendors: Unknown Products: WP BASE Booking of Appointments, Services and Events Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/997eb9f6-80e1-4bc5-be72-bd6a6f52379c/
CVE ID: CVE-2024-12738 State: PUBLISHED Published: 2025-01-07T12:43:40.348Z Last Updated: 2025-01-07T14:33:31.423Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: reflectionmedia Products: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Problem Types: CWE-79 Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers
3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51b626e1-89c0-49b9-bfeb-32005e8e78d6?source=cve - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.12.8/features/email-confirmation/class-email-confirmation.php - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.12.8/features/email-confirmation/class-email-confirmation.php#L95 - http
ac.wordpress.org/browser/profile-builder/tags/3.12.8/features/email-confirmation/class-email-confirmation.php#L95 - https://plugins.trac.wordpress.org/changeset/3217544/
CVE ID: CVE-2024-12739 State: PUBLISHED Published: 2025-05-15T20:06:55.786Z Last Updated: 2025-05-20T19:30:57.135Z Vendors: Unknown Products: Mobile Contact Bar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5492f1b2-481b-472a-82d3-949f85c8dc70/
CVE ID: CVE-2024-12740 State: PUBLISHED Published: 2025-01-27T17:17:28.308Z Last Updated: 2025-01-27T18:52:58.721Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: Vision Development Module, FlexRIO, NI-IMAQdx, Vision Acquisition Software, Vision Builder for Automated Inspection, Data Record AD, FRC Game Tools Problem Types: CWE-1395 Description: Vision related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file. Additional Analyst Notes: - CISA A
ful exploitation requires an attacker to get a user to open a specially crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dependency-on-vulnerable-third-party-component-exposes-vulnerabi.html
CVE ID: CVE-2024-12741 State: PUBLISHED Published: 2024-12-18T19:20:41.889Z Last Updated: 2025-03-06T16:18:31.635Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: DAQExpress Problem Types: CWE-502 Description: A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions. Please note that DAQExpress is an EOL product and will not receive any updates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://knowledge.ni.
and will not receive any updates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://knowledge.ni.com/KnowledgeArticleDetails?id=kA00Z000000kFD7SAM&l=en-US
CVE ID: CVE-2024-12742 State: PUBLISHED Published: 2025-03-06T16:27:31.660Z Last Updated: 2025-03-06T16:43:15.603Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: G Web Development Software Problem Types: CWE-502 Description: A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects G Web Development Software 2022 Q3 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/availab
ersions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-g-web-deve.html
CVE ID: CVE-2024-12743 State: PUBLISHED Published: 2025-05-15T20:06:55.990Z Last Updated: 2025-05-20T19:30:43.953Z Vendors: Unknown Products: MailPoet Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7945f52d-364d-438c-84f2-cf19b4250056/
CVE ID: CVE-2024-12744 State: PUBLISHED Published: 2024-12-24T16:12:51.304Z Last Updated: 2025-10-14T18:59:16.572Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Amazon Products: Amazon Redshift JDBC Driver Problem Types: CWE-89 Description: A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-8596-2jgr-ppj7 - https://aws.
References: - https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-8596-2jgr-ppj7 - https://aws.amazon.com/security/security-bulletins/AWS-2024-015/ - https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.1.0.32
CVE ID: CVE-2024-12745 State: PUBLISHED Published: 2024-12-24T16:15:08.718Z Last Updated: 2025-10-14T18:58:13.925Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Amazon Products: Amazon Redshift Python Connector Problem Types: CWE-89 Description: A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, or get_columns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-8gc2-vq6m-rwjw
Vulnrichment: References: - https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-8gc2-vq6m-rwjw - https://aws.amazon.com/security/security-bulletins/AWS-2024-015/ - https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.5
CVE ID: CVE-2024-12746 State: PUBLISHED Published: 2024-12-24T16:16:37.499Z Last Updated: 2025-10-14T18:56:10.073Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Amazon Products: Amazon Redshift ODBC Driver Problem Types: CWE-89 Description: A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 (Windows or Linux) allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aws/amazon-redshift-odbc-driver/security/advisories/GHSA-g63m-5vjv-wr3v -
ulnrichment: References: - https://github.com/aws/amazon-redshift-odbc-driver/security/advisories/GHSA-g63m-5vjv-wr3v - https://aws.amazon.com/security/security-bulletins/AWS-2024-015/ - https://github.com/aws/amazon-redshift-odbc-driver/releases/tag/v2.1.6
CVE ID: CVE-2024-12747 State: PUBLISHED Published: 2025-01-14T17:39:16.031Z Last Updated: 2025-11-06T21:50:58.392Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Discovery 1.14, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 Problem Types: CWE-362 Description: A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbol
default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:2600 - https://access.redhat.com/errata/RHSA-2025:7050 - https://access.redhat.com/errata/RHSA-2025:8385 - https://access.redhat.com/security/cve/CVE-2024-12747 - https://bugzilla.redhat.com/show_bug.cgi
errata/RHSA-2025:8385 - https://access.redhat.com/security/cve/CVE-2024-12747 - https://bugzilla.redhat.com/show_bug.cgi?id=2332968 - https://kb.cert.org/vuls/id/952657
CVE ID: CVE-2024-12749 State: PUBLISHED Published: 2025-01-29T06:00:07.835Z Last Updated: 2025-01-29T14:43:40.327Z Vendors: Unknown Products: Competition Form Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/478316b9-9f47-4aa6-92c6-03879f16a3e5/
CVE ID: CVE-2024-12750 State: PUBLISHED Published: 2025-05-15T20:06:56.360Z Last Updated: 2025-05-20T19:30:32.480Z Vendors: Unknown Products: Competition Form Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f3570bdc-659f-4a03-96f8-b4f9f045f910/
CVE ID: CVE-2024-12751 State: PUBLISHED Published: 2024-12-30T20:13:40.610Z Last Updated: 2025-01-01T04:56:28.195Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation
s file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25344. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1737/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2024-12752 State: PUBLISHED Published: 2024-12-30T20:13:55.716Z Last Updated: 2025-01-01T04:56:26.938Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-119 Description: Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation o
file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25345. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1738/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2024-12753 State: PUBLISHED Published: 2024-12-30T20:14:13.391Z Last Updated: 2025-01-09T19:26:22.102Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-59 Description: Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. By creating a junction, an attacker can abuse the installer proces
he specific flaw exists within the product installer. By creating a junction, an attacker can abuse the installer process to create an arbitrary file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25408. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1739/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2024-12754 State: PUBLISHED Published: 2024-12-30T16:51:19.468Z Last Updated: 2024-12-31T19:09:11.684Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: AnyDesk Products: AnyDesk Problem Types: CWE-59 Description: AnyDesk Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of background images. By creating a junction, an attacker can abuse the service to read
flaw exists within the handling of background images. By creating a junction, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-23940. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1711/
CVE ID: CVE-2024-12755 State: PUBLISHED Published: 2025-02-11T16:57:07.799Z Last Updated: 2025-02-12T18:50:59.349Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Avaya Products: Avaya Spaces Problem Types: CWE-79 Description: A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and potential disclose of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.avaya.com/css/public/documents/101091836
CVE ID: CVE-2024-12756 State: PUBLISHED Published: 2025-02-11T16:59:12.902Z Last Updated: 2025-10-01T01:30:33.461Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Avaya Products: Avaya Spaces Problem Types: CWE-1287 Description: An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.avaya.com/css/public/documents/101091836
CVE ID: CVE-2024-12757 State: PUBLISHED Published: 2025-01-17T17:41:38.174Z Last Updated: 2025-01-21T15:40:31.347Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Nedap Librix Products: Ecoreader Problem Types: CWE-306 Description: Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execute malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-02
CVE ID: CVE-2024-12758 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:36.418Z Description: No description available.
CVE ID: CVE-2024-12759 State: REJECTED Published: 2025-03-20T10:10:56.937Z Last Updated: 2025-04-15T15:54:10.390Z Description: No description available.
CVE ID: CVE-2024-12760 State: REJECTED Published: 2025-03-20T10:09:44.167Z Last Updated: 2025-04-15T15:54:55.605Z Description: No description available.
CVE ID: CVE-2024-12761 State: PUBLISHED Published: 2025-03-20T10:08:54.531Z Last Updated: 2025-03-20T19:00:51.197Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: brycedrennan Products: brycedrennan/imaginairy Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability exists in the brycedrennan/imaginairy repository, version 15.0.0. The vulnerability is present in the `/api/stablestudio/generate` endpoint, which can be exploited by sending an invalid request. This causes the server process to terminate abruptly, outputting `KILLED` in the terminal, and results in the unavailability of the server. This issue disrupts the server's functionality,
ILLED` in the terminal, and results in the unavailability of the server. This issue disrupts the server's functionality, affecting all users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/282900f4-2498-42c4-8ce7-ba5368aaf035
CVE ID: CVE-2024-12762 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:36.561Z Description: No description available.
CVE ID: CVE-2024-12763 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:03.765Z Description: No description available.
CVE ID: CVE-2024-12764 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:04.577Z Description: No description available.
CVE ID: CVE-2024-12765 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:05.415Z Description: No description available.
CVE ID: CVE-2024-12766 State: PUBLISHED Published: 2025-03-20T10:11:20.626Z Last Updated: 2025-03-20T13:08:13.183Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-918 Description: parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter `{"url":"http://steal.target"}`. Existing security mechanisms such as `forbid_remote_access(lollmsElfServer)`, `lollmsElfServer.confi
://steal.target"}`. Existing security mechanisms such as `forbid_remote_access(lollmsElfServer)`, `lollmsElfServer.config.headless_server_mode`, and `check_access(lollmsElfServer, request.client_id)` do not protect against this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a143a2e2-1293-4dec-b875-3312584bd2b1
CVE ID: CVE-2024-12767 State: PUBLISHED Published: 2025-05-15T20:09:40.026Z Last Updated: 2025-11-13T21:06:51.959Z Vendors: Unknown Products: buddyboss-platform Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e8997f90-d8e9-4815-8808-aa0183443dae/
CVE ID: CVE-2024-12768 State: PUBLISHED Published: 2025-02-01T06:00:03.095Z Last Updated: 2025-02-04T20:46:59.192Z Vendors: Unknown Products: Responsive iframe Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive iframe WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fe2e47f4-b89e-4c22-8d27-672da0fb99af/