Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11452 State: PUBLISHED Published: 2025-01-16T03:27:21.913Z Last Updated: 2025-01-16T15:15:52.275Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gwendydd Products: Chamber Dashboard Business Directory Problem Types: CWE-79 Description: The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'business_categories' shortcode in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts
makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/54e5989f-3d2c-4ed3-b4c4-f2589b885637?source=cve - https://plugins.trac.wordpress.org/browser/chamber-dashboard-business-directory/trunk/shortcodes/bus_cat_shortcode.php#L52 - https://plugins.trac.wordpress.org/changeset/3222548/
CVE ID: CVE-2024-11453 State: PUBLISHED Published: 2024-12-03T07:34:54.323Z Last Updated: 2024-12-03T11:23:42.933Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: samdani Products: WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout Problem Types: CWE-79 Description: The WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_pin_widget' shortcode in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentica
o insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/425cd0be-d17e-4c2b-bf29-3b850905a88e?source=cve - https://plugins.trac.wordpress.org/browser/gs-pinterest-portfolio/tags/1.8.8/includes/shortcode.php#L202 - https://plugins.trac.wordpress.org/changeset/3200115/gs-pinterest-portfolio/trunk/includes/shortcode.php
CVE ID: CVE-2024-11454 State: PUBLISHED Published: 2024-12-09T17:48:30.983Z Last Updated: 2025-08-28T14:35:08.803Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit Problem Types: CWE-426 Description: A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0025
CVE ID: CVE-2024-11455 State: PUBLISHED Published: 2024-11-21T02:06:24.103Z Last Updated: 2024-11-21T11:40:09.523Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wolfgang101 Products: Include Mastodon Feed Problem Types: CWE-79 Description: The Include Mastodon Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'include-mastodon-feed' shortcode in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execu
thenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ed075f2-778a-49f5-bd6e-439cd3f1cee6?source=cve - https://plugins.trac.wordpress.org/browser/include-mastodon-feed/tags/1.9.5/plugin.php#L730
CVE ID: CVE-2024-11456 State: PUBLISHED Published: 2024-11-21T08:31:10.959Z Last Updated: 2024-11-21T11:30:08.715Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mdedev Products: Run Contests, Raffles, and Giveaways with ContestsWP Problem Types: CWE-79 Description: The Run Contests, Raffles, and Giveaways with ContestsWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perfo
ticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1b68ff1e-ef79-4c11-a73c-591177d8dffe?source=cve - https://plugins.trac.wordpress.org/changeset/3192738/contest-code-checker/trunk/free/admin/prizes/class-prizes-table.php
CVE ID: CVE-2024-11457 State: PUBLISHED Published: 2024-12-07T11:09:54.038Z Last Updated: 2024-12-09T18:02:25.381Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: spartac Products: Feedpress Generator – External RSS Frontend Customizer Problem Types: CWE-79 Description: The Feedpress Generator – External RSS Frontend Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a
ble for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9660aee-1069-4197-b166-12ea30f8fd0c?source=cve - https://wordpress.org/plugins/feedpress-generator/#developers
CVE ID: CVE-2024-11458 State: PUBLISHED Published: 2024-11-28T08:47:34.694Z Last Updated: 2024-11-28T12:25:18.041Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ays-pro Products: FAQ Builder AYS Problem Types: CWE-79 Description: The FAQ Builder AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ays_faq_tab' parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional
ages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c509345b-441f-474d-ad3a-720801859f86?source=cve - https://plugins.trac.wordpress.org/browser/faq-builder-ays/tags/1.7.0/admin/partials/faq-builder-ays-admin-actions.php#L281 - https://plugins.trac.wordpress.org/browser/faq-builder-ays/tags/1.7.1/admin/partials/faq-builder-ays-admin-actions.php#L281 - https://plugins.trac.wordpress.org/browser/faq-builder-ays/tags/1.7.2/admin/partials/faq-builder-ays-admin-actions.php#L281
CVE ID: CVE-2024-11459 State: PUBLISHED Published: 2024-12-12T04:23:13.940Z Last Updated: 2024-12-12T15:47:12.008Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: karlkiesinger Products: Country Blocker Problem Types: CWE-79 Description: The Country Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Anal
that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8f2aaf-43db-412b-947c-ca1eb946c3aa?source=cve - https://plugins.trac.wordpress.org/browser/country-blocker/trunk/block-page.php#L605 - https://plugins.trac.wordpress.org/browser/country-blocker/trunk/block-page.php#L597
CVE ID: CVE-2024-11460 State: PUBLISHED Published: 2024-12-06T09:22:59.962Z Last Updated: 2024-12-06T17:09:26.529Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: pictureplanet Products: Verowa Connect Problem Types: CWE-89 Description: The Verowa Connect plugin for WordPress is vulnerable to SQL Injection via the 'search_string' parameter in all versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive inform
ed attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5da47f6-4cfe-480e-9472-bd5efc8bac71?source=cve - https://plugins.trac.wordpress.org/browser/verowa-connect/trunk/general/rest-routes.php#L92 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201030%40verowa-connect&new=3201030%40verowa-connect&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11461 State: PUBLISHED Published: 2024-12-03T07:34:58.642Z Last Updated: 2024-12-03T11:23:42.474Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: taunoh Products: Form Data Collector Problem Types: CWE-79 Description: The Form Data Collector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional
ages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6dba72ee-7c38-4e10-9c0c-35d12aa83442?source=cve - https://plugins.trac.wordpress.org/browser/form-data-collector/tags/2.2.3/index.php#L165 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3199031%40form-data-collector&new=3199031%40form-data-collector&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11462 State: PUBLISHED Published: 2024-12-14T04:23:42.685Z Last Updated: 2024-12-16T17:50:33.540Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: filestack Products: Filestack Official Problem Types: CWE-79 Description: The Filestack Official plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fstab' and 'filestack_options' parameters in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as cli
arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/559a94d8-527d-48b3-a917-461ebfa012bc?source=cve - https://plugins.trac.wordpress.org/browser/filestack-upload/tags/2.0.0/lib/admin-settings.php#L103
CVE ID: CVE-2024-11463 State: PUBLISHED Published: 2024-11-23T03:25:47.408Z Last Updated: 2024-11-23T13:18:21.034Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: debounce Products: DeBounce Email Validator Problem Types: CWE-79 Description: The DeBounce Email Validator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'from', 'to', and 'key' parameters in all versions up to, and including, 5.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as
ect arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39e8c8e1-5bf4-4e4a-91a3-cf884cccf374?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3194566%40debounce-io-email-validator&new=3194566%40debounce-io-email-validator&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11464 State: PUBLISHED Published: 2024-12-07T11:09:52.644Z Last Updated: 2024-12-09T16:07:20.347Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: alphabposervice Products: Easy Code Snippets Problem Types: CWE-79 Description: The Easy Code Snippets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Add
ts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31f5ddbf-2014-40e7-881d-27148bf133ff?source=cve - https://wordpress.org/plugins/easy-code-snippets/#developers
CVE ID: CVE-2024-11465 State: PUBLISHED Published: 2025-01-07T04:21:56.824Z Last Updated: 2025-01-07T16:25:33.618Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: eherman24 Products: Custom Product Tabs for WooCommerce Problem Types: CWE-502 Description: The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikes_woo_products_tabs' post meta parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. I
Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad0d6eb-aafa-4f0b-bf1c-73d94e361087?source=cve - https://plugins.trac.wordpress.org/browser/yikes-inc-easy-custom-woocommerce-product-tabs/trunk/yikes-inc-easy-custom-woocommerce-product-tabs.php#L262 - https://plugins.trac.wordpress.org/browser/yikes-inc-easy-custom-
es-inc-easy-custom-woocommerce-product-tabs.php#L262 - https://plugins.trac.wordpress.org/browser/yikes-inc-easy-custom-woocommerce-product-tabs/trunk/admin/class.yikes-woo-generate-html.php#L19 - https://plugins.trac.wordpress.org/browser/yikes-inc-easy-custom-woocommerce-product-tabs/trunk/admin/class.yikes-woo-saved-tabs.php#L222 - https://plugins.trac.wordpress.org/browser/yikes-inc-easy-custom-woocommerce-product-tabs/trunk/admin/class.yikes-woo-saved-tabs.php#L449 - https://plugins.trac.wordpress.org/browser/yikes-inc-easy-custom-woocommerce-product-tabs/trunk/public/class.yikes-woo-tabs-display.php#L47
CVE ID: CVE-2024-11466 State: PUBLISHED Published: 2024-12-04T07:32:24.645Z Last Updated: 2024-12-04T21:04:03.987Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tomasgroulik Products: Intro Tour Tutorial DeepPresentation Problem Types: CWE-79 Description: The Intro Tour Tutorial DeepPresentation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action
rs to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe082a7-3d36-48b4-b81f-1e65e5ea430d?source=cve - https://plugins.trac.wordpress.org/browser/dp-intro-tours/tags/6.5.2/admin/class-dp-intro-tours-admin-settings.php#L125 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198780%40dp-intro-tours&new=3198780%40dp-intro-tours&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11467 State: PUBLISHED Published: 2025-02-04T22:12:39.209Z Last Updated: 2025-02-05T15:05:31.472Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Omnissa Products: Omnissa Horizon Client for MacOS Problem Types: Logic Flaw Vulnerability Description: Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successful exploitation of this issue may allow attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://static.omnissa.com/sites/default/file
nstalled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://static.omnissa.com/sites/default/files/OMSA-2024-0002.pdf - https://www.omnissa.com/omnissa-security-response/
CVE ID: CVE-2024-11468 State: PUBLISHED Published: 2025-02-04T22:17:33.319Z Last Updated: 2025-02-05T15:39:33.820Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Omnissa Products: Omnissa Horizon Client for MacOS Problem Types: Installer Process Vulnerability Description: Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process. Successful exploitation of this issue may allow attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://static.o
Horizon Client for macOS is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://static.omnissa.com/sites/default/files/OMSA-2024-0002.pdf - https://www.omnissa.com/omnissa-security-response/
CVE ID: CVE-2024-11477 State: PUBLISHED Published: 2024-11-22T20:22:33.278Z Last Updated: 2025-02-15T00:10:31.081Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: 7-Zip Products: 7-Zip Problem Types: CWE-191 Description: 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper val
specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1532/
CVE ID: CVE-2024-11478 State: REJECTED Published: N/A Last Updated: 2025-07-30T22:19:02.730Z Description: No description available.
CVE ID: CVE-2024-11479 State: PUBLISHED Published: 2024-12-04T00:23:39.944Z Last Updated: 2024-12-04T14:49:43.102Z Vendors: Issuetrak Products: Issuetrak Problem Types: CWE-79, CWE-80 Description: A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes
CVE ID: CVE-2024-11481 State: PUBLISHED Published: 2024-11-29T07:01:44.562Z Last Updated: 2024-11-29T13:55:59.611Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Trellix Products: Trellix Enterprise Security Manager (ESM) Problem Types: CWE-22 Description: A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thrive.trellix.com/s/article/000014058
CVE ID: CVE-2024-11482 State: PUBLISHED Published: 2024-11-29T07:03:33.494Z Last Updated: 2025-03-18T14:56:37.259Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trellix Products: Trellix Enterprise Security Manager (ESM) Problem Types: CWE-78 Description: A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://thrive.trellix.com/s/article/000014058#h2_0
CVE ID: CVE-2024-11483 State: PUBLISHED Published: 2024-11-25T03:54:34.342Z Last Updated: 2025-11-20T18:21:42.049Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 Problem Types: CWE-284 Description: A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’