Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11782 State: PUBLISHED Published: 2024-12-03T09:32:01.713Z Last Updated: 2024-12-03T11:23:41.208Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brandtoss Products: WP Mailster Problem Types: CWE-79 Description: The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mst_subscribe' shortcode in all versions up to, and including, 1.8.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/909beed4-06a9-4ec4-bf00-4072a38af82b?source=cve - https://plugins.trac.wordpress.org/browser/wp-mailster/tags/1.8.17.0/mailster/subscr/SubscriberPlugin.php#L216 - https://plugins.trac.wordpress.org/changeset/3198497/wp-mailster/trunk/mailster/subscr/SubscriberPlugin.php
CVE ID: CVE-2024-11783 State: PUBLISHED Published: 2024-12-20T06:59:09.877Z Last Updated: 2024-12-20T17:37:04.160Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: financecalculatorwp Products: Financial Calculator Problem Types: CWE-79 Description: The Financial Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'finance_calculator' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will ex
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9314970-1030-4488-8147-05ba1453182c?source=cve - https://plugins.trac.wordpress.org/browser/finance-calculator-with-application-form/tags/2.2.1/finance-calculator-with-aplication-form.php#L604
CVE ID: CVE-2024-11784 State: PUBLISHED Published: 2024-12-20T06:59:08.263Z Last Updated: 2024-12-20T17:37:29.445Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ticketsource Products: Sell Tickets Online – TicketSource Ticket Shop Problem Types: CWE-79 Description: The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop' shortcode in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to
ser supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/970826cf-316d-4fce-ac90-bf338c5ef3e4?source=cve - https://plugins.trac.wordpress.org/browser/ticketsource-events/trunk/includes/ticketsource-events-build.php#L37 - https://wordpress.org/plugins/ticketsource-events/
CVE ID: CVE-2024-11785 State: PUBLISHED Published: 2024-12-12T05:24:23.299Z Last Updated: 2024-12-12T15:46:24.390Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hanthuy Products: Integrate Firebase Problem Types: CWE-79 Description: The Integrate Firebase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'firebase_show' shortcode in all versions up to, and including, 0.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9788e450-4e79-43ce-ae78-466eef458c29?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202693%40integrate-firebase&new=3202693%40integrate-firebase&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11786 State: PUBLISHED Published: 2024-11-28T08:47:35.258Z Last Updated: 2024-11-28T12:25:17.541Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wphostingdev Products: Login with Vipps and MobilePay Problem Types: CWE-79 Description: The Login with Vipps and MobilePay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'continue-with-vipps' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in page
t possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d015e6ce-641c-4d68-b42b-03c039e973bd?source=cve - https://plugins.trac.wordpress.org/browser/login-with-vipps/tags/1.3.3/VippsLogin.class.php#L724 - https://plugins.trac.wordpress.org/changeset/3197620/login-with-vipps/trunk/VippsLogin.class.php
CVE ID: CVE-2024-11787 State: PUBLISHED Published: 2024-11-27T23:34:08.859Z Last Updated: 2024-11-29T17:09:49.282Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-121 Description: Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V10 files
he target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24413. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1614/
CVE ID: CVE-2024-11788 State: PUBLISHED Published: 2024-11-28T08:47:30.227Z Last Updated: 2024-11-28T12:25:17.417Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: streamweasels Products: StreamWeasels YouTube Integration Problem Types: CWE-79 Description: The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sw-youtube-embed' shortcode in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in
es it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03c76e61-f263-459f-8618-7565225467e8?source=cve - https://wordpress.org/plugins/streamweasels-youtube-integration/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3197683%40streamweasels-youtube-integration&new=3197683%40streamweasels-youtube-integration&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11789 State: PUBLISHED Published: 2024-11-27T23:34:14.031Z Last Updated: 2024-11-29T17:09:49.168Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-121 Description: Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V10 files
he target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24448. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1615/
CVE ID: CVE-2024-11790 State: PUBLISHED Published: 2024-11-27T23:34:18.453Z Last Updated: 2024-11-29T17:09:49.009Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-121 Description: Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V10 files
he target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24449. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1616/
CVE ID: CVE-2024-11791 State: PUBLISHED Published: 2024-11-27T23:34:23.304Z Last Updated: 2024-11-29T17:09:48.897Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-121 Description: Fuji Electric Monitouch V-SFT V8C File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8C files
he target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8C files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24450. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1617/
CVE ID: CVE-2024-11792 State: PUBLISHED Published: 2024-11-27T23:34:28.147Z Last Updated: 2024-11-29T17:09:48.771Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-121 Description: Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files.
e target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24502. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1618/
CVE ID: CVE-2024-11793 State: PUBLISHED Published: 2024-11-27T23:34:32.078Z Last Updated: 2024-11-29T16:59:47.581Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-787 Description: Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V9C files. The is
t must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V9C files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24503. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1619/
CVE ID: CVE-2024-11794 State: PUBLISHED Published: 2024-11-27T23:34:36.653Z Last Updated: 2024-11-29T16:59:47.461Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-787 Description: Fuji Electric Monitouch V-SFT V10 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V10 files. The is
t must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24504. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1620/
CVE ID: CVE-2024-11795 State: PUBLISHED Published: 2024-11-27T23:34:41.798Z Last Updated: 2024-11-29T16:59:47.336Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-121 Description: Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files.
e target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24505. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1621/
CVE ID: CVE-2024-11796 State: PUBLISHED Published: 2024-11-27T23:34:45.779Z Last Updated: 2024-11-29T16:59:47.224Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-787 Description: Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V9C files. The is
t must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V9C files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24506. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1622/
CVE ID: CVE-2024-11797 State: PUBLISHED Published: 2024-11-27T23:34:50.024Z Last Updated: 2024-11-29T16:59:47.107Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-787 Description: Fuji Electric Monitouch V-SFT V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files. The issu
must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24662. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1623/
CVE ID: CVE-2024-11798 State: PUBLISHED Published: 2024-11-27T23:34:53.455Z Last Updated: 2024-11-29T16:59:46.980Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT Problem Types: CWE-787 Description: Fuji Electric Monitouch V-SFT X1 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X1 files. The issu
must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X1 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24663. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1624/
CVE ID: CVE-2024-11799 State: PUBLISHED Published: 2024-11-27T23:34:57.579Z Last Updated: 2024-11-29T16:45:20.598Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite Problem Types: CWE-121 Description: Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files
the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24664. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1625/
CVE ID: CVE-2024-11800 State: PUBLISHED Published: 2024-11-27T23:35:01.965Z Last Updated: 2024-11-29T16:49:44.955Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite Problem Types: CWE-121 Description: Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files
the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24768. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1626/
CVE ID: CVE-2024-11801 State: PUBLISHED Published: 2024-11-27T23:35:06.196Z Last Updated: 2024-11-29T16:49:30.465Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite Problem Types: CWE-787 Description: Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files in the
et must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files in the V-Simulator 5 component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24769. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1627/