Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
VE Program Container: References: - https://cert.pl/en/posts/2024/06/CVE-2024-1228/ - https://cert.pl/posts/2024/06/CVE-2024-1228/ - https://www.eurosoft.com.pl/eurosoft-przychodnia
CVE ID: CVE-2024-1229 State: PUBLISHED Published: 2024-05-09T20:03:25.268Z Last Updated: 2024-08-01T18:33:25.170Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: redbitcz Products: SimpleShop Problem Types: CWE-862 Missing Authorization Description: The SimpleShop plugin for WordPress is vulnerable to unauthorized disconnection from SimpleShop due to a missing capability check on the maybe_disconnect_simpleshop function in all versions up to, and including, 2.10.2. This makes it possible for unauthenticated attackers to disconnect the SimpleShop. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.c
eShop. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4dc39c47-3b99-4e43-b25d-a025f3d228b5?source=cve - https://plugins.trac.wordpress.org/browser/simpleshop-cz/trunk/src/Settings.php?rev=3019145#L341 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3080151%40simpleshop-cz&new=3080151%40simpleshop-cz&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1230 State: PUBLISHED Published: 2024-05-09T20:03:34.354Z Last Updated: 2024-08-01T18:33:25.312Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: redbitcz Products: SimpleShop Problem Types: CWE-284 Improper Access Control Description: The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybe_disconnect_simpleshop function. This makes it possible for unauthenticated attackers to disconnect the site from simpleshop via a forged request granted they can trick a site administrator into performing an action such as
site from simpleshop via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9870db7f-0c8e-44a4-aa0f-13709d773756?source=cve - https://plugins.trac.wordpress.org/browser/simpleshop-cz/trunk/src/Settings.php?rev=3019145#L341 - https://github.com/redbitcz/simpleshop-wp-plugin/commit/8b04c95bb29036658e6a5b1ef735440646e3199b
CVE ID: CVE-2024-1231 State: PUBLISHED Published: 2024-03-25T05:00:00.845Z Last Updated: 2025-03-19T20:04:28.792Z Vendors: Unknown Products: CM Download Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7d3968d9-61ed-4c00-8764-0360cf03255e/
CVE ID: CVE-2024-1232 State: PUBLISHED Published: 2024-03-25T05:00:01.133Z Last Updated: 2024-08-09T20:00:16.433Z Vendors: Unknown Products: CM Download Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2a29b509-4cd5-43c8-84f4-f86251dd28f8/
CVE ID: CVE-2024-1233 State: PUBLISHED Published: 2024-04-09T07:01:47.673Z Last Updated: 2025-11-07T20:40:30.662Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat JBoss Enterprise Application Platform, Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss
Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Red Hat JBoss Enterprise Application Platform Expansion Pack Problem Types: CWE-918 Description: A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:3559 - https://access.redhat.com/errata/RHSA-2024:3560 - https://access.redhat.com/errata/RHSA-2024:3561 - https://access.redhat.com/errata/RHSA-2024:3563 - https://access.redhat.com/errata/RHSA-2024:3580 - https://access.redhat.com/errata/RHSA-2024:3581 - https://access.redhat.com/errata/RHSA-2024:3583 - https://access.redhat.com/errata/RHSA-2025:9582 - https://access.redhat.com/errata/RHSA-2025:9583 - https://access.redhat.com/security/cve/CVE-2024-1233 - https://bugzilla.redhat.com/show_bug.cgi?id=2262849 - https://github.com/advisories/GHSA-v4mm-q8fv-r2w5 - https://
233 - https://bugzilla.redhat.com/show_bug.cgi?id=2262849 - https://github.com/advisories/GHSA-v4mm-q8fv-r2w5 - https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523 - https://issues.redhat.com/browse/WFLY-19226
CVE ID: CVE-2024-1234 State: PUBLISHED Published: 2024-03-13T15:26:35.418Z Last Updated: 2024-08-01T18:33:25.351Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: timstrifler Products: Exclusive Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary
ut escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1b87fe3d-a88d-477a-8d91-4d7c2dba4a43?source=cve - https://plugins.trac.wordpress.org/changeset/3042217/exclusive-addons-for-elementor
CVE ID: CVE-2024-1235 State: PUBLISHED Published: 2024-02-20T18:56:34.421Z Last Updated: 2024-08-01T18:33:25.055Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: livemesh Products: Elementor Addons by Livemesh Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom class field in all versions up to, and including, 8.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary
put escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/70bda4b7-e442-4956-b3cb-8df96043bcde?source=cve - https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/templates/addons/device-slider/loop.php#L33 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3032737%40addons-for-elementor%2Ftrunk&old=3026261%40addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail
il=&reponame=&new=3032737%40addons-for-elementor%2Ftrunk&old=3026261%40addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1236 State: PUBLISHED Published: 2024-02-20T18:56:27.656Z Last Updated: 2024-08-01T18:33:25.255Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Filterable Controls label icon parameter in all versions up to, and including, 5.9.8 due to in
ss-Site Scripting via the Filterable Controls label icon parameter in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43014ecd-72d9-44cc-be24-c0c9790ddc20?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php#L3259 - https://
ordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php#L3259 - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php#L3261 - https://plugins.trac.wordpress.org/changeset/3034127/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php
CVE ID: CVE-2024-1237 State: PUBLISHED Published: 2024-03-13T15:27:00.687Z Last Updated: 2024-08-01T18:33:25.334Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Elementor Header & Footer Builder Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the flyout_layout attribute in all versions up to, and including, 1.6.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to
tization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82644c46-205b-4005-bba8-6b3e45769639?source=cve - https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.24/inc/widgets-manager/widgets/class-navigation-menu.php#L1951 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034938%40header-footer-elementor&new=3034938%40header-footer
ordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034938%40header-footer-elementor&new=3034938%40header-footer-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1238 State: PUBLISHED Published: 2024-03-30T04:31:10.192Z Last Updated: 2024-08-01T18:33:25.337Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor addons Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button ID parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web
escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf195cca-4e07-41ff-bf26-9ad5fca3635d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3054091%40elementskit-lite&new=3054091%40elementskit-lite&sfp_email=&sfph_mail=#file18
CVE ID: CVE-2024-1239 State: PUBLISHED Published: 2024-03-16T02:34:26.986Z Last Updated: 2024-08-01T18:33:25.118Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor addons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to injec
ion and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1822fd58-0dba-4b15-9702-32e3aa4405b3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042291%40elementskit-lite&new=3042291%40elementskit-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1240 State: PUBLISHED Published: 2024-11-15T10:57:07.797Z Last Updated: 2024-11-15T19:07:26.471Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: pyload Products: pyload/pyload Problem Types: CWE-601 Description: An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other malicious activities. The issue is fixed in pyload-ng 0.5.0b3.dev79. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hun
issue is fixed in pyload-ng 0.5.0b3.dev79. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/eef9513d-ccc3-4030-b574-374c5e7b887e - https://github.com/pyload/pyload/commit/fe94451dcc2be90b3889e2fd9d07b483c8a6dccd
CVE ID: CVE-2024-1241 State: PUBLISHED Published: 2024-04-23T03:52:34.318Z Last Updated: 2024-08-01T18:33:25.295Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Watchdog Products: Watchdog Antivirus Problem Types: CWE-476 Description: Watchdog Antivirus v1.6.415 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002014 IOCTL code of the wsdk-driver.sys driver. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fluidattacks.com/advisories/cole/ - https://watchdog.dev/solutions/anti-virus/
CVE ID: CVE-2024-1242 State: PUBLISHED Published: 2024-02-20T18:56:19.129Z Last Updated: 2024-08-01T18:33:25.318Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and including, 4.10.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary
ut escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1026b753-e82b-4fa3-9023-c36ab9863b29?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3035504%40premium-addons-for-elementor%2Ftrunk&old=3025571%40premium-addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1243 State: PUBLISHED Published: 2025-06-11T01:15:13.116Z Last Updated: 2025-06-11T14:25:37.576Z Vendors: Wazuh Products: Wazuh Agent Problem Types: CWE-73, CWE-20 Description: Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pentraze.com/ -
ging and other similar attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pentraze.com/ - https://pentraze.com/vulnerability-reports/CVE-2024-1243/ - https://github.com/wazuh/wazuh/security/advisories/GHSA-3crh-39qv-fxj7
CVE ID: CVE-2024-1244 State: PUBLISHED Published: 2025-06-11T02:59:06.240Z Last Updated: 2025-06-11T13:31:20.308Z Vendors: OSSEC Products: OSSEC-HIDS Agent Problem Types: CWE-73, CWE-20 Description: Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: R
to SYSTEM via AD CS certificate forging and other similar attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pentraze.com/ - https://pentraze.com/vulnerability-reports/
CVE ID: CVE-2024-1245 State: PUBLISHED Published: 2024-02-09T19:43:58.153Z Last Updated: 2024-08-19T16:13:40.880Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-20 Description: Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page. A rogue administrator could put malicious code into the file tags or description attributes and, when another administrator opens the same file for editing, the malicious code could execute. The Concrete CMS Security team scored
r administrator opens the same file for editing, the malicious code could execute. The Concrete CMS Security team scored this 2.4 with CVSS v3 vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes - https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory
CVE ID: CVE-2024-1246 State: PUBLISHED Published: 2024-02-09T19:33:26.054Z Last Updated: 2025-04-24T15:46:51.612Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-20 Description: Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. This does not affec
he Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. This does not affect Concrete versions prior to version 9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes - https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory
CVE ID: CVE-2024-1247 State: PUBLISHED Published: 2024-02-09T18:58:24.672Z Last Updated: 2024-08-01T18:33:25.343Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-20 Description: Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the affected page. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N https://nvd.nist.gov/vuln-me
ete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Concrete versions below 9 do not include group types so they are not affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes - https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory
CVE ID: CVE-2024-1249 State: PUBLISHED Published: 2024-04-17T13:22:48.335Z Last Updated: 2025-11-20T07:11:34.898Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat AMQ Broker 7, Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.10, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, RHOSS-1.33-RHEL-8, RHSSO 7.6.8, Migration Toolkit for Applications 6, Migration Toolkit for Applications 7, Red Hat build of Apicurio Registry 2, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Developer Hub, Red Hat Fuse 7, Red Hat JBoss
curio Registry 2, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Developer Hub, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Process Automation 7, streams for Apache Kafka Problem Types: CWE-346 Description: A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's ava