Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11676 State: PUBLISHED Published: 2024-11-26T00:31:04.233Z Last Updated: 2024-11-26T15:33:07.591Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Hospital Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /backend/admin/his_admin_add_lab_equipment.php of the component Add Laboratory Equipment Page. The manipulation of the argument eqp_code/eqp_name/eqp_vendor/eqp_desc/eqp_dept/eqp_status/eqp_qty leads to cross site scripting. The attack may be launched remotely. The expl
vendor/eqp_desc/eqp_dept/eqp_status/eqp_qty leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286016 - https://vuldb.com/?ctiid.286016 - https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md - https://www.youtube.com/watch?v=UsScmd8Xzuw - https://codeastro.com/
CVE ID: CVE-2024-11677 State: PUBLISHED Published: 2024-11-26T01:00:20.559Z Last Updated: 2024-11-26T15:27:08.144Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Hospital Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /backend/admin/his_admin_add_vendor.php of the component Add Vendor Details Page. The manipulation of the argument v_name/v_adr/v_number/v_email/v_phone/v_desc leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public a
to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286017 - https://vuldb.com/?ctiid.286017 - https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md - https://www.youtube.com/watch?v=UsScmd8Xzuw - https://codeastro.com/
CVE ID: CVE-2024-11678 State: PUBLISHED Published: 2024-11-26T01:31:04.638Z Last Updated: 2024-11-26T15:26:13.327Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Hospital Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /backend/doc/his_doc_register_patient.php. The manipulation of the argument pat_fname/pat_ailment/pat_lname/pat_age/pat_dob/pat_number/pat_phone/pat_type/pat_addr leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public
t_addr leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286018 - https://vuldb.com/?ctiid.286018 - https://vuldb.com/?submit.448789 - https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md - https://codeastro.com/
CVE ID: CVE-2024-11679 State: PUBLISHED Published: 2025-04-11T18:21:06.375Z Last Updated: 2025-04-11T18:46:00.771Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: System x3550 M5, System x3560 M5 Problem Types: CWE-125 Description: An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privileges to read the contents of memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-193044
CVE ID: CVE-2024-11680 State: PUBLISHED Published: 2024-11-26T09:55:23.588Z Last Updated: 2025-11-22T12:24:39.978Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ProjectSend Products: ProjectSend Problem Types: CWE-306 Description: ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment:
to create accounts, upload webshells, and embed malicious JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 - https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml - https://vulncheck.com/advisories/projectsend-bypass
CVE ID: CVE-2024-11681 State: PUBLISHED Published: 2025-01-07T14:35:52.723Z Last Updated: 2025-01-07T15:04:25.786Z Vendors: MacPorts Products: MacPorts Problem Types: CWE-78 Description: A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/google/security-research/security/advisories/GHSA-2j38-pjh8-wfxw
CVE ID: CVE-2024-11682 State: PUBLISHED Published: 2024-12-21T07:03:02.657Z Last Updated: 2024-12-28T00:50:04.942Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: moonheart Products: G Web Pro Store Locator Problem Types: CWE-79 Description: The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addi
s in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb84b71e-7d4d-4bd7-88cb-1b86d7023edb?source=cve - https://plugins.trac.wordpress.org/browser/gwebpro-store-locator/trunk/gwebpro-store-locator-frontend.php#L452
CVE ID: CVE-2024-11683 State: PUBLISHED Published: 2024-12-12T03:23:11.667Z Last Updated: 2024-12-12T15:08:30.454Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: hanif-khan Products: Newsletter Subscriptions Problem Types: CWE-79 Description: The Newsletter Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_type' parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on
y web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0d1427-d01e-4054-8ba7-59d6878cfbea?source=cve - https://plugins.trac.wordpress.org/browser/newsletter-subscriptions/newsletter_subcriptions.php#L176
CVE ID: CVE-2024-11684 State: PUBLISHED Published: 2024-11-28T08:47:35.804Z Last Updated: 2024-11-28T12:25:17.899Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: iseardmedia Products: Kudos Donations – Easy donations and payments with Mollie Problem Types: CWE-79 Description: The Kudos Donations – Easy donations and payments with Mollie plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully
it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f281c9a5-1663-4dca-968f-685d933f99b1?source=cve - https://plugins.trac.wordpress.org/changeset/3197315/kudos-donations/tags/3.3.0/app/View/kudos-admin-subscriptions.php?old=3178869&old_path=kudos-donations%2Ftags%2F3.2.9%2Fapp%2FView%2Fkudos-admin-subscriptions.php - https://plugins.trac.wordpress.org/changeset/3197315/kudos-donations/tags/3.3.0/app/View/kudos-admin-transactions.php?old
ttps://plugins.trac.wordpress.org/changeset/3197315/kudos-donations/tags/3.3.0/app/View/kudos-admin-transactions.php?old=3178869&old_path=kudos-donations%2Ftags%2F3.2.9%2Fapp%2FView%2Fkudos-admin-transactions.php
CVE ID: CVE-2024-11685 State: PUBLISHED Published: 2024-11-28T08:47:34.138Z Last Updated: 2024-11-28T12:25:17.781Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: iseardmedia Products: Kudos Donations – Easy donations and payments with Mollie Problem Types: CWE-79 Description: The `Kudos Donations – Easy donations and payments with Mollie` plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of `add_query_arg` without appropriate escaping on the URL in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user
ssible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b02b5ea6-e112-4255-833c-87ee939986b0?source=cve - https://plugins.trac.wordpress.org/changeset/3197315/kudos-donations/tags/3.3.0/app/Controller/Table/TransactionsTable.php?old=3178869&old_path=kudos-donations%2Ftags%2F3.2.9%2Fapp%2FController%2FTable%2FTransactionsTable.php
CVE ID: CVE-2024-11686 State: PUBLISHED Published: 2025-01-09T11:11:01.148Z Last Updated: 2025-01-09T14:28:05.489Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: manycontacts Products: WhatsApp 🚀 click to chat Problem Types: CWE-79 Description: The WhatsApp 🚀 click to chat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'manycontacts_code' parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as c
ct arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d623840-30d1-4599-a52d-08c28e190699?source=cve - https://wordpress.org/plugins/manycontacts-bar/
CVE ID: CVE-2024-11687 State: PUBLISHED Published: 2024-12-06T08:24:56.655Z Last Updated: 2024-12-06T14:18:26.148Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: martinnguyen1990 Products: Next-Cart Store to WooCommerce Migration Problem Types: CWE-79 Description: The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perform
cated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/abcebcdb-e22a-4b6c-86db-f95b00260446?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202036%40nextcart-woocommerce-migration&new=3202036%40nextcart-woocommerce-migration&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11688 State: PUBLISHED Published: 2024-12-21T09:23:55.806Z Last Updated: 2024-12-28T00:48:59.905Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: van-abel Products: LaTeX2HTML Problem Types: CWE-79 Description: The LaTeX2HTML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ver' or 'date' parameter in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analys
at execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3d9af8b-1168-462d-a767-d16ee660f646?source=cve - https://plugins.trac.wordpress.org/browser/latex2html/trunk/inc/html/manual.php
CVE ID: CVE-2024-11689 State: PUBLISHED Published: 2024-12-12T03:23:05.861Z Last Updated: 2024-12-12T15:12:07.690Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: caagsoftware Products: HQ Rental Software Problem Types: CWE-352 Description: The HQ Rental Software plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.29. This is due to missing or incorrect nonce validation on the displaySettingsPage() function. This makes it possible for unauthenticated attackers to update arbitrary options that can be leveraged for privilege escalation via a forged request granted they can trick a site administrator into per
that can be leveraged for privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e9142b2-2935-4644-8c56-00789948202b?source=cve - https://plugins.trac.wordpress.org/browser/hq-rental-software/tags/1.5.29/includes/settings/HQRentalsAdminSettings.php#L74 - https://plugins.trac.wordpress.org/browser/hq-rental-software/tags/1.5.29/includes/settings/HQRentalsSettings.php#L489
CVE ID: CVE-2024-11690 State: PUBLISHED Published: 2025-01-07T04:21:57.591Z Last Updated: 2025-01-07T16:25:08.746Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: deios Products: Financial Stocks & Crypto Market Data Plugin Problem Types: CWE-79 Description: The Financial Stocks & Crypto Market Data Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'e' parameter in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing a
attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/210e9d94-ae2a-4dd9-a151-0bafbac68d18?source=cve - https://wordpress.org/plugins/live-stock-prices-for-wordpress/
CVE ID: CVE-2024-11691 State: PUBLISHED Published: 2024-11-26T13:33:55.946Z Last Updated: 2025-01-06T17:47:24.397Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Out-of-bounds write in Apple GPU drivers via WebGL Description: Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver. *This bug only affected the application on Apple M series hardware. Other platforms were unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18. Additional Analyst Notes: - CISA
Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1914707 - https://bugzilla.mozilla.org/show_bug.cgi?id=1924184 - https://www.mozilla.org/security/advisories/mfsa2024-63/ - https://www.mozilla.org/security/advisories/mfsa2024-64/ - https://www.mozilla.org/security/advisories/mfsa2024-65/ - https://www.mozilla.org/security/advisories/mfsa2024-67/ - https://www.mozilla.org/security/advisories/mfsa2024-68/ - https://www.mozilla.org/security/advisories/mfsa2024-70/
CVE ID: CVE-2024-11692 State: PUBLISHED Published: 2024-11-26T13:33:56.656Z Last Updated: 2025-11-03T21:51:55.987Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Select list elements could be shown over another site Description: An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1909535 - https://www.mozilla.org/security/advisories/mfsa2
: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1909535 - https://www.mozilla.org/security/advisories/mfsa2024-63/ - https://www.mozilla.org/security/advisories/mfsa2024-64/ - https://www.mozilla.org/security/advisories/mfsa2024-67/ - https://www.mozilla.org/security/advisories/mfsa2024-68/
CVE ID: CVE-2024-11693 State: PUBLISHED Published: 2024-11-26T13:33:57.608Z Last Updated: 2024-11-27T15:36:35.662Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Download Protections were bypassed by .library-ms files on Windows Description: The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1921458 - https://www.mozilla.
otes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1921458 - https://www.mozilla.org/security/advisories/mfsa2024-63/ - https://www.mozilla.org/security/advisories/mfsa2024-64/ - https://www.mozilla.org/security/advisories/mfsa2024-67/ - https://www.mozilla.org/security/advisories/mfsa2024-68/
CVE ID: CVE-2024-11694 State: PUBLISHED Published: 2024-11-26T13:33:57.989Z Last Updated: 2025-11-03T21:51:57.429Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: CSP Bypass and XSS Exposure via Web Compatibility Shims Description: Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18. Additional
Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1924167 - https://www.mozilla.org/security/advisories/mfsa2024-63/ - https://www.mozilla.org/security/advisories/mfsa2024-64/ - https://www.mozilla.org/security/advisories/mfsa2024-65/ - https://www.mozilla.org/security/advisories/mfsa2024-67/ - https://www.mozilla.org/security/advisories/mfsa2024-68/ - https://www.mozilla.org/security/advisories/mfsa2024-70/
CVE ID: CVE-2024-11695 State: PUBLISHED Published: 2024-11-26T13:33:58.459Z Last Updated: 2025-11-03T21:51:58.908Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters Description: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1925496 - https://www.mozilla.or
nt: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1925496 - https://www.mozilla.org/security/advisories/mfsa2024-63/ - https://www.mozilla.org/security/advisories/mfsa2024-64/ - https://www.mozilla.org/security/advisories/mfsa2024-67/ - https://www.mozilla.org/security/advisories/mfsa2024-68/
CVE ID: CVE-2024-11696 State: PUBLISHED Published: 2024-11-26T13:33:59.172Z Last Updated: 2025-11-03T21:52:00.429Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Unhandled Exception in Add-on Signature Verification Description: The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that t
e validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1929600 - https://www.mozilla.org/security/advisories/mfsa2024-63/ - https://www.mozilla.org/security/advisories/mfsa2024-64/ - https://www.mozilla.org/security/advisories/mfsa2024-67/ - https://www.mozilla.org
rg/security/advisories/mfsa2024-64/ - https://www.mozilla.org/security/advisories/mfsa2024-67/ - https://www.mozilla.org/security/advisories/mfsa2024-68/