Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47613 State: PUBLISHED Published: 2024-12-11T19:14:02.436Z Last Updated: 2025-11-03T20:39:55.973Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-476 Description: GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_dec_flush` within `gstgdkpixbufdec.c`. This function invokes `memcpy`, using `out_pix` as the destination address. `out_pix` is expected to point to the frame 0 from the frame structure, which is read from the input file. However, in certain situations, it can points to a NULL frame, causing the subsequent call to `memcpy` to attempt writing to the nu
certain situations, it can points to a NULL frame, causing the subsequent call to `memcpy` to attempt writing to the null address (0x00), leading to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041.patch - https://gstreamer.freedesktop.org/security/sa-2024-0025.html
CVE ID: CVE-2024-47614 State: PUBLISHED Published: 2024-10-03T14:29:59.124Z Last Updated: 2024-10-03T15:47:22.144Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: async-graphql Products: async-graphql Problem Types: CWE-770 Description: async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/async-graphql/async-graphql/security/advisories/GHSA-5gc2-7c65-8fq8 - htt
Vulnrichment: References: - https://github.com/async-graphql/async-graphql/security/advisories/GHSA-5gc2-7c65-8fq8 - https://github.com/async-graphql/async-graphql/commit/7f1791488463d4e9c5adcd543962173e2f6cbd34
CVE ID: CVE-2024-47615 State: PUBLISHED Published: 2024-12-11T19:13:47.894Z Last Updated: 2025-11-03T22:20:21.623Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-787 Description: GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a result, size can exceed the fixed size of the pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 by
es the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038.patch - https://gstreamer.freedesktop.org/security/sa-2024-0026.html
CVE ID: CVE-2024-47616 State: PUBLISHED Published: 2024-10-02T21:10:24.146Z Last Updated: 2024-10-03T15:43:26.879Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: pomerium Products: pomerium Problem Types: CWE-863 Description: Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium services in the same deployment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be tre
yment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be treated as valid for the purpose of databroker API authorization. Improper access to the databroker API could allow exfiltration of user info, spoofing of user sessions, or tampering with Pomerium routes, policies, and other settings. A Pomerium deployment is susceptible to this issue if all of the following conditions are met, you have issued a service account access token using Pomerium Zero or Pomerium Enterprise, the access token has an explicit expiration date in the future, and the core Pomerium databroker gRPC API is not otherwise secured by network access controls. Thi
n date in the future, and the core Pomerium databroker gRPC API is not otherwise secured by network access controls. This vulnerability is fixed in 0.27.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pomerium/pomerium/security/advisories/GHSA-r7rh-jww5-5fjr - https://github.com/pomerium/pomerium/commit/e018cf0fc0979d2abe25ff705db019feb7523444 - https://github.com/pomerium/pomerium/releases/tag/v0.27.1
CVE ID: CVE-2024-47617 State: PUBLISHED Published: 2024-10-03T14:24:44.300Z Last Updated: 2024-10-08T13:33:43.219Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sulu Products: sulu Problem Types: CWE-79 Description: Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fix
ive information, manipulate the website's content, or perform actions on behalf of the victim. This vulnerability is fixed in 2.6.5 and 2.5.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85 - https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda - https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29
CVE ID: CVE-2024-47618 State: PUBLISHED Published: 2024-10-03T14:18:02.129Z Last Updated: 2024-10-18T14:42:45.592Z Vendors: sulu Products: sulu Problem Types: CWE-79 Description: Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers. This issue is fixed in 2.6.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sulu/sulu/security/advisories/GHSA-255w-87rh-rg44 - https://github.com/sulu/sulu/commit/ca72f7
ces: - https://github.com/sulu/sulu/security/advisories/GHSA-255w-87rh-rg44 - https://github.com/sulu/sulu/commit/ca72f75eebe41ea7726624d8aea7da6c425f1eb9
CVE ID: CVE-2024-47619 State: PUBLISHED Published: 2025-05-07T15:12:02.118Z Last Updated: 2025-05-28T10:03:45.900Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: syslog-ng Products: syslog-ng Problem Types: CWE-295 Description: syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue. Additional Analyst No
connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-xr54-gx74-fghg - https://github.com/syslog-ng/syslog-ng/commit/dadfdbecde5bfe710b0a6ee5699f96926b3f9006 - https://github.com/syslog-ng/syslog-ng/blob/b0ccc8952d333fbc2d97e51fddc0b569a15e7a7d/lib/transport/tls-verifier.c#L78-L110 - https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.2
CVE ID: CVE-2024-47621 State: PUBLISHED Published: 2024-10-05T14:37:26.731Z Last Updated: 2024-10-07T13:19:01.161Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Katie Seaborn Products: Zotpress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Katie Seaborn Zotpress allows Stored XSS.This issue affects Zotpress: from n/a through 7.3.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/zotpress/wordpress-zotpress-plugin-7-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47622 State: PUBLISHED Published: 2024-10-05T14:36:20.406Z Last Updated: 2024-10-07T13:19:17.045Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ILLID Products: Advanced Woo Labels Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels allows Stored XSS.This issue affects Advanced Woo Labels: from n/a through 2.01. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-woo-labels/wordpress-advanced-woo-labels-plugin-2-01-cross-site-scripting-xss-vulnerability?_s_i
/vulnerability/advanced-woo-labels/wordpress-advanced-woo-labels-plugin-2-01-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47623 State: PUBLISHED Published: 2024-10-05T14:35:23.529Z Last Updated: 2024-10-07T13:55:27.740Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: GhozyLab, Inc. Products: Gallery Lightbox Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GhozyLab, Inc. Gallery Lightbox allows Stored XSS.This issue affects Gallery Lightbox: from n/a through 1.0.0.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gallery-lightbox-slider/wordpress-gallery-lightbox-plugin-1-0-0-39-cross-site-scripting-xss-
.com/database/vulnerability/gallery-lightbox-slider/wordpress-gallery-lightbox-plugin-1-0-0-39-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47624 State: PUBLISHED Published: 2024-10-05T14:29:44.459Z Last Updated: 2024-10-07T13:59:10.079Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: BannerSky Products: BSK Forms Blacklist Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky BSK Forms Blacklist allows Reflected XSS.This issue affects BSK Forms Blacklist: from n/a through 3.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bsk-gravityforms-blacklist/wordpress-bsk-forms-blacklist-plugin-3-8-1-reflected-cross-site-scri
m/database/vulnerability/bsk-gravityforms-blacklist/wordpress-bsk-forms-blacklist-plugin-3-8-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47625 State: PUBLISHED Published: 2024-10-05T13:32:43.813Z Last Updated: 2024-10-07T14:00:44.774Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemeLooks Products: Enter Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeLooks Enter Addons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/enteraddons/wordpress-enter-addons-ultimate-template-builder-for-elementor-plugin-2-1-8-cross-site-scripting-xss-vu
lity/enteraddons/wordpress-enter-addons-ultimate-template-builder-for-elementor-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47626 State: PUBLISHED Published: 2024-10-05T13:31:23.871Z Last Updated: 2024-10-07T14:02:52.752Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Rometheme Products: RomethemeKit For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rometheme RomethemeKit For Elementor allows Stored XSS.This issue affects RomethemeKit For Elementor: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/rometheme-for-elementor/wordpress-romethemekit-for-elementor-plugin-1-5-0-c
ttps://patchstack.com/database/vulnerability/rometheme-for-elementor/wordpress-romethemekit-for-elementor-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47627 State: PUBLISHED Published: 2024-10-05T13:30:15.791Z Last Updated: 2024-10-07T14:03:51.611Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Travel Products: WP Travel Gutenberg Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through 3.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-travel-blocks/wordpress-wp-travel-gutenberg-blocks-plugin-3-6-0-cross-si
ttps://patchstack.com/database/vulnerability/wp-travel-blocks/wordpress-wp-travel-gutenberg-blocks-plugin-3-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47628 State: PUBLISHED Published: 2024-10-05T13:23:04.493Z Last Updated: 2024-10-07T14:04:59.085Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: LA-Studio Products: LA-Studio Element Kit for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-eleme
Vulnrichment: References: - https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47629 State: PUBLISHED Published: 2024-10-05T13:21:53.103Z Last Updated: 2024-10-07T13:19:32.439Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: BdThemes Products: Ultimate Store Kit Elementor Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ultimate-store-kit/wordpress-ultimate-store-kit-el
richment: References: - https://patchstack.com/database/vulnerability/ultimate-store-kit/wordpress-ultimate-store-kit-elementor-addons-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47630 State: PUBLISHED Published: 2024-10-05T13:20:38.867Z Last Updated: 2024-10-07T13:19:48.430Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ElementInvader Products: ElementInvader Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ElementInvader ElementInvader Addons for Elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through 1.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/elementinvader-addons-for-elementor/wo
ISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/elementinvader-addons-for-elementor/wordpress-elementinvader-addons-for-elementor-plugin-1-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47631 State: PUBLISHED Published: 2024-10-05T13:11:14.310Z Last Updated: 2024-10-07T13:20:04.156Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins LLC Products: Logo Carousel – Clients logo carousel for WP Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins LLC Logo Carousel – Clients logo carousel for WP allows Stored XSS.This issue affects Logo Carousel – Clients logo carousel for WP: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/responsive-client
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/responsive-client-logo-carousel-slider/wordpress-logo-carousel-clients-logo-carousel-for-wp-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47632 State: PUBLISHED Published: 2024-10-05T13:10:03.616Z Last Updated: 2024-10-07T13:20:19.594Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: deTheme Products: DethemeKit For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dethemekit-for-elementor/wordpress-dethemekit-for-elementor-plugin-2-1-7-cross-site-s
chstack.com/database/vulnerability/dethemekit-for-elementor/wordpress-dethemekit-for-elementor-plugin-2-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47633 State: PUBLISHED Published: 2024-10-05T13:08:36.405Z Last Updated: 2024-10-07T13:20:35.432Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Zoho Forms Products: Zoho Forms Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zoho Forms allows Stored XSS.This issue affects Zoho Forms: from n/a through 4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/zoho-forms/wordpress-zoho-forms-plugin-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47634 State: PUBLISHED Published: 2024-10-20T10:29:41.741Z Last Updated: 2024-10-21T19:05:55.635Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Streamline.lv Products: CartBounty – Save and recover abandoned carts for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Streamline.Lv CartBounty – Save and recover abandoned carts for WooCommerce allows Cross Site Request Forgery.This issue affects CartBounty – Save and recover abandoned carts for WooCommerce: from n/a through 8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-s
.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-save-abandoned-carts/wordpress-cartbounty-plugin-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-47635 State: PUBLISHED Published: 2024-10-05T13:07:16.605Z Last Updated: 2024-10-07T14:07:24.341Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: TinyPNG Products: TinyPNG Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in TinyPNG.This issue affects TinyPNG: from n/a through 3.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tiny-compress-images/wordpress-tinypng-plugin-3-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-47636 State: PUBLISHED Published: 2024-10-10T18:04:47.824Z Last Updated: 2024-10-10T18:13:51.376Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Eyecix Products: JobSearch Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-jobsearch/wordpress-wp-jobsearch-plugin-2-5-9-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-47637 State: PUBLISHED Published: 2024-10-16T13:12:53.310Z Last Updated: 2024-10-16T13:43:35.504Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: LiteSpeed Technologies Products: LiteSpeed Cache Problem Types: CWE-23 Description: : Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through 6.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-6-4-1-path-traversal-vulnerability?_s_id=cve
CVE ID: CVE-2024-47638 State: PUBLISHED Published: 2024-10-05T13:03:21.928Z Last Updated: 2024-10-07T13:20:50.929Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: vCita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/databa
: from n/a through 4.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/meeting-scheduler-by-vcita/wordpress-online-booking-scheduling-calendar-for-wordpress-plugin-4-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47639 State: PUBLISHED Published: 2024-10-05T13:01:19.940Z Last Updated: 2024-10-07T13:21:07.887Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: VdoCipher Products: VdoCipher Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VdoCipher allows Stored XSS.This issue affects VdoCipher: from n/a through 1.29. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/vdocipher/wordpress-vdocipher-plugin-1-29-cross-site-scripting-xss-vulnerability?_s_id=cve